The more we advance and become smarter and more efficient through new technology, the greater the opportunity for IT to inadvertently fall out of alignment with business goals. By this I mean, technology simplifies things, so users have the opportunity to bypass IT involvement and set up new processes which start driving part of the business. The downside is if you don’t have systems in place to protect these new processes, they become adopted without the benefit of protection around it.
Contributed Article: Time for a New Conversation On Cloud Data Backup
Niels Van Ingen, Keepit’s Chief Customer Officer, has contributed a blog post on how cloud backup is essential for protecting business data and ensuring continuity.
This conversation revolves around how cloud data protection is a must-have for any organization: protection that is secure, reliable, and accessible from anywhere. Van Ingen, a veteran of the data protection and management space, provides insight on this imperative.
What he refers to as a “wild west” mentality, he sees there is a lack of holistic data security planning which can lead to profound consequences for enterprises. Van Ingen shares how businesses should frame the discourse around cloud applications to safely manage the ever-growing dependence on them and the data they produce to minimize (or in some cases eliminate) business disruption.
Read the full article “The Business Case for Data Backup and Recovery” from Disaster Recovery Journal here.
About Keepit At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
On November 10, 2022 (published on 27 December 2022), the EU Parliament adopted new legislation (the NIS2 Directive) to strengthen EU-wide cybersecurity resilience which includes, among other requirements, a crystal-clear requirement for backup and disaster recovery.
The Network and Information Security Directive (NIS2) is a response to the increased exposure of Europe to cyberthreats and the fact that the more interconnected we are, the more we are vulnerable to malicious cyber activity. The regulators hereby set consistent rules for companies and ensure that law enforcement and judicial authorities can work effectively and raise the awareness of EU citizens on cybersecurity.
Keepit supports the EU initiative on protecting our digital infrastructure, our sensitive business data, as well as our personal data.
What Is the Purpose of the NIS Directive?
In comparison to the first NIS directive, the purpose of the NIS2 Directive is to expand the requirements and sanctioning of cybersecurity to harmonize and streamline the level of security across member states—and with tougher requirements for several sectors.
The European Parliamentary Research Service (EPRS), in a briefing on the NIS2 Directive, tells that due to the fact that cyberattacks are quickly growing in number worldwide, as well as increasing in scale, cost and sophistication, “the Commission has submitted this proposal to replace the original NIS Directive and thereby strengthen the security requirements, address the security of supply chains, streamline reporting obligations, and introduce more stringent supervisory measures and stricter enforcement requirements.”
So what has lead to the need for more requirements? According to the WEF Global Risks Report 2023, it is because:
The ever-increasing intertwining of technologies with the critical functioning of societies is exposing populations to direct domestic threats, including those that seek to shatter societal functioning.
Who Does NIS2 Apply To? Which Sectors and entities?
The directive applies particularly to two categories, with those two being “essential” entities and “important” entities.
The following are classified as essential sectors:
Energy (electricity, district heating, oil, gas, and hydrogen)
Transport (air, rail, water, and road)
Banking (credit institutions)
Financial market infrastructures (marketplaces)
The health sector (healthcare providers and manufacturers of pharmaceuticals, etc.)
Drinking and wastewater
Digital infrastructure (including providers of cloud services, data centers, domain name systems (DNS), top-level domain registries (TLD) and public communication networks)
Information and communication service providers (ICT services)
Providers of managed services and managed security services
Public administration
Space
The ‘important entities’ includes public and private entities within:
Postal and courier services
Waste management
Manufacture, production, and distribution of chemicals
Manufacture, processing, and distribution of food
Production of i.a., electronics, machinery, and motor vehicles
Providers of certain digital services (online marketplaces and search engines and social networking services)
Research (higher education institutions and research institutions).
If you are an entity that provides a service that is essential for the maintenance of critical societal and/or economic activities—for example, a transport company—you are, in the eyes of the law, classified as an “operator of essential services.”
This classification will entail a lot of pressure on your technical and organizational structure and capabilities due to the extensive risk management security you are required by law to implement and maintain.
NIS2 Requirements, Risk Management, and Security Measures
The current NIS Directive requires the covered entities to take appropriate and proportionate technical and organizational measures to manage security risks and limit the damage in the event of a security incident.
The NIS2 Directive continues this requirement and sets out additional requirements for appropriate security measures, which must now include as a minimum:
Policies for risk analysis and information security
Incident handling
Business continuity, such as backup management and disaster recovery and crisis management
Supply chain security, including supplier management/security
Security in connection with the acquisition, development, and maintenance of network and information systems
Policies and procedures for assessing the effectiveness of measures to manage cyber security risks
Guidelines for basic ‘computer hygiene’ and cyber security training
Policies for Use of Cryptography and Encryption
Employee security, access control, and asset management
Securing internal communication systems.
Negotiating and Navigating the NIS2 Directive
A dedicated backup and data management solution can help your organization implement resilient data protection and management services for your SaaS workloads, such as Microsoft 365 and Salesforce.
Keepit offers a suite of services for your SaaS data which can help you comply with the legal requirements of the NIS2 Directive with the overall goal of protecting your business continuity.
However, you need to decide which functions are essential and determine how ready you are to maintain those critical functions after an emergency or a disruption—and finally allocate the available budget accordingly. Read our article: Data Compliance Makes Third-Party Security a Must.
Governance
With the NIS2 Directive, the governance provisions are tightened as the responsibility for violation of the NIS2 Directive is not only imposed on the legal entity but on the management itself.
