Securing IoT Part III: The Cloud

While cloud service providers are responsible for infrastructure security, it is the responsibility of individual companies to ensure data protection for stored information. McAfee outlines best practices for securing the cloud in three phases.

Phase 1: Understand Cloud Usage and Risk

Securing the cloud involves understanding what data is stored and the potential risks. Companies should begin cloud security by identifying their most sensitive data, how it is transmitted to and from the cloud and who has access to the data.

Phase 2: Protect the Cloud

From knowledge gained in the first phase, a security plan can be created and should contain as much of the following as possible:

• Limit how data is shared. Companies should limit what devices are authorized to upload and download data. Access permissions should be tailored to each employee along with permissions for viewing and editing data.
• Block unmanaged devices. Guest devices and employee personal devices should not be able to download sensitive data without security verification.
• Encrypt data. While cloud providers offer encryption services, full control over sensitive data means a company should deploy their own encryptions
• Secure network endpoints. Endpoints – user devices such as laptops and mobile phones – serve as access to the cloud that hackers commonly exploit and must be secured through access restriction and regular security updates.
• Train employees. Human error is the greatest security risk. Employees trained on security threats and their role in avoiding them help prevent attacks.

Phase 3: Respond to Security Issues

Security risks should be quickly identified and managed.

• Monitor accounts. Monitoring user accounts allows for the detection of unauthorized access or unusual user behavior and the ability to quickly shut down attacks. While a cloud provider may offer such services, it’s important for a company to implement additional monitoring to fill any gaps.
• Collaborate with cloud service provider. Understanding what security services a provider offers and what practices a company needs to fulfill is critical in establishing an effective security plan. Responding to threats also relies on the provider and customer to work together as assistance may be needed once a threat is detected.
• Automate when appropriate. Small security teams may be unable to carry out all necessary cybersecurity practices. Automation can help take over when there is too much for a team to manage. Automation of certain procedures can also prevent security mistakes like onboarding issues that cause false alarms in unauthorized access or activity. A former employee who still has network access can also pose a security risk. Automation can help prevent these mistakes.
• Review and update policies. Security best practices should be reviewed and revised regularly to identify and correct security vulnerabilities and keep up with changing cyberthreats.

>>>Read Securing IoT Part IV: Humans