Remote working is likely to persist for many organisations after the pandemic. In an environment where workers are no longer bound to an office, organisations are increasingly relying on digital tools, collaboration platforms and cloud technologies to enable remote access for their employees.
Against this backdrop, organisations are generating and moving more data than ever – with substantial amounts of sensitive material being stored in the cloud. This is creating new security risks for organisations because the more cloud-based platforms they use, the greater their attack surface becomes.
This matters because cloud account compromises can be costly. Almost nine in every 10 companies say the annual cost of such breaches is more than $500,000, according to a 2021 Ponemon survey. On average, companies experienced 64 cloud account compromises a year, with almost a third of those exposing sensitive data.
“What we see today is much more sophisticated cybercriminal activity than anything that we would have seen in the past,” says Michael McGrath, senior director for compliance and digital risk at Proofpoint. “It used to be that attacks were very brute force, but now attacks are becoming much more targeted at specific individuals or organisations, perhaps because an individual has access to valuable data – so they might not be attempting to defraud you, they want to access something you have.”
Given that the cloud environment is remote, hackers will more often want your login credentials because if they can emulate how you log in, they have access to everything you do
Insider threats are also seen as an increased risk, with 37% of chief information security officers flagging insider threats as the biggest security risk they face, according to Proofpoint’s Voice of the CISO 2021 report. In addition, phishing attacks are becoming more sophisticated.
“It’s not always that a link in an email is harmful, instead the hacker may look to bring you on a journey and then two or three links later you are doing what they want you to do,” says McGrath. “Given that the cloud environment is remote, hackers will more often want your login credentials because if they can emulate how you log in, they have access to everything you do.”
It is not just cybersecurity risks organisations face when migrating data to the cloud. There is also a risk that legacy data could be lost or destroyed when it is uploaded. Compliance is another concern. The General Data Protection Regulation (GDPR), for example, requires organisations to have policies in place to ensure personal data is properly safeguarded and not misused. Organisations need to protect themselves, their customers and employees from a whole range of risks relating to conduct, such as fraud, misselling and abuse. There is also a potential financial risk from opportunities missed if organisations aren’t effectively leveraging the value of their data, says McGrath.
To help mitigate all these risks, organisations need to change their mindset by accepting that work-from-anywhere is here to stay and that data security risks are more elevated as a result.
“What organisations need to do is to look at the problem from end-to-end – all data has a life cycle, from the instant it’s created through to its usage, its storage, and then when it gets disposed of. So organisations need to think about how to protect data at each phase of the life cycle,” says McGrath.
But organisations still must keep a broad view of cyber threats. That means they should be adopting a security solution that works across that whole data life cycle and in whatever cloud environment that data is stored. By having a holistic view of an organisation’s data, companies can start to generate predictive insights that can potentially flag high-risk targets – for instance, an employee who has access to sensitive data and has a propensity to click on links.
Cloud-based security systems also have advantages over traditional on-premise data security. First, organisations benefit from having a larger team of dedicated security experts guarding their data. Second, cloud security systems can monitor risks across multiple organisations. If one company is subject to an attack, the system can adjust in real time to ensure all the other organisations are shielded from the same attack.
“This means companies have better data protection and a better overall security posture,” says McGrath.
For more information please visit www.proofpoint.com
Promoted by Proofpoint
