Cloud Security Essentials: Protecting Your Data and Applications in the Cloud

Cloud computing delivers cost reductions and better business results for organisations. It does, however, also include information security dangers that should be properly evaluated. These dangers vary depending on the sensitivity of the data and how the cloud provider of choice implements it.

To analyse the risks associated with employing cloud computing services, our blog seeks to help businesses with a robust cloud security architecture.

Senior company leaders can use the overview of cloud computing and a set of thought-provoking questions to help them decide whether cloud computing is appropriate for their business objectives while posing manageable risks.

We have addressed the following topics in the blog:

• availability of data and business functionality
• protecting data from unauthorised access
• handling security incidents.

Cloud Security

The term “cloud security” describes a collection of guidelines, safeguards, and tools for securing infrastructure services, data, and applications. To keep data, infrastructure, and applications safe, all of these elements cooperate. It is also called cloud computing.

Characteristics of Cloud Security Architecture

As per ISO 27001, the following are the key characteristics of Cloud Security architecture in Australia:

• Remote Accessibility

Employees and clients may access projects, data, and apps via cloud computing from any location. By doing this, the need to use particular tools on-site is removed, saving time and effort. Also eliminated is the need for file transfers. Everything is automated and completed in real-time.

• Disaster Recovery

Compared to conventional file storage, your data is more secure. Purchasing enough hardware and storage space for that hardware to hold copies of all your data is a need for traditional file storage. Employee focus is needed to maintain a dependable network infrastructure with enough capacity. Even then, physical harm to the hardware, such as fire or water damage, can cause a catastrophic loss of data.

There is no need to maintain hardware or a physical location with cloud computing. Since the data is duplicated on cloud servers, a functioning copy can be used to replace a lost or damaged file. Concerning whether the hard discs can be recovered is unnecessary. You can reassemble as long as you have a gadget that can connect to the internet. Your internet speed will determine how soon you can retrieve lost data.

• Scalability

When compared to traditional IT infrastructures, cloud computing offers far greater flexibility. A costly and challenging undertaking is expanding your traditional IT infrastructure. Running out of space on a typical infrastructure will need you to rent or buy an additional server, acquire more software licences, and engage more staff to operate the new machines. Cloud computing changes all of that! Depending on your requirements, cloud servers may be ramped up immediately. In addition to saving, you time, this is more affordable than the standard approach.

• Increased Efficiency

With cloud computing, both employees and clients may effortlessly monitor, access, review, and change data and projects in a timely and efficient manner. Instead of transferring materials back and forth, teams may schedule meetings online and work together on projects in real-time. Your operations’ bottlenecks are lessened as a result.

• Software Updates Availability

There is predictability in software updates. They occur precisely at the time when you will be most bothered by them. The majority of the time, when you have a tight deadline and need to make a single, essential modification. Automatic software updates are provided from the cloud. By eliminating the need for manual device updates, both you and your IT team will benefit.

• Environmental Friendliness

Less paper means fewer trees will be taken down. Adopting the cloud will significantly reduce your paper usage. A further benefit of cloud computing is that you will discard fewer gadgets, which are difficult to recycle and end up in landfills. When compared to conventional IT infrastructure, using cloud servers uses less energy. We all gain from preserving the ecosystem.

Cloud Service Models

Three different cloud service models exist. The reader is given access to a non-exhaustive set of sample vendor services to better comprehend the cloud service models.

• Infrastructure as a Service(IaaS)

Infrastructure as a Service (IaaS) involves a vendor providing physical computer hardware, such as CPU, memory, data storage, and network connectivity, and sharing it with multiple tenants using virtualization software. Customers run their preferred operating systems and software applications, with the vendor controlling hardware and the customer maintaining them.

• Platform as a Service(PaaS)

Platform as a Service (PaaS) is a cloud-based service provided by a vendor, allowing customers to deploy web applications and software using their cloud infrastructure. The vendor manages hardware, operating systems, and server applications, while the customer handles software applications.

