Remote working in the cloud: what’s the risk?

The cloud has proved a life­line to many organ­i­sa­tions dur­ing the coro­n­avirus pan­dem­ic. It has enabled a swift tran­si­tion from office to home work­ing, allowed firms to scale quick­ly in the switch to dig­i­tal ser­vices and con­tin­ues to under­pin their day-to-day oper­a­tions. How­ev­er, one aspect of the cloud con­tin­ues to cause con­cern: secu­ri­ty.

Forty-one per cent of organ­i­sa­tions still believe the office is a safer envi­ron­ment from a cyber­se­cu­ri­ty per­spec­tive, accord­ing to research from the Cloud Indus­try Forum. But what is it about work­ing over the cloud that prompts such con­cern for organ­i­sa­tions? Many of the doubts focus on data loss or a per­ceived lack of con­trol over their data.

“Many busi­ness­es that have held back from adopt­ing the cloud have done so through fear their data could be leaked. This stems from the fact that the cloud is a mul­ti-user envi­ron­ment where mul­ti­ple resources are shared,” says Lisa Ven­tu­ra, chief exec­u­tive of the UK Cyber Secu­ri­ty Asso­ci­a­tion.

“The basic val­ue propo­si­tion of the cloud is it offers near-unlim­it­ed stor­age to every­one. Data is often stored along with oth­er customer’s data, lead­ing to poten­tial data breach­es via third par­ties. 

‘With the use of cloud ser­vices such as Google Dri­ve, Microsoft Azure and Drop­box becom­ing more main­stream, organ­i­sa­tions must deal with new­er secu­ri­ty issues such as the loss of con­trol over sen­si­tive data held.”

Disappearing perimeters

Some indus­try experts, how­ev­er, argue it’s not nec­es­sar­i­ly work­ing over the cloud that height­ens the secu­ri­ty risk, but because many usu­al­ly office-based staff are now work­ing from home and there­fore out­side the secu­ri­ty pro­tec­tion their office net­works would usu­al­ly pro­vide.

“The cloud is anoth­er evo­lu­tion in the dis­so­lu­tion of the perime­ter. One of the key ben­e­fits of cloud is it enables access to crit­i­cal data from any­where at any time, but this cre­ates prob­lems for IT as it takes vital data out­side their purview,” says Ian Pratt, glob­al head of secu­ri­ty for per­son­al sys­tems at HP.

Com­pound­ing this, the pan­dem­ic-dri­ven tran­si­tion to remote work was hasti­ly enact­ed by most organ­i­sa­tions. Quick­ly estab­lish­ing could-based remote work­ing runs the risk of mis­con­fig­ured soft­ware as a ser­vice or cloud ser­vices.

“Much of the result­ing secu­ri­ty inci­dents we have seen are due to poor­ly thought-out remote work con­fig­u­ra­tions than cloud usage,” says Jim Reav­is, chief exec­u­tive of the Cloud Secu­ri­ty Alliance.

Practical measures

There are, how­ev­er, prac­ti­cal steps com­pa­nies can take to lim­it their vul­ner­a­bil­i­ty with­in the new work envi­ron­ment. These include con­trol­ling who has access to com­pa­ny data and tak­ing pass­words and encryp­tion more seri­ous­ly.

Cloud encryp­tion is crit­i­cal for pro­tec­tion, as it allows for data and text to be trans­formed using encryp­tion algo­rithms and placed on a stor­age cloud. Sim­i­lar­ly, organ­i­sa­tions should imple­ment two-fac­tor or mul­ti-fac­tor authen­ti­ca­tion, use dis­tinct orig­i­nal pass­words and con­sid­er pass­words with SMS, bio­met­ric fin­ger­print require­ments and smart­phone access con­trol sys­tems.

But it is just as cru­cial com­pa­nies engage their employ­ees in tak­ing cloud and cyber­se­cu­ri­ty seri­ous­ly. Tech­nol­o­gy can­not pro­vide all the answers and employ­ees are the first line of defence against cyber­at­tacks. This is par­tic­u­lar­ly impor­tant with phish­ing attacks cur­rent­ly at an all-time high; across Europe there was a 667 per cent increase in phish­ing scams in just one month dur­ing the pan­dem­ic.

“Being aware of what to look for would pre­vent falling vic­tim to a phish­ing email,” says Ken Roul­ston, man­ag­ing direc­tor at IT ser­vices provider CMI. “While it’s not nice from a cul­tur­al per­spec­tive, you have to oper­ate a zero-trust pol­i­cy. It’s like some­one knock­ing at the front door of your house; you don’t always open the door to every­one and you cer­tain­ly don’t let them in unless they are a known and trust­ed per­son.”

This zero-trust mod­el advo­cates that no user or sys­tem, either inside or out­side the cloud, is trust­ed until they have been ver­i­fied. Key is deploy­ing a robust cyber­se­cu­ri­ty aware­ness train­ing pro­gramme that involves the entire organ­i­sa­tion. 

Cybersecurity training

“When employ­ees are active­ly involved in pro­tect­ing com­pa­ny assets, they are more like­ly to take own­er­ship when it comes to secu­ri­ty mea­sures,” says Ven­tu­ra.

How­ev­er, this is an area still neglect­ed by many organ­i­sa­tions, accord­ing to a recent study by cyber­se­cu­ri­ty firm iomart. It found that while almost 20 per cent of firms said they had seen an increase in cyber­at­tacks due to remote working, 70 per cent con­ced­ed the busi­ness did not cur­rent­ly offer cyber­se­cu­ri­ty train­ing to all employ­ees.

So how can organ­i­sa­tions approach cybere­d­u­ca­tion for employ­ees, par­tic­u­lar­ly when in-per­son train­ing is off the table?

“Although it is more dif­fi­cult to imple­ment train­ing while employ­ees are work­ing from home, it is not impos­si­ble,” says Ven­tu­ra. “Elearn­ing, for exam­ple, is par­tic­u­lar­ly use­ful with a remote work­force. It is scal­able and eas­i­ly deployed to the entire organ­i­sa­tion and stud­ies have shown it pro­duces bet­ter learn­ing out­comes.”

At the same time, the secu­ri­ty team will have to play a much more active role, says Aman­da Finch, chief exec­u­tive of the Char­tered Insti­tute of Infor­ma­tion Secu­ri­ty. “Secu­ri­ty teams need com­plete­ly new skills, not only tech­ni­cal abil­i­ties, but the ‘soft’ skills nec­es­sary to engage and man­age their co-work­ers, teach them the risks and how to reduce them, and act as a coach or men­tor for those who will need a guid­ing hand to begin with,” she says.

With near­ly half of com­pa­nies say­ing they intend in future to allow employ­ees to work remote­ly full time, it is cru­cial they not only deploy tech­nolo­gies to pro­tect them in the cloud, but also devel­op a cul­ture of aware­ness and report­ing with­in the work­force to help defend staff from cloud-based threats.