Thus, management must approve the risk management measures taken by the entity regarding cybersecurity and oversee implementation and maintenance. What’s key to a backup strategy? Read our blog post on the 3-2-1 backup rule here.
To ensure sufficient competencies, management members must regularly follow specific courses to obtain the necessary knowledge, insight, and skills to understand and assess cybersecurity risks and management practices and their impact on the entity’s operations.
Supervision, Enforcement, and Sanctions
According to the NIS2 Directive, the competent national authorities must oversee compliance with the directive’s security and notification requirements based on specific incidents—and the competent authorities are empowered to issue certain orders.
What Are the Costs of Non-compliance?
The competent authority can, among other things, issue warnings and orders and (particularly materially) temporarily suspend or request that a person with management responsibility (CEO or another senior member of management) be temporarily suspended from exercising management functions in the entity.
The NIS2 Directive also tightens the sanction options. In addition to having to ensure t hat violations are punished with sanctions that are effective, proportionate to the violation, and have a dissuasive effect, the competent authority in the Member States now has the concrete possibility to impose administrative fines if the entity does not comply with the directive’s requirements for risk management measures or reporting obligations.
The administrative fines are as follow:
Essential entities – as a minimum – can be fined up to a maximum of 10 million EUR or 2% of the company’s total global annual revenue.
Important entities – as a minimum – can be fined up to a maximum of 7 million EUR or 1.4% of the company’s total global annual revenue.
When Does It Begin? Timeline and Important Dates
The EU member states will now have 20 months to transpose the new directive into national law. Want to know more about the important dates and the timeline surrounding NIS2 entering into force? Go to https://www.nis-2-directive.com/ to learn more about the important dates.
What Are the Next Steps? Educate with Further Reading
We recommend starting to educate yourself and your organization on the legal requirements and to start mapping for compliance gaps with the requirement for risk management and risk measures. You can read the EU Parliament briefing of the legislation here.
For those wanting an in-depth look into the matter, the European Parliament has shared the full texts adopted regarding this proposal, which can be read in PDF format here.
Beyond the NIS2 Directive, Keepit delivers a solid return on investment beyond the critical compliance requirements. Check out our post entitled “What’s the Return on Investment (ROI) of a cloud backup solution” here.
About Keepit At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
In the modern economy, around 75% of workloads have migrated to the cloud. Millions of workers use the cloud daily to send messages, develop code, and manage customer relationships. Cloud computing is convenient, flexible, and cost-effective. But relying on the cloud brings security risks.
Unsecured apps are vulnerable to external attacks, data loss, and infrastructure damage. One unprotected app can cause an enterprise-wide data breach. Fortunately, there are many ways to strengthen cloud security and make application usage safe.
This blog will explore cloud app security and the threats users face. You should find everything you need to know when securing critical cloud assets.
What Is cloud application security?
Cloud application security is a set of tools, policies, and procedures that protect information passing across a cloud environment. The aim is to:
Create a secure environment and protect data on all cloud apps
Manage cyber threats
Prevent unauthorized access to cloud resources
Ensure the availability of critical assets
Cloud application security covers popular platforms like Amazon AWS, Google, and Microsoft Azure. It also extends to individual SaaS apps hosted on cloud platforms. Collaboration tools like Slack or Zoom require specific security solutions. The same applies to cloud-hosted business tools like Salesforce or data storage services.
Do you need cloud application security?
Yes. Legacy network security tools cannot properly protect cloud assets. VPNs and firewalls can protect locally-hosted data and applications. But cloud apps are hosted by third parties. Users can access them from virtually anywhere via a huge range of devices.
Attack surfaces have become more complex as cloud apps have proliferated. Cloud endpoints cannot be secured by locally-managed hardware or encrypted network connections. Older tech plays a role, but new application security approaches are essential.
Cloud application security threats
The first step in securing a cloud environment is understanding critical security threats. Here are some of the most important cloud application security risks to factor into security planning.
Misconfigured cloud apps – Gartner reports that as many as 99% of cloud security issues are due to client error. Cloud deployments are complex, and teams must manage a range of application configurations. Every SaaS app requires access controls and processes to guard against shadow IT. Getting app configurations right is essential.
Account hijacking – Malicious attackers can hijack user accounts and infiltrate cloud-hosted apps. Account hijacking tends to result from poor password hygiene and credential exposure. Security teams must enforce strong password policies. Password managers make life easier for workers. Encryption keeps credentials private and secure.
Phishing – Phishers persuade employees to provide access credentials. They may also entice users to click links that harvest private data. Security teams must train all staff and enforce responsible behavior.
Automated attacks – Attackers may find vulnerabilities via scanning agents. Botnets target poorly secured cloud apps, taking down cloud resources via denial-of-service attacks.
Buggy APIs – APIs connect cloud applications and users. They need to be secure at all times. The problem with APIs is that they are both feature and data-rich. One compromised feature could expose data inside the app for outsiders to harvest.
Physical security – Cloud applications rest on physical hardware somewhere in the world. Cloud providers must protect hardware against theft and take measures to handle fire, extreme weather, and other sources of damage.
Inadvertent data loss – Staff can accidentally delete data, change it irreversibly, or lose encryption keys. This places intact data out of reach. A comprehensive data backup strategy is essential.
Cloud application security best practices
Failure to deal with cloud security vulnerabilities can have serious consequences. Let’s explore some app security best practices to lock down critical assets.
1. Understand the threat surface
Robust cloud application security rests upon strong visibility. Total awareness of cloud workloads and device connections puts you in a good position to apply controls.