• Software as a Service(SaaS)

SaaS is a cloud-based service where vendors provide customers with software applications, such as email and collaborative file sharing, through their cloud infrastructure. Users access these applications via a web browser, without the need for additional software. The vendor manages hardware, operating systems, and software, while the customer controls specific application configuration settings. Examples include CRM, Google Docs, Gmail, and Microsoft 365.

A vendor adding the words ‘cloud’ or ‘as a Service’ to the names of their products and services does not automatically mean that the vendor is selling cloud computing as per the NIST definition.

Cloud Deployment Models

There are four cloud deployment models:

• Public cloud

Public clouds share vendor infrastructure among users to save costs, but they come with built-in security vulnerabilities.

• Private Cloud

Private cloud refers to a company’s sole usage of vendor- or company-managed cloud infrastructure and services. It provides benefits similar to the public cloud but with enhanced security control, as well as decreased cost efficiencies and security issues.

Managed private cloud enables enterprise customers to negotiate suitable contracts with vendors, avoiding generic contracts offered by public cloud vendors.

• Community cloud

The goal of the community cloud is to gain security and financial benefits from the public cloud by allowing organisations with similar security needs to use a private cloud. Government agencies sharing a private cloud are some examples.

• Hybrid Cloud

Combining public and private cloud architectures, the hybrid cloud uses public resources to show non-sensitive data while processing sensitive data.

Overview of Business Drivers to Adopt Cloud Security

Cloud computing has the potential to help organisations leverage modern technologies such as computer virtualisation and worldwide internet connectivity. Some of the key business drivers are:

• Pursuing new business opportunities:

Studying online business opportunities and experimenting with innovative ideas.

• Reducing Upfront Costs

Minimising initial investment expenditures for computer equipment and associated costs by substituting them with predictable ongoing costs, only covering real computing processing and storage consumption.

• Potentially Reducing Ongoing Costs

By reaching economies of scale, shared infrastructure and technical experts can lower costs, but security concerns and regulations may impact potential cost reductions.

• Potentially Improving Business Continuity

Improve Business Continuity and computing infrastructure availability by ensuring guaranteed network connectivity, flexible scaling, and multiple physical locations for disaster recovery.

• Potentially Reducing Carbon Footprint

Utilising computer hardware more efficiently lowers carbon footprint.

Public cloud technology can help mitigate the Distribution of Denial Service (DDoS) attacks by distributing network traffic and computer processing globally. However, these technologies are expensive to build and rent, and organizations may have to pay for the computer processing and network bandwidth consumed by the attack.

Cloud computing organisations should consider the availability and integrity of public data, including reputational damage if offline or compromised. While outsourcing IT staff, software, and hardware can help focus on core business, the organization remains responsible for data protection.

Risk Management

Balancing the benefits of cloud computing with security worries requires a risk management strategy. Risk analysis determines if a company is prepared to commit its data, ongoing operations, and reputation to a vendor. The contract with the provider should cover data access, security protocols, governance, and risks. Customers should take into account certifications, supporting materials, and ISO/IEC 27001 compliance.

Cloud Computing Security Considerations

Although cloud computing security considerations is not a comprehensive list of cloud computing security issues, it should be given some thought to see if the risk is one that can be tolerated.

Maintaining Availability and Business Functionality

• The functionality or data a user wants to migrate to the cloud is not essential for their organisation. The vendor’s business continuity and catastrophe recovery strategy has been examined.
• Users shall keep a current backup copy of data, and they should have a second vendor reproduce any business functionality or data that they have.
• There is a sufficient network connection between a user’s computer and the vendor’s network.
•  An acceptable level of system availability is guaranteed by the Service Level Agreement (SLA).
• The promised percentage of system availability is not negatively impacted by scheduled outages, regardless of their length or timing.
• Scheduled outages of any length or time of day are permissible.
• The promised percentage of system availability is impacted by planned downtime.
• If the SLA or contract were broken, a user would be adequately compensated.
• Offsite backups and redundancy procedures guard against data loss or corruption.
• The seller can swiftly recover any files or other data that a user unintentionally removes.
• The user should have the flexibility to quickly increase the utilisation of the vendor’s computer power.
• A user can quickly transfer data to a different vendor or internally.
• A user can easily transfer their standard application to a different vendor or internally.

