Every cloud has its own identity and access management system. AWS and Google use a bunch of JSON files specifying various rules. Open source projects like Kubernetes support three concurrent access control models - attribute-based, role-based and a webhook access control, all expressed using YAML. Some teams are going as far as inventing their own programming language to solve this evergreen problem.

Cloud security. Cloud architecture. Cloud storage. As you start scaling your business, you know “the cloud” is an important element of your IT capabilities. But, it can be a little confusing to understand the ins and outs of “the cloud” — especially when it comes to using cloud-based tools for your company to work remotely. Before we get into private vs public clouds, let’s quickly establish what we mean by cloud computing.

According to a seminal Clark School study, a hacker attacks a computer with internet access every 39 seconds. What’s more, almost a third of all Americans have been harmed by a hacker at one point or another, and more than two-thirds of companies have been victims of web-based attacks. A 2020 IBM study showed that the total cost of data breaches worldwide amounted to $3.9 million, which just may sound the death knell for many businesses affected by breaches.

Google Cloud Platform (GCP) is attracting a lot of companies, large and small, with its stability and many built-in services. But aggregated security monitoring has to be done via an external service. However, log aggregation for security purposes is a mandatory requirement of many standards and regulations. Those include GDPR, HIPAA, SOX, PSD2, PCI-DSS, ISO 27001 and many more.

The recent SolarWinds breach highlights a new paradigm in the Software Supply Chain. When compared simply to the code itself without any additional tools, Proprietary Code is no more secure than Open Source. By contrast, many would argue that Open Source Code is more secure due to a faster fix/patch/update cycle and the pervasive access to source code (Clarke, Dorwin, and Nash, n.d.).

Misconfigurations remain one of the most common risks in the technology world. Simply telling organisations to “fix” this problem, however, is not as easy as it might first seem because there’s a myriad of technologies at play in modern infrastructure deployments. All of this results in a complicated mix of hardening approaches for each system. What is key, then, is to identify where hardening is required and then consider the methodology for each area.

All organizations want to take advantage of the cost savings, operational efficiency, and improved capabilities that a shift to the cloud provides. But having the right protections in place is key to make sure not only your users are protected, but that your sensitive data is also protected. Especially as workforces become increasingly remote, improved functionality and cloud security are both must-haves for any organization.