Create and maintain inventories of connected cloud apps. This inventory will form the basis for security measures later on. Trim the inventory regularly to remove any unneeded cloud apps. Try to keep the threat surface as small as possible.
2. Deploy identity and access management (IAM)
Every cloud application is vulnerable to credential theft. Enterprises must establish complete control over who accesses cloud apps. They must also define and manage user privileges.
Cloud-native IAM tools manage access by authenticating log-in requests. They compare login credentials with secure directories and ensure that only authentic users gain access. Multi-Factor Authentication (MFA) adds another set of time-limited and unique credentials.
After admitting users, IAM systems authorize their privileges. Privileges allow users to carry out core workloads and restrict access to other applications.
Developers can access the tools they need. Sales teams can access CRM databases and marketing assets. Every role is limited, but workers are free to carry out their duties.
Additionally, IAM applies Single Sign On. SSO creates a single point of entry to cloud resources. One cloud-based application provides access to all apps. There is no need to secure multiple cloud endpoints.
More advanced IAM tools actively check for unsafe credential storage. They alert security teams if staff store credentials digitally or share information insecurely. All these features enhance the safety of cloud applications.
3. Create a cloud application security strategy
Companies need cloud application security. This strategy should specify how to access cloud apps safely and how user identities are verified. Users should know what they need to do and what threat mitigation controls are in place.
Looking beyond security policies, security teams should have a clear plan to secure data on all cloud applications. This can be visualized on three levels to cover vulnerabilities:
Platforms. Cloud infrastructure underlying can include exposed data files. If companies develop cloud infrastructure in-house, security staff must focus on correctly configuring platforms. Encrypting all data is advisable.
Databases. Secure cloud databases with appropriate encryption and access controls. Assess the right authorization levels for every role. Workers should only have access to relevant data. All other information should be out of reach.
Applications. Secure the attack surface by extending IAM to all applications. Check API configurations, and use any threat detection systems provided by app developers. Set up automated notifications about unusual access requests or network traffic patterns.
4. Use automated security testing
Testing is a critical aspect of cloud app security. It may be too late to detect and mitigate vulnerabilities when cloud apps go live. Instead, companies should switch from standard DevOps to DevSecOps (Development Security Operations).
DevSecOps includes automated testing systems that assess code during the development phase. Testing during the CI/CD process uncovers weaknesses before hackers have a chance to exploit them.
Testing should extend to open-source code libraries used to build cloud applications. It should also cover data containers and user-provisioned cloud deployments. Every part of the cloud environment is vulnerable.
Testing does not end after app provisioning. Enterprises must continuously test IAM systems to ensure the integrity of IAM processes. They should also test encryption tools. Keys may be exposed or out of date, creating inherent weaknesses.
Automation is vital. You can automate development and post-deployment testing to reduce security workloads and ensure regular results.
5. Focus on password hygiene
Companies need to drive home the importance of password hygiene. Access controls and encryption mean little if employees expose passwords to outsiders.
Stolen or hacked credentials are a major security weakness. Staff must use strong passwords and change them regularly.
SSO helps make this task more manageable as workers handle fewer credentials. Cloud-native password managers also automate password strengthening and password replacement.
6. Employ comprehensive encryption strategies
Exposed data is an easy target for hackers inside cloud perimeters. That’s why encryption is a critical component of cloud app security.
Encryption scrambles data, making it unreadable to anyone without specific encryption keys. There are three main ways to encrypt data on the cloud:
Encrypting data at rest secures information stored by enterprises. This could include HR information or financial records. Companies can encrypt files, databases, and even cloud platforms. With more layers covered, hackers will struggle to access confidential data.
Encrypting data in transit makes collaboration safer. Data constantly moves throughout cloud environments. Information passes from on-premises networks and remote devices to the cloud. Encrypting data as it moves protects against interception attacks.
Encrypting data in use makes using applications safer. Employees may retain workloads in an open state for long periods. This leaves data vulnerable to interception and extraction. The use of encryption and tools like DRM makes in-use data less accessible.
7. Active threat detection
Monitor cloud applications in real-time to detect threats and protect data. User behavior patterns can provide clues about ongoing attacks. Access requests for sensitive files can generate automated alerts.
Security teams can use activity monitoring data to fine-tune privileges management. Monitoring data is also a valuable compliance tool, providing evidence of continuous security management.
8. Regularly patch software and apply system updates
Cloud applications require timely and frequent updates to keep pace with evolving threats. Codebase changes and new services constantly present new vulnerabilities and exploits for hackers to target. Automated scheduled updates neutralize weak spots as they emerge.
9. Proactive privacy and compliance policies
Data privacy is a central part of compliance strategies. Enterprises operating in the cloud face major regulatory challenges, including GDPR, PCI-DSS, or HIPAA compliance. Secure cloud apps to meet relevant compliance standards.
Security teams should build app security audits into their schedule. Check that apps and security controls meet regulatory guidelines. Include the development environment used to provision cloud applications and open-source libraries used by DevOps teams.
Use regulatory requirements as a framework to build effective controls. For instance, PCI-DSS compliance demands data encryption for financial records. HIPAA demands tight identity management and encryption of sensitive information.
Compliance strategies aren’t static. Enterprises should take a proactive approach when securing sensitive data, using regulatory frameworks as guides.
How businesses could secure their cloud applications
Legacy tools like VPNs have security limitations when guarding the cloud. Instead, using security tools that function alongside cloud application APIs is advisable.
