Muscle up your cybersecurity using Public Cloud
By: Antoine Lagier
Tags: Cloud Computing, Public Cloud, Cybersecurity, Security

In early 2019, if you searched for the keyword « Clusif CSV » in bing.com, you gained access to a list of the names of some 2200 IT Security experts (and not the lesser of them).

An ordinary data leak ? Well, yes and no : the funny thing about this leak is that the targeted entity was the CLUSIF, the french Information Security Professionals Club, whose goal is to unite professionals (both vendors and client-side) in the cybersecurity space to exchange ideas, best practices and experiences. I have no doubt what the topic of the next gathering may have been…

Nevertheless, let’s not poke too much fun at this mishap. Cybersecurity in the digital, ultra-connected, open & mobile world is not an easy task.

In this context, is the public cloud today an aggravating factor, or, quite the opposite, an ally to better secure your Information Systems and your Data ?

The reflex of CIOs is still, most of the time, to think that security is stronger “on premises” — when their data & infrastructure is in their own, well known Datacenters. They tend to favor public clouds only for non-sensitive data & applications.

A page is nevertheless being turned before our eyes : a recent McAfee study shows that 63% of the IT professionals now consider the Public Cloud as secure as as their own infrastructures.

At Timspirit, we think that the 37% who argue the opposite are wrong ! Here’s why.

Because Cybersecurity requires huge investments

Cybersecurity and Data compliance have become so important and complex that it is difficult, even for large organizations, to stay up to date and invest in the massive know-how, systems, tools, knowledge required.

To highlight this point, look at Google investment in this area :

After Heartbleed (2014), Google set up a ZeroDay vulnerability discovery team. Google Project Zero, goes beyond covering Google’s own services & products. It contributes to identify major security vulnerabilities and to correct them before they become public knowledge

Google has given away no less than $3 million in 2016 in its Bug Bounty program, that aims at securing its services

All vendors are investing heavily in research, academia, open source project contributions and to promote the adoption of security standards (such as the generalization of the https protocol)

Within these large Cloud Services Providers (Microsoft, Google, AWS), between 600 and 800 experts & professionals are working daily to guarantee Datacenter & Infrastructure security. Who, even within the largest Fortune 500 companies, can claim to invest as much?

Think Compliance. Again, it is difficult to achieve certifications for the many, country-dependent certifications that may be required by regulatory authorities. Here’s a quick list of AWS certifications.

Again, how much would it cost to achieve and maintain certification of your own infrastructures up to the same standards?

Theses means are not enough, of course, to actually guarantee that no security breach will occur in the public clouds. But they offer a strong base layer that is hard to replicate in house — and it would be foolish not to leverage it.

Because the public cloud helps clarify your security model

The standard security model that has been proposed by a large majority of cloud Providers is a shared responsibility model : the lower levels are taken care of by the provider, the higher levels being the client’s responsibility. Depending on the service model, the threshold gets allocated differently. The higher the outsourced level of the service, the higher the supplier responsibility. Nice, isn’t it ?