Five Ways for Companies to Improve Security in the Cloud
Web applications are constantly under threat. New research shows that of all the attacks aimed at the cloud, 73% are specifically aimed at web applications. With the threat against web apps increasing, and new regulations looming in the form of the GDPR, it’s time to refresh your memory on how best to secure your cloud implementations. Here are our top five tips.
1. Use Strong Authentication Tools
Making sure your users are who they say they are is about the most important, and the most obvious step that you can take to secure your cloud applications.
The traditional username/password combination is almost totally obsolete in terms of being an effect way to manage authentication. The safest way to proceed is to add two-factor or multifactor authentication to your application. Asking your users to sign in with one or more extra authentication methods on top of their username/password is an easy and efficient way to provide an additional layer of protection around your logins.
2. Set Proper Levels of Authorization
Authentication answers the question “who are you?” Authorization answers the question, “now that I know who you are, what are you allowed to do?”
Employees should be authorized to view and manipulate only those applications and data that are absolutely necessary for them to do their job. This mitigates against two bad outcomes:
- It prevents employees from gaining accesses to data they shouldn’t have and then doing things they shouldn’t do.
- It also ensures that even if a hacker steals their access, there’s only a small chance that they can access customer data, health information, credit card numbers etc.
But how do you maintain control of your users’ access permissions? An Identity and Access Management (IAM) solution can help you gain a centralized view of which users have permissions to access which applications, and let you define permission levels by user, user group or user job role. Assigning access rights to a role makes it easier to maintain control of those rights as people move around the organization through different job functions via transfer, promotion, etc.
3. Monitor and Log All User Activity
Let’s say that an attacker does manage to steal the login credentials for an individual with high-level authorizations. What then? This is where monitoring comes into play. With continuous real-time monitoring, you are able to spot if users start deviating wildly from their normal pattern of activity (then there’s a good chance they’ve been compromised), and can fix any security issue or breach before it becomes a major problem.
In addition to monitoring user activity, you also need to save it. For certain critical data, you will need to store a record whenever someone accesses or manipulates the data. Logging user data will allow you to prove to auditors that your safeguards are secure, and be able provide a report pf who has accesses what application at any given time and location in case of a serious breach.
4. Securely Offboard Cloud Users
As a rule of thumb, you don’t want individuals who leave your company to take your trade secrets with them. Securely offboarding your employees means taking away their accesses in order to deter IP theft, data breaches, and other undesirable outcomes.
This can be more difficult than it sounds. A departing employee might have access to dozens, if not hundreds, of individual cloud (and on-premises) applications. Imagine how long it will take to revoke access from them individually!
As mentioned above, keeping track of what cloud applications each user and/or job role have access to is a good start. However, you also need to ensure that you have proper processes in place for revoking user access permissions (deprovisioning) easily. An IAM solution consolidates user IDs and passwords into a single identity which can be turned on and off for all cloud (and other) applications at once. This means that your IT administrators don’t need to run through a checklist of applications when HR notifies them that an individual is no longer employed by the organization.
5. Ensure Compliance with Data Protection Regulations
The General Data Protection Regulation (GDPR) is a compliance regime intended to protect the data of citizens in the European Union that comes into force in May 2018. This regulation doesn’t just apply to EU companies – it affects every organization that does business with EU citizens and failure to comply can result in large fines.
Here are some of the provisions you’ll have to adapt to in order to comply:
- Corporations must specifically design their applications in order to prevent user privacy
- Companies must delete, on request, user information that’s found to be inaccurate
- Companies must now notify their users within 72 hours of a breach
If you’ve been following the advice above and are taking measure to ensure that you have control over who has access to what assets, what level of access they have and how those levels are maintained, you are already well on your way to compliance with some of the most important information security dictates of GDPR.
Safewhere can help you achieve compliance. Our federated IAM platform makes it easy for administrators to create, manage and revoke user access permissions. You can implement multi-factor authentication using any authentication method that you may require, while still providing your users with convenient single-sign-on access.
For more information on Safewhere and how we’ll help you negotiate cloud security, request a free demo today!
Feel free to repost this on your blog. But if you do so, please be so kind to mention the source and set a link to www.safewhere.com