IAM and SSO systems are essential components of cloud security strategies alongside data encryption and threat monitoring. Fortunately, you can source solutions that bring together core app security functions.
The two major options here are proxy or API-integrated Cloud Access Security Brokers (CASBs):
Proxy CASBs route traffic through a separate proxy between user devices and cloud apps. Proxies usually employ HTTP and can intervene with traffic passing through cloud endpoints. The CASB applies encryption and tracks anomalies such as suspicious login requests.
API-based CASBs do not require an extra layer of routing. These CASBs are built into cloud apps instead. This has many potential benefits, as well as some drawbacks.
Benefits of API-based CASBs include:
Improved speed – There is no need to route traffic via a proxy. This boosts speeds and improves the user experience. Routing large amounts of traffic through a proxy may lead to performance issues as demands grow.
Firewall interaction – API CASBs supplement existing network firewalls. They add cloud security features that protect data and monitor activity. Proxy CASBs damage performance by adding another security barrier alongside firewalls.
Easy upgrades – Users must update CASBs as applications evolve. App developers often add or exchange protocols and authentication systems. But developers do not routinely alert CASB developers about needed upgrades. API-based tools are easier to patch as apps change. Over time, cloud apps will leave proxy CASBs behind.
Better security – Proxy-based CASBs break TLS sessions to access the HTTP stream. They then reconstruct TLS protection to complete cloud access. Users trust their CASB to restore TLS sessions safely and reliably. This weak point can compromise the security of cloud deployments.
Major cloud computing providers like Google and Amazon recommend API-embedded CASBs where possible. This makes perfect sense in a fast-changing cloud application environment.
However, API-based CASBs may not work with all SaaS deployments. CASBs are often compatible with most but not all APIs. This can add complexity to cloud security architecture. Proxy CASBs can operate across different APIs, resulting in simple solutions.
Enterprises also need to be aware of problems surrounding CASBs. For instance, cloud infrastructure providers rarely inform CASB developers about platform alterations that cause security issues. Cloud platforms can change quickly. CASB vendors need to keep up with changes and plug any security holes.
This issue affects proxy CASBs more than API-based versions. API-based brokers integrate closely with apps. App developers tend to flag any API changes for CASB developers. As a result, patches appear in a more timely manner. Users can expect stronger security.
The shared security responsibility model
Before implementing cloud application security best practices, bring the shared responsibility model into the picture.
In cloud environments, cloud providers and users share responsibility for security. Responsibility levels depend upon your cloud computing setup and your choice of a cloud service provider.
Generally speaking, cloud providers like AWS or Microsoft Azure assume responsibility for protecting:
The infrastructure stack (including hosts and data centers)
Software required to host cloud applications and data
Networking infrastructure connecting cloud apps
Clients must handle everything else. Responsibilities vary according to whether you choose IaaaS, PaaS, or SaaS deployments.
IaaS – Infrastructure-as-a-service users have the widest responsibilities. Users must protect apps and data, as well as infrastructure. This includes middleware and can include the cloud operating system.
PaaS – Platform-as-a-service users must protect any infrastructure they maintain, including apps and data hosted by their service provider. Any proprietary apps hosted by third parties remain your responsibility.
SaaS – Software-as-a-service users are responsible for data stored or processed by cloud applications. The main security risks relating to SaaS applications are access management and encrypting sensitive data.
Shared responsibility model in practice
Getting the balance right when applying the shared responsibility model is all-important. A good starting point is assessing every cloud application.
It is critical to define the responsibilities of users and providers for each application. Be clear about internal security controls and what your provider offers. Write a clear description of who is responsible for securing each asset and how to ensure data security.
Regardless of the cloud model in use, users are always responsible for:
Securing on-premises and remote access endpoints
Protecting data flowing through cloud resources
Managing access to cloud applications.
Bring operations and security teams together. Developers need to provision cloud services flexibly and quickly. Security teams must advise about how to calibrate those services safely.
However, cloud users aren’t alone. Cloud service providers realize the complexity involved in managing cloud application security threats.
Providers usually offer user controls within APIs to secure their apps. They may also offer monitoring and threat management functions. Always investigate and use available cloud-native security tools.
Enterprises can also request audit information from providers. This should include details about their security strategy. Compare the material provided with your service terms to ensure providers meet their obligations.
Cloud application security assessment checklist
Before we finish, here is a quick checklist of critical cloud application security measures:
1. Create robust security policies covering all cloud apps. Take into account private, public and multi-cloud environments. Consider how to secure remote workers. Include processes to onboard and off-board employees. And put plans in place to detect and mitigate data breaches.
2. Implement IAM for the cloud. Ensure users have the correct privileges. Keep in mind Zero Trust concepts and the principle of least privilege. Combine cloud apps with SSO and add an extra protective screen with MFA.
3. Train staff in cloud security awareness. Make sure staff is aware of data storage and password policies. Train workers in secure cloud application usage and ways to share data safely. Focus on the threat posed by phishing attacks.
4. Deploy cloud security controls. Protect endpoints with encryption and CASBs. For instance, cloud-specific controls like disabling SSH and SQL Server access guard against brute force attacks.
5. Check application configurations. Poorly configured cloud apps are a critical security threat. Enforce API protection policies to configure apps properly. Focus on potential malware injection sites to neutralize common external attacks.
6. Put backups in place. Store sensitive data and workloads on separate cloud servers. Backup server files to ensure smooth disaster recovery. Carry out regular restoration tests to make sure data is recoverable.
7. Update software when needed. Use automated patch management to update cloud applications and deliver patches to all worker devices. Test updates when possible before deployment.