Protecting data from unauthorised access by a third party

• The cloud-sharing model chosen by a user is compatible with the level of risk tolerance.
• The sensitivity of user data is not an issue for cloud processing or storage.
• A user can uphold their legal duty to manage and preserve data.
•  A user is aware of and agrees to abide by the privacy regulations of any nation that may access my data.
• User’s sensitive data is always protected by strong encryption that has been authorised by the ACSC.
• At the end of its useful life, the vendor properly sanitises the storage medium holding user data.
• The vendor keeps an eye on the machines that handle or store user data securely.
• Users can keep track of how they are using the vendor’s services with the help of the tools they already have.
• Users retain legal ownership of their data.
• The vendor securely monitors the machines that contain or process user data.
•  The vendor appropriately sanitises storage media holding user data at the end of its useful life.
• The vendor’s gateway environment is secure and certified by a reputable third party.
• The provider offers an appropriate email content screening feature.
• Policies and procedures are in place to support the vendor’s security posture.
• Direct technological controls are in place to support the vendor’s security posture.
• Users have access to reliable third-party audit reports or can check out the vendor’s security.
• The identity and access management solution the user use is supported by the vendor.
• Users exclusively use secure operating environments to access and store sensitive data.
• The vendor’s software and hardware procurement procedures are reliable.
• The vendor employs approved physical security products and devices.

Protecting data from unauthorised access by the vendor’s customers

• Using the vendor’s cloud does not compromise the security of the user’s network.
• The vendor sufficiently isolates user data from other customers.
• Users may choose to utilise computers that are just for their use.
• After the user erases their data, the storage media is sanitised and then reused.

Protecting Data from Unauthorised Access by Rogue Vendor Employees

• User’s data encryption key or password is unknown to the vendor.
• The vendor does the necessary hiring and people screening.
• The vendor’s workers’ actions are recorded and examined.
• Visitors are positively identified and led inside the vendor’s data centre.
• Cable management procedures are used in vendor data centres to spot tampering.

Handling Security Incidents

• You have looked through the vendor’s security incident response strategy; the vendor is reachable and offers prompt replies and help.
• The vendor’s staff members are skilled in spotting and responding to security problems.
• If there are any security incidents, the seller shall inform.
• The vendor will help with security checks and legal research.

Detailed Cloud Computing Security Considerations

This section offers a comprehensive list of security considerations for organizations to discuss internally and with transparent vendors. The questions aim to provoke thought and discussion, guiding decision-making on cloud computing risk assessment. It’s crucial to determine which questions are most relevant based on the organization’s intended use.

Maintaining availability and Business Functionality

Answers to the following questions can reveal mitigations to help manage the risk of business functionality being negatively impacted by the vendor’s cloud services becoming unavailable:

• Business criticality of data or functionality

Consider migrating business-critical data to the cloud.

• Vendor’s business continuity and disaster recovery plan

Review vendor’s business continuity and disaster recovery plan, including data availability and restoration, recovery timeline, and priority for larger customers.

• My Data Backup Plan

Consider investing in a reliable backup copy for data storage at your organization’s premises or with a second vendor.

• My Business Continuity and Disaster Recovery Plan

Consider investing in data replication with a second vendor with no common failure points, ensuring a seamless transition to the other vendor if one fails.

• My network connectivity to Cloud

Assess network connectivity for availability, throughput, latency, and packet loss.

• Vendor’s Guarantee of Availability

The Service Level Agreement (SLA) ensures vendor system availability and quality of service, but it may be affected by technical issues, deliberate attacks, and configuration mistakes. Availability may also be affected by hardware failures, faulty software, denial-of-service attacks, and poor software version control and change management processes.

• Impact of Outages

Assess SLA tolerance, acceptable scheduled outage windows, and potential interference with critical business processes for 99.9% availability without breaching SLA.

• SLA Inclusion of Scheduled Outages

Given that suppliers with dispersed and redundant computing and network infrastructure can conduct planned maintenance in batches, ensuring smooth transitions to available infrastructure, the SLA guaranteed availability percentage should take scheduled outages into account.

