How gaps in cloud system configuration can expose user data

Subject :Science and technology

Section: Awareness in computers

Context:

68% of businesses in India, and 75% globally, say that more than 40% of data stored in the cloud is classified as sensitive. And 35% of organisations in India note that their data was breached in a cloud environment last year.

What is cloud storage and why do companies use it?

Cloud storage is a method in which digital data, including files, business data, videos, or images, are stored on servers in off-site locations.
Companies use cloud storage to store, access and maintain data so they do not need to invest in operating and maintaining data centres.
These servers may be maintained by the companies themselves or by third-party providers responsible for hosting, managing, and securing stored data.
These servers can be accessed either by the public or through private internet connections, depending on the nature of the data.
An added advantage of cloud storage is its scalability; organisations can expand or reduce their data footprint depending on need.
Most cloud providers offer security features like physical security at data centres, in addition to zero-trust architecture, identity and access management, and encryption to ensure the security of data on their servers.

Risks associated with cloud storage:

The risks arise from deployment of incompatible legacy IT systems and third-party data storage architecture.
The use of weak authentication practices and easily guessable passwords can allow unauthorised individuals to access sensitive data.
There is the risk of exposure due to:
- Insecure APIs,
- Poorly designed or inadequate security controls,
- Internal threats due to human error and
- Inadequate encryption during transfer or storage.

How legacy systems weaken cloud storage setup?

Legacy IT security may have known vulnerabilities that are yet to be fixed.
Legacy systems may not be capable of supporting more advanced encryption techniques such as secure boot methods or hardware-based encryption.
Updating and auditing legacy systems when used in tandem cloud infrastructure is therefore important.

Data breaches and Data exposure in the cloud:

While in a data breach, confidential or protected information is exposed to unauthorised individuals, data exposure is often depicted as the unintentional disclosure or accidental disclosure of data, resulting from misconfiguration or human error.

What are system misconfigurations and how do they happen?

A system misconfiguration arises when there is a lack of thorough security configurations on the devices accessing the cloud data, the servers, or a weakness in the software used. Misconfigurations can either expose user data, making it accessible to unauthorised individuals, compromising security.

Who is liable for data protection in the cloud?

The onus of ensuring data security lies with the companies even though they grant access to data to vendors and partners. This includes checking cloud compliances like ensuring passwords have two-factor authentication, monitoring access to the database, ensuring it is encrypted, and ensuring all firewall rules are set so that only access through certain places and certain departments is allowed.

Data encryption:

Data encryption is seen as one of the most effective approaches for securing sensitive information in the cloud.
However, it comes with its own set of challenges which include:
- Encryption before data is stored,
- Ensuring the security of encryption keys, and
- Changing the encryption keys periodically to ensure continued safety.

What are the risks of data migration in the cloud?

There is risk involved when switching between vendors for cloud storage or when systems are upgraded.
Without a proper migration plan and process based on thorough assessment of the cloud provider, data could get exposed.

How can users keep their data safe?

When users get to know of possible data breaches, they are recommended to change passwords, two-factor authentication setup, push security question answers, and monitor accounts for unauthorised transactions and SMSs for suspicious activity.