8. Track threats and log incidents. Use automated threat scanning and activity logging. Cloud logging tools can organize and analyze complex data. Use this data to improve your security posture and provide evidence of compliance.
9. Apply data security policies. Put in place policies to encrypt data at rest, in transit, and in use. Check encryption keys are used safely, preventing exposure to external attackers.
How can NordLayer help?
Follow our cloud application security checklist and best practices to secure cloud environments. With the correct controls, enterprises can take advantage of cloud computing. Sound app security measures reduce costs and cut data loss risks.
NordLayer offers cloud security solutions for all digital businesses. Install IAM, MFA, and SSO to control cloud access and reduce the attack surface. Create encrypted connections between remote workers and cloud portals. And integrate client-side security controls with tools provided by CSPs.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
As described by Gartner, Secure Access Service Edge (SASE) is a combination of networking and security services. Unifying both provides businesses with a streamlined and future-thinking approach to orchestrate their IT infrastructure. However, as a solution, it has its fair share of challenges in terms of deployment, administration, and management.
There are several routes that a business can take to transition to SASE: doing everything themselves or going to a vendor are just some of the options. For this reason, Managed Service Providers (MSPs) can be incredibly useful when making the leap more streamlined and convenient.
How do MSPs help enterprises migrate to SASE?
MSPs can reach out a helping hand to businesses that don’t want or can’t implement SASE by themselves. Enterprise as a client just picks what they need from MSPs, and everything is done for them. Though, it’s not unheard of to have a MSP provider choose the needed components for the organization. This converged approach is more effective and saves client organizations time.
The external experts help businesses that may not have on-site specialists that could help them navigate various specific challenges associated with SASE. Choosing a SASE vendor is one of the most important IT decisions a business can make, so it’s very helpful to have someone to deal with product analysis, narrowing down the needed technologies, and planning network security schemes. It’s one of the most hassle-free methods to ensure optimal user experience when the transition to SASE is completed.
MSP benefits for SASE implementation
Here is the list of principal benefits that MSPs bring to businesses moving to the SASE framework.
1. Experience
As MSPs provide their security and networking services in a very niche field, they have amassed considerable expertise in helping clients overcome various challenges associated with SASE. Dealing with various vendor platforms is something that MSPs deal with daily, so they already have all the necessary knowledge for in-depth consultations.
2. Scalability
One of the most important benefits that MSPs can provide is scale. Simultaneously they can support thousands of clients as their multi-tenant architectures are equipped to do just that. Most MSPs also invest resources to have multiple points of presence across the globe to provide service without interruptions for globally distributed workforces. A broad reach is paramount in ensuring stable connectivity when setting up SD-WAN elements of SASE infrastructure.
3. Time-saving
MSPs are often regarded as the quickest route to implement SASE. Going from the drawing board to operating infrastructure takes little time. As MSP has all bases covered, this means very rapid implementation of SASE services. In turn, this also cuts the time and creates a quick route to instant value.
4. Prioritization
As SASE is a complex service with many critical components, it can be difficult to wrap your head around what should be done first. MSPs can guide organizations through this minefield by clearly defining priorities that should be achieved. Not to mention that some SASE service components can be implemented only after completing some prerequisites. MSPs, therefore, streamline the whole rollout procedure by keeping it on track.
5. Execution
A typical business could be stuck at the proof of concept level when planning its SASE service approach, which can be costly and time-consuming. MSPs have an in-depth understanding of their client’s pain points, which makes them more equipped to tackle various practical issues. This saves the trouble of going the trial-and-error route when implementing SASE without external help.
How to choose the right MSP for SASE implementation
While MSPs help you to create SASE that works for you, you still need to pick an MSP provider that would be the right fit for you.
1. Know which MSP type is right for you
The first decision you’ll have to make is to pick one of the main MSP types.
Build and operate — this type handles full SASE deployment, including software and hardware configurations, monitoring performance, and integrated response to incidents. This involves not only the setup but ongoing maintenance.
Build and transfer — MSP designs, configures, and deploys all needed equipment and transfers it to the client. From the handover, the customer is responsible for its maintenance.
Takeover — after the organization creates and deploys its SASE solution, MSP makes strategic decisions for operations outsourcing.
Note that there still can be varieties and hybrids of these models. The agreements could be time-based, as the provider will maintain everything for a set duration, after which the organization agrees to take over.
2. Do background research on MSP capabilities
The second part of the equation is that MSP should match the organization’s requirements:
Can MSP match the enterprise’s scale?
Are necessary network security services provided?
Does MSP have the required expertise within the customer’s industry?
Are connectivity services provided along with security?
Is MSP providing an integrated product or combining different tools from separate providers?
A good match should align across the board with your setup requirements.
3. Check the price/value ratio
It’s essential to calculate whether relying on MSP makes sense financially. The return on investment can vary greatly depending on the used services, company size, and other agreements. This is a helpful exercise to rethink priorities and get the best solution that makes sense not only securely but money-wise.
4. Look into the SLA agreement
Finally, there is a question about legally binding contracts. MSPs heavily rely on Service Level Agreements to establish expectations with their clients. The document outlines the services that will be provided, the objectives, and any other relevant prerequisites. SLA metrics can vary greatly from one MSP to another, and it’s a client’s responsibility to ensure that their needs are addressed.
How can NordLayer help?
SASE and its network security component, Secure Service Edge, is an essential cornerstone of most enterprises’ digital transition. SSE combines cybersecurity technologies and concepts like ZTNA to deliver internet access security and network access management. This allows the development of a future-focused approach to an organization’s cybersecurity for growing modern businesses.
