Towards a More Secure Cloud

With cloud computing thus entering mainstream technology, Chief Information Security Officers (CISOs) have a key role to play in safeguarding the data stored, and mitigating cybersecurity threats, while also ensuring compliance with IT regulations, standards, and policies. Here are five areas that every CISO needs to consider to ensure that their cloud data, assets, and brand are well-protected.

1. Enabling a Risk-based Approach to Data Protection

As custodians of sensitive customer information, CISOs play a major role in keeping data in the cloud safe and secure. More than anyone else in their organization, they have a clear insight into the risks that can impact the integrity, confidentiality, and privacy of sensitive information. Therefore, it is imperative that they be part of core team discussions that examine cloud related risks such as the loss of intellectual property (IP), loss of customer information, and business operation disruptions.

CISOs can add value to the discussion by highlighting cybersecurity risks in the context of the business – i.e. by correlating IT assets and their residual risk scores with their business importance. These insights are essential in examining the need for new cybersecurity investments from a strategic and organizational perspective, rather than from a technical or upgrade perspective.

2. Maintaining Controls in the Cloud

When it comes to the cloud, many organizations tend to focus on costs rather than controls. But without effective controls, it’s only a matter of time before a serious cybersecurity incident occurs. And when it does, the resulting losses can be significant. Therefore, it falls to the CISO to ensure that sufficient controls around cloud-based data segregation, data security, and infrastructure security are incorporated into cloud deployments from the start. A sustainable control monitoring mechanism is also essential to check that controls are working as expected. These initiatives can help ensure that cloud investments have a positive trade-off from a total cost of ownership perspective.

3