• SLA Compensation

The SLA should appropriately represent the harm brought on by a breach, such as unexpected downtime or data loss. Most basic SLAs for the consumer market sometimes offer insufficient compensation, such as a free service or a credit. This does not restore a company’s reputation, as shown by a large vendor’s neglect, poor employee development, and poor backup implementation.

• Data Integrity and Availability.

Redundancy and offshore backups are used by vendors to guard against data corruption and guarantee integrity. A 2011 email software update that resulted in data loss highlighted the value of multiple data centres and offline backups.

• Data Restoration.

How long does it take to recover my data partially or fully from the backup when I unintentionally remove a file, email, or other piece of data? Is the maximum allowable time specified in the SLA?

• Scalability

How many extra computer resources is the vendor making available to allow me to quickly scale my use of the vendor’s services?

• Changing Vendor

Ensure vendor-neutral access, work with the vendor, and make sure data is completely erased before moving data to an organisation or vendor. Find out the vendor’s requirements for the platform as a service interoperability and portability.

• Protecting data from unauthorised access by a third party

Answers to the following questions can reveal mitigations to help manage the risk of unauthorised access to data by a third party:

• Choice of Cloud Deployment Model

Am I thinking about adopting a private cloud, which is theoretically the most secure, a hybrid cloud, which is possibly more secure, or a community cloud?

• Sensitivity of my data

Is the information I want to keep or handle in the cloud classified, sensitive, confidential, or public information like that on my open website? Is my data more sensitive than any other data because it has been combined? When holding a lot of data or a variety of data that, if stolen, might make identity theft easier, for instance, the sensitivity may rise. Could I show senior management, governmental agencies, and the public that I did my due diligence in the event of a data compromise?

• Legislative Obligations

What duties do I have to safeguard and manage my data in accordance with various laws, such as the Privacy Act of 1988, the Archives Act of 1983, and other laws relevant to the kind of data? Will the vendor contractually agree to uphold these commitments to assist me in making sure that they are satisfied with the Australian Government?

• Countries with Access to My Data

Foreign laws, including Freedom of Information Act requests and government access procedures, may apply to data that is kept, backed up, processed, and transported there. Foreign-owned merchants could be bound by the laws of their own nation, and if they are summoned by law authorities, they might be unable to warn clients as a result.

• Data Encryption Technologies

To safeguard sensitive data while it is travelling over networks, researchers are investigating hashing techniques, encryption methods, and key lengths. The processing power of cloud computing has decreased the effectiveness of brute force methods for regaining weak passwords, including SHA1 hashes and pre-shared keys for Wi-Fi Protected Access (WPA). Additionally, the durability of encryption is being evaluated for sensitive data.

• Media Sanitisation

Clean storage media using ISM-approved techniques when the data has served its purpose.

• Vendor’s Remote Monitoring and Management

Remote data processing systems are monitored, managed, and processed by the vendor to guarantee security and patch compliance. offers security reports and measures to stop employees from using phoney laptops.

• Monitoring and Management

Can systems be visible independent of location or vendor using current integrity, compliance, security monitoring, and network management tools without the need to learn new ones or rely on vendor-provided monitoring mechanisms?

• Data Ownership

Maintain legal ownership of data, otherwise, the bankruptcy liquidators may sell it as an asset.

• Gateway technologies. What technologies does the vendor use to create a secure gateway environment? Examples include firewalls, traffic flow filters, content filters, antivirus software and data diodes where appropriate.
• Gateway certification.

Is the vendor’s gateway environment approved in accordance with national security guidelines?

• Email Content Filtering

To uphold an organisation’s email policy, email software as a service companies offer customizable content screening. Filtering spam has little to do with email content since it interferes with worker productivity rather than network security. Specific file types, not all material, should be covered by email policies.

• Policies and Processes supporting the vendor’s IT security posture.

Policies, procedures, vulnerability management, change management, penetration testing, logging, Australian Government-endorsed security solutions, and adherence to security standards all assist the vendor’s computer and network security posture.