NordLayer helps to reduce risks associated with hybrid work or globally distributed workforces. As a complimentary addition to your IT infrastructure, it enhances network access control by segmenting the user base through Virtual Private Gateways and filtering out malicious websites from the employees’ browsing.
Get in touch with our experts today, and learn how NordLayer could improve your network security with a click of a button.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Companies of all sizes and industries should be concerned about the impacts of a data breach, since, according to the IBM Cost of a Data Breach 2022 report, its average cost is $4.35 million, and 83% of companies had more than one breach.
With this in mind, we prepared an article exploring the main information collected by this document. To facilitate your reading, we divided our text into topics. These are:
What Is the IBM Cost of a Data Breach Report?
IBM Cost of a Data Breach 2022 report: What’s New
Main Data Collected in the IBM Cost of a Data Breach 2022 Report
Topics with Detailed Results
Suggested Security Recommendations in the Report
About senhasegura
Enjoy the read!
What Is the IBM Cost of a Data Breach Report?
The IBM Cost of a Data Breach report is an annual survey of data breaches, which provides insights into hundreds of breaches so that the public can understand current cyber threats. With nearly 20 editions, this document provides IT professionals with tools to deal with security risks, showing which factors can favor or help prevent cyberattacks.
IBM Cost of a Data Breach 2022 report: What’s New
In its latest edition, the IBM Cost of a Data Breach report has conducted more than 3,600 interviews with professionals from 550 companies that suffered violations between March 2021 and March 2022. The questions made during the interviews aimed to evaluate the costs of organizations to respond to data breaches in the short and long term.
What’s more: the report has assessed the causes and consequences of the violations that occurred in 17 industries located in different countries and regions, and addressed the impact of certain factors and technologies to reduce losses.
Here are some new things from the IBM Cost of a Data Breach report:
The 2022 edition has brought analyses related to extended detection and response, the use of risk quantification techniques, and the impacts of individual technologies on zero-trust security structures;
It analyzed what contributes to higher data breach costs and the effects of supply chain commitments and the gap in security skills;
It examined areas of cloud security vulnerability to critical infrastructure;
It assessed, in greater depth than in previous years, the impacts of ransomware and destructive attacks; and
It studied the phenomenon of remote work, which many companies adopted due to the covid-19 pandemic.
Main Data Collected in the IBM Cost of a Data Breach 2022 Report
Check the key findings from the IBM Cost of a Data Breach 2022 report:
The average cost of a data breach was $4.35 million in 2022, an increase of 2.6% over the previous year, when the average cost was $4.24 million; 83% of the companies studied suffered more than one data breach and only 17% said this was their first breach;
60% of organizations had to increase the price of their services or products because of a data breach; The average cost of a data breach for the critical infrastructure organizations surveyed was $4.82 million – $1 million more than the cost for companies from other segments;
28% of critical infrastructure organizations have suffered a destructive or ransomware attack, and 17% have been violated because of a compromised business partner;
Cyberattacks on companies with deployed security and automation AI cost $3.05 million less than violations on organizations that do not invest in these resources;
The average cost of a ransomware attack fell from $4.62 million in 2021 to $4.54 million in 2022; Stolen or compromised credentials remain a leading cause of data breaches, accounting for 19% of breaches in the 2022 study;
Leaks involving credentials are the ones that take the longest to be detected. On average, 327 days are required for identification and remediation;
Only 41% of the organizations in the study have deployed zero-trust security architecture; Violations related to remote work cost, on average, about $600,000 more if compared to the global average;
45% of violations in the study occurred in the cloud;
The average cost of health-related violations has increased by almost $1 million, reaching $10.10 million;
The top five countries and regions with the highest average cost of a data breach were the United States, the Middle East, Canada, the United Kingdom, and Germany.
Topics with Detailed Results
The IBM Cost of a Data Breach 2022 report analysis 16 topics. These are:
Global Highlights;
Data Breach Lifecycle;
Initial Attack Vectors;
Key Cost Factors;
Security and Automation AI;
XDR Technologies;
Incident Response (IR);
Quantification of Risk;
Zero Trust;
Ransomware and Destructive Attacks;
Attacks on the Supply Chain;
Critical Infrastructure;
Cloud Violations and Cloud Model;
Remote Work;
Skills Gap; and
Mega Violations.
The following are five of these topics in detail:
Data Breach Lifecycle
We call the lifecycle of a data breach the time elapsed between the discovery of the breach and its containment.
According to the IBM Cost of a Data Breach 2022 report, the average time to identify and contain a data breach is currently 277 days. In 2017, the average time was 287 days, that is, 3.5% more.
In 2021, it took an average of 212 days to detect a violation and 75 days to contain it. In 2022, it took 207 days to identify the violation and 70 days to contain it.
The report has also shown that the less time an organization takes to identify and contain a data breach, the less its financial impact is.
However, the cost difference between a lifecycle of more than 200 days and a lifecycle of less than 200 days was lower in 2022 than in 2021: in 2021, the difference was $1.26 million, the largest in seven years and, in 2022, it was $1.12 million.
Incident Response
Relying on an incident response team reduces the average cost of a data breach and, according to the IBM Cost of a Data Breach 2022 report, 73% of the companies that participated in the survey claimed to have an incident response plan.
The report also pointed out that the average cost of a violation in these companies in 2022 was $3.26 million versus $5.92 million spent by companies without incident response resources, a difference of $2.66 million. In the previous year, this difference was $2.46 million, and in 2020, $1.77 million.
