Cloud security

Cloud security

Migrate to the cloud, but securely.

More and more companies are looking to move to the cloud for a variety of reasons. As almost all companies now process and analyse vast amounts of complex data, outsourcing is an immediate option. However, it is not only data that can be outsourced to the cloud for processing and analysis, but also all applications and functions. In addition to high initial costs such as the procurement of in-house hardware, this can save further expenses:

• Setting up the infrastructure and networks

• Time to commission and configure the hardware

• Setting up or purchasing expertise to set up and operate the hardware

• . Acquisition of expertise to set up and operate the IT environment

What makes cloud computing so interesting?

The world of information technology is in a constant state of infrastructural change. Starting with physical servers, we are now in a time where the term serverless is enjoying increasing popularity. But beware: "serverless" does not mean that servers are no longer in use, but simply that consumers have neither access to nor insight into them. With serverless computing, a backend service is provided by an external provider and you only pay for the effective utilisation of computing time. And that has many advantages. You can already guess at this point: in addition to the advantages, there are of course also disadvantages - often at the expense of security.

But let's stick to the advantages for now:

• Dynamic scalability: Depending on the workload, more or less computing power can be dynamically booked

• Financial dynamics: No investment costs in physical hardware, no hardware operation, computing power tailored to requirements

• High flexibility: Availability and use of software, applications and services independent of network, location and device

• Reduced effort: backup planning is the responsibility of the provider, hardware configuration, maintenance and commissioning is the responsibility of the provider, redundancy causes simple disaster recovery

• Increased data security

Cloud migration can be a good decision if you consider the security aspects.

The topic of data security is generally one of the advantages of cloud computing. This is because data redundancy, protection against data loss and flexible access and data processing are generally a profitable opportunity. We should therefore now look at which things can and should be outsourced and which are better not.

What can be outsourced to the cloud and what is better not?

In principle, everything that is operated locally can also be outsourced to the cloud. But you should keep one question in mind: What makes sense?"

The first step is to analyse your own use cases and select a suitable cloud or provider model based on this. At this point, always critically scrutinise whether the outsourcing of a use case will also lead to significant benefits. And it is essential to ensure that the use case is also secured locally.

Detailed information on the various cloud models and the associated shared responsibility can be found in our white paper.

When outsourcing data, careful consideration should be given: If the data is sensitive and subject to compliance requirements, it can be outsourced to the cloud, provided the provider fulfils the relevant requirements. However, if the data is so critical that a short-term disruption in availability would have a noticeable impact, then it is better to keep it locally.

How secure are cloud solutions?

The security of cloud solutions depends on three factors: the standards of the provider, the selected cloud model and the own security aspects. It can normally be assumed that cloud providers adhere to significantly higher standards in terms of security, availability, data backup and redundancy than non-IT companies. Errors on the part of the provider would have massive consequences and all customers would be affected in any case. Nevertheless, it must unfortunately be noted that innovations in digital processing such as cloud computing also bring with them new types of cybercrime.

Even if it seems as if you no longer have any means of applying your own security measures, you can take the following measures yourself:  

• Encryption of the data to be processed

• Security checks

• Application best practices

• Identity management

• Access management

It is and remains essential to keep the most important data and its backups on-premise data recovery. In the event of a cyberattack on the cloud provider, data can be lost as long as the only backup is located there. In the event of a cyberattack on your own servers, the data can be restored from the cloud via a backup. Hybrid or multicloud approaches should therefore be pursued. It is still advisable to take the classic route of offline backups on appropriate data storage media as an emergency backup.

It is clear that the selection of a suitable and reliable provider is essential for a secure cloud migration.

How to recognise a good cloud provider?

There are a few starting points for identifying a reliable and secure cloud provider. The first step is to evaluate a provider that offers the services you want to use. The second step is to look for key figures:

• Availability of services

• Number of failures and incidents

• Metrics such as KPIs

In addition to these rather informal indicators, there are a number of certifications that cloud providers can and should obtain. Here, it is particularly important to pay attention to common standards such as ISO, PCI and SOC.

Certifications at a glance:

• ISO 9001: Quality management - availability of performance and latencies

• ISO 27001: Security - in accordance with IT-Grundschutz

• ISO 27017: Cloud-specific controls

• ISO 27018: Protection of personal data

• PCI DSS: Payment Card Industry - Data Security Standard - primarily for the financial sector

• SOC1, SOC2, SOC3: Standards that evaluate security criteria, among other things

Start securely in the cloud now.