What is the Current State of Cloud Cyber Security with phishing still prevalent?
Is Cyber security a serious problem in today’s digital world with phishing a top threat? Yes. Cybercrime is a term that describes any crime committed using blah blah blah
Enough of that
We have heard it continuously and yet attacks are still occurring right?
Let’s just go with this from US-CERT.
The United States Computer Emergency Readiness Team (US-CERT) defines cyber threats as “any action, not just criminal activity, that threatens confidentiality, integrity, or availability of data and systems”
Current state? Must do better.
The Future of Cyber Attacks in 2022
‘When we look at the future of cyber attacks, it is important to understand the different states that hacking can take. The first state is the most common one – where hacking is a crime and any attack on a system or network is illegal. The second state is when hacking becomes an act of war. This means that if two countries are in conflict, they can legally hack each other’s systems and networks. In this case, there are no laws against hacking and it’s just considered as another form of warfare. The third state is when cyber attacks become a weaponized form of terrorism where hackers use their skills to attack governments and private companies with intent to scare people into submission or to cause disruption in society.‘
Small and medium sized businesses rarely stand a chance against state or state sponsored adversaries. Throw in the blatant disregard of the adversary having backdoor access and encryption removed and the future is poor. Insider threat coupled with backdoors and no encryption for the power hungry really does need some common sense invited back to the table. The latest attack on mailchimp can be explored here
So call out those cloud providers that are allowing you to be phished or allowing bots on their platforms and then charging you hard earned money from the coal face of industry to then defend against them.
Future of cyber attacks? Rising (until common sense addresses unaccountable power hungry people)
The Future of Cyber Defence in 2022
The future of cybersecurity is a topic of great interest for many companies and individuals. The future state of cybersecurity in 2022 has been analysed by experts as always with predictions everywhere. Cybersecurity is hard to predict. However, experts believe that cyberattacks will likely become more sophisticated and difficult to detect.
Is that prediction based on knowing that cloud security and associated logs are akin to the holy grail inside a black hole?
That said it’s important for companies to start investing and protecting cybersecurity now so they can be prepared for what’s coming in the future.
More research has recently been released in the UK by the DCMS? and can be found here Make of it what you will, but cloud security is remarkably absent as a topic.
Over the last 12 months, 97% of UK businesses have been affected by cyber-security breaches. In this survey, businesses reported a variety of different breaches including data leaks and malware attacks.
Phishing is a huge issue and one of the most successful attacks on small and medium sized businesses. Many businesses are being caught out by removing security controls such as spam filters to save money. However metaphorically – if you were fishing in 2022 would you make the holes in your net bigger to save a little money? With cloud it transpires you require more security controls not less.
Conclusion and Recommendations
Cloud security has simply not delivered the promises made to users who moved to the cloud. ‘Someone else’s computer’ is as true as ever from a data privacy and data protection perspective let alone security controls.
Are cloud providers internal cyber security strategies as poor as their customer side offerings?
When will the DCMS/NCSC offer up a report on Cloud Security?
Cyber security in the cloud simply has to raise its bar and these recommendations may assist the cloud providers
- Cloud providers could up their game to meet logging levels for incidents for root cause analysis. Logging should be available for years not 30 days for free.
- Content Distribution Networks (CDN) providers could up their game to provide transparency on their networks when issues occur and not selling “bot” “protection”.
- Artificial Intelligence (AI) use should be scrutinised to level up the playing field where poor/biased coding is affecting users and society as a whole
- Less policy with better operational and transparent security
- Stop monetising “protections” whilst allowing adversaries to leverage attacks from your platforms.
- Audit all your code related to security. If logging stops it is rarely to save disk space.
Only when these recommendations prevail can we be sure that parties are not complicit in hiding adversaries. Then they become problem solvers not the problem creators when incidents need responding to quickly, effectively and transparently.
Have you been frustrated when investigating an incident to find cloud security lacking? Contact the National Cyber Security Centre and let them know!
Contact Switch2IT to guard your SME against cyber-attacks today!