Zero Trust
The implementation of a zero-trust security architecture was performed by 41% of the companies that participated in the IBM Cost of a Data Breach 2022 report. In 2021, this number was lower: 35%.
The study also revealed companies that deployed zero trusts saved almost $1 million with data breaches when compared to those that did not invest in this concept.
This is because the average cost of a violation was $4.15 million in organizations with zero trust deployed and $5.10 mi
llion in companies that did not use the same approach.
When we talk about implementing zero trust in a mature stage, the economy is even greater, reaching more than $1.5 million. Companies with early-stage zero trust practices spent an average of $4.96 million on data breaches, while for those that had these practices consolidated, the average cost was $3.45 million.
Cloud Violations and Cloud Model
The Covid-19 pandemic has accelerated the mass adoption of remote work by organizations and, consequently, the use of technologies such as cloud computing, impacting cybersecurity.
However, the IBM Cost of a Data Breach 2022 report brings interesting data on the subject, which was analyzed for the second year: according to the document, 45% of violations occurred in the cloud. Moreover, the costs of breaches in private clouds are significantly higher than in hybrid clouds.
Another revealing fact is that 43% of companies claimed they were still in the early stages of their practices protecting cloud environments, showing that, in general, organizations still need to evolve a lot.
Nevertheless, the most worrying fact is that 17% of companies have yet to take any action to protect their cloud environments.
Remote Work
Since the beginning of the pandemic, the IBM Cost of a Data Breach report analyzes the impacts of remote work on data breaches. In its 2022 edition, the survey has shown data breach costs were higher for companies that have more employees working remotely.
In practice, companies that have between 81% and 100% of employees working outside the corporate environment had an average cost of $5.10 million. Companies with less than 20% of their team working remotely had to bear an average cost of $3.99 million, a difference of $1.11 million (24.4%).
In addition, the average cost of a data breach was $4.99 million for companies that had remote work as the cause of the breach, while this loss was $4.02 million when remote work was not the cause.
Suggested Security Recommendations in the Report
The IBM Cost of a Data Breach 2022 report also contains important security recommendations on its pages, which can help prevent problems with data breaches. Check them out:
Adopting a Zero Trust Security Model
According to the results of the study, organizations that implemented a zero-trust approach in their security at a mature stage have saved $1.5 million. Therefore, it is convenient to adopt this security model in your company to reduce the financial impacts of a data breach.
Protecting Cloud Environments with Policies and Encryption
Companies that have adopted mature cloud security practices have saved $720,000 compared to those that did not care about the subject. Thus, it is recommended to invest in security policies, data encryption, and homomorphic encryption to prevent data breaches.
Using Incident Response Manuals
Another highly recommended practice is to create and test incident response manuals, as companies that regularly test their plan have saved $2.66 million in violations over those that do not rely on an IR plan team or test.
Improving Incident Detection and Response Times
Added to security and automation AI, Extended Detection and Response (XDR) capabilities contribute to reducing the average costs of a data breach as well as its lifecycle. The study pointed out that companies with XDR deployed have reduced the lifecycle of a violation by 29 days, on average, when compared to organizations that did not implement XDR, saving $400,000.
Monitoring Endpoints and Remote Employees
Finally, the IBM Cost of a Data Breach 2022 report reinforces the need to monitor endpoints and remote workers, showing that violations caused by this modality cost almost $1 million more than violations in which remote work was not a factor.
About senhasegura
We, from senhasegura, are a company specializing in cybersecurity. Our mission is to provide our clients with sovereignty over their actions and privileged information. To do this, we offer our PAM solution, which helps companies protect themselves from all the threats presented in the IBM Cost of a Data Breach 2022 report.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Segura® Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.
Keepit’s Chief Customer Officer (and frequent contributing author to the Keepit blog) Niels van Ingen has been featured in Solutions Review as part of their “Premium Content Series” written by industry experts.
As a true veteran in the data protection and management space — not only from a product point of view but also from a customer and business development one — Niels covers what he finds are the most important elements to consider when evaluating cloud data protection offerings.
Those who work in IT disaster recovery understand that data is perhaps a business’ most valuable asset that needs protection all day, every day. Implementing a SaaS backup and recovery plan is essential for nearly every aspect of business operations, and those who have not made it a top priority are literally flirting with disaster.
To read the full article entitled ‘4 Keys to Consider When Evaluating Cloud Data Protection Tools’ on Solutions Review, click here.
About Keepit At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
The cybersecurity landscape is ever-shifting. With new and advanced technologies developing at lightning speed, we can expect major digital security changes — and challenges — this year. So, what cybersecurity predictions can we make for 2023? Read on to find out.
#1 Possible spike in state-sponsored attacks
With Russia continuing to wage war in Ukraine and China’s president securing an unprecedented third term, we may see a spike in state-sponsored attacks.
In China, another five years in power may give the president the opportunity to launch more large-scale cyberattacks on Taiwan and other countries seen as a threat to the regime.
We can also expect Russia to launch cyber attacks on Ukraine or lash out against the states supporting Ukraine. These malicious activities may also come in response to the economic sanctions imposed on Russia.
#2 5G may present new security challenges
With the growing adoption of the 5G network, we’re likely to see new 5G security challenges in 2023.
Every new technology comes with security concerns — and 5G is no exception.
While 5G technology offers much greater speeds than 4G and potentially unlimited connectivity, it has several system vulnerabilities. The technology needs new cloud-based infrastructure to work, which creates more access points for hackers to exploit.