• Technologies Supporting Vendor’s IT Security Posture

Technical measures including patching, antivirus updates, defence mechanisms, hardened operating systems, intrusion detection, and data loss prevention are used to support the vendor’s computer and network security posture.

• Auditing the vendor’s IT security posture.

Verify vendor security protocols, carry out internal and external audits, and assess ISO/IEC 27001-certified data centres for legal compliance.

• User authentication

For users to log in and utilise Software as a Service, what identity and access management solutions does the vendor support? Examples include federated single sign-on, synchronisation with the company’s Active Directory, and two-factor authentication.

• Centralised Control of Data

Use technical protections, business policies, and user education to stop unauthorised access to sensitive data on untrusted computer devices.

• Vendor’s physical security posture

A vendor should safeguard servers, infrastructure, and data using authorised physical security tools of the Australian Government and shall get certification from a credible third party.

• Software and Hardware Procurement

Procurement process for trustworthy cloud infrastructure software and hardware that isn’t hacked in transit.

Protecting data from unauthorised access by Vendor’s customers

The following pointers can suggest mitigations to help businesses manage the risk of unauthorised data access by the vendor’s other customers:

• Customer Segregation

By ensuring logical and network isolation between tenants through virtualization and multi-tenancy methods, unauthorised access to data is prevented. Although virtualization software for infrastructure as a service is enhancing security, some measures may be added to already-existing applications.

• Weakening My Security Posture

By enabling an adversary to advertise without express permission, the vendor’s cloud architecture might degrade the network security posture of an organisation. This might make it possible for users to be fed dangerous online material and for sensitive data to be stolen, getting beyond security measures governing domains and IP address ranges.

• Dedicated Servers

Is it possible to regulate the use of virtual machines on real computers and to pay extra for access to private clouds or dedicated servers?

• Media Sanitisation

The ISM deems data deletion operations legitimate since they sanitise storage media before being made available to another client. Zeroing over storage space before reuse is promoted by vendors.

Protecting Data from Unauthorised Access by Rogue Vendor Employees

The following pointers can help manage the risk of unauthorised access to data by rogue vendor employees by suggesting appropriate mitigation methods:

• Data Encryption Key Management

The vendor has the password to decrypt data; alternatively, a computer user encrypts and decrypts data.

• Vetting of vendor’s employees.

To establish employee trust, the vendor does extensive background investigations, citizenship checks, security clearances, and psychological evaluations as part of the hiring process. A significant vendor acknowledged firing an employee in 2010 for abusing consumer privacy.

• Auditing Vendor’s Employees

Vendor’s employee identity and access management system; audit process.

• Visitors to Data Centre

Escorts and confirmed visitor information are required at data centres.

• Physical tampering by vendor’s employees.

Professionally installed network cabling meets Australian and international standards to prevent accidental connections and detect intentional tampering.

• Vendor’s Subcontractors

Questions about the applicability of vendor subcontractors apply similarly.

Handling Security Incidents

The following pointers can determine a vendor’s ability to handle security incidents:

• Timely Vendor Support

The vendor should be easily contactable and responsive to support requests, with a maximum acceptable response time captured in the SLA. Support should be provided locally or internationally, and the vendor should use a real-time understanding of security posture for support.

• Vendor’s Incident Response Plan

The vendor’s security incident response plan resembles ISM procedures for detecting and responding to security incidents.

• Training of Vendors’ Employees

What qualifications, certifications and regular information security awareness training do the vendor’s employees require, to know how to use the vendor’s systems in a secure manner and to identify potential security incidents?

• Notification of Security Incidents

Vendors should notify users of security incidents beyond agreed thresholds and automatically notify law enforcement, potentially confiscating data storage or processing equipment.

• Extent of Vendor Support

It involves Vendor support for legal electronic evidence discovery and security breach investigations.

Access to Logs

Access time-synchronised audit records to conduct forensic analysis and provide legal proof.

• Security Incident Compensation

It involves vendor remuneration for problems caused by security breaches.

• Data Spills

Data spills can be resolved using forensic sanitisation techniques, but the process depends on whether the data is zeroed or overwritten by customers. Clouds typically have spare unused storage capacity, so it’s important to ensure proper storage and handling of spilled data.