With the rapid 5G adoption and the significant global shortage of cybersecurity professionals, this technology could bring new cybersecurity challenges that are easy to overlook.
#3 Government surveillance may increase in some regions
Democratization has suffered a lot over the last few years, with global democracy reaching an all-time low.
Countries with strict authoritarian regimes, like China, Russia, and Iran, may increase government surveillance and censorship to maintain control. One example of surveillance could be China’s plans to review social media comments before they’re published.
The leaders of these countries may take even more steps to cut off users from the global internet, potentially resulting in more isolation, restrictions, and prosecution.
#4 This year could be big for data privacy
With corporations and criminals continuing to compete for your information, data privacy is more important than ever.
2023 may be the year data privacy gains much-needed legal protection from governments worldwide.
India, one of the world’s fastest-growing online markets, is expected to pass the Personal Data Protection Bill — its version of the GDPR — this year. The legislation will include requirements for companies to get individual consent, correct inaccurate personal data, and protect data rights.
We may also see data privacy laws tightening in the U.S., depending on Congress’ actions.
2023 could be the year that the American Data Privacy and Protection Act gains traction and finally establishes a data privacy framework on the federal level.
#5 We may see more blockchain-based cybersecurity solutions
Blockchain technology is beneficial for secure, decentralized information storage and exchange. Blockchain delivers unrivaled data integrity, transparency, and decentralization.
In 2023, blockchain will likely be applied to cybersecurity in new ways, helping to create advanced and virtually unbreakable digital security solutions.
Until now, using blockchain in cybersecurity has been very expensive because of how new the technology is.
However, blockchain is maturing and attracting substantial investment. Therefore, this year we may see blockchain technology increasingly being used in cybersecurity solutions.
#6 This year could be the end for third-party cookies
Google is working on phasing out third-party cookies in Chrome — another huge win for data privacy.
Third-party cookies are trackers that advertisers and website owners use to collect data and track user behavior. While first-party cookies mainly collect data about your user experience, third-party cookies track you around the web and pose privacy and security risks.
Firefox and Safari browsers already protect users from third-party trackers, and you can even disable cookies yourself. However, removing third-party cookies from Google Chrome is a major win for privacy because two-thirds of all internet browsing happens on Chrome.
#7 Hackers may carry out more supply chain attacks
Hackers are predicted to continue targeting organizations by launching attacks on weaker supply chain links. We’re already seeing this trend in 2022, and it is expected to grow in 2023.
The supply chain consists of a network of organizations, resources, individuals, and activities involved in the creation of one single product.
By targeting a weaker point in the attack chain, cybercriminals can take advantage of the trust organizations place in third-party vendors.
These attacks are likely to increase in 2023 — with businesses continuing to lose large sums due to production disruptions.
#8 Fileless malware may become a more serious threat
Fileless malware is malicious software that uses built-in applications to infect a device, making it extremely difficult to detect and eliminate.
This malware exploits software vulnerabilities in well-known and trusted applications you’ve already downloaded, leaving no trace of the attack on the device’s memory.
Fileless malware has been a cybersecurity threat since its emergence in 2017 — but it is likely to become even more damaging in 2023. Cybersecurity technologies are constantly evolving — but so are cyber threats.
Fileless malware has always been difficult to detect, but the sophisticated methods and tools attackers use make it even harder. While fileless malware isn’t easy to develop and execute, it can cause immense damage if done successfully.
#9 Cloud security may become more important
Most companies use cloud computing for storing files. Cloud technologies provide a centralized location for applications and data and are more secure than storing files on-premises.
However, several cloud security issues still exist. For example, misconfiguration of security settings or hijacking accounts could lead to data breaches or unauthorized access.
With more and more companies moving their data into the cloud instead of storing files locally, we are likely to see a growing number of attacks on cloud vulnerabilities. Therefore, improving cloud security is expected to be a crucial element of organizations’ security strategies.
#10 Consumer data breaches may decline
The following prediction may be good news for customers — but not for businesses: we’re likely to see a decline in consumer data breaches in 2023.
Cybercriminals are finding new and more profitable ways to make money. An increasing number of hackers turn to ransomware — demanding that the breached company pay a large sum of money to retrieve the stolen data.
Bot sales are becoming more common, too. Hackers can purchase bots with customer information without initiating a data breach.
These sophisticated techniques mean that hackers are less likely to leak your personal information and opt for the “big wins” instead.
How to increase your online security in 2023
We can expect many cybersecurity challenges this year, so taking the necessary steps to protect yourself online is paramount. Here are the main ways to stay safe and secure in the digital world:
Use strong, unique passwords. Weak passwords can cause serious damage. If your passwords are short, common, or something that could be easily guessed by a hacker, it’s like you’re leaving your door unlocked at night. Create strong, long, and unique passwords — or secure your passwords with a reliable password manager.
Stay in the know. Hackers are more successful with people who don’t know much about the dangers of the digital world. Make sure you know about the most common cybersecurity threats and what new, sophisticated hacking techniques are on the rise. Staying in the loop will help you spot anything suspicious — and protect yourself before anything happens.
Use a VPN. A VPN secures your internet connection and hides your IP address, protecting you from hackers and keeping your data private. If you choose NordVPN, you’ll also get free Threat Protection — an advanced cybersecurity feature that blocks annoying ads and intrusive trackers and scans downloads for malware. On top of that, a VPN protects you on public Wi-Fi, keeping your data safe and secure.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Nord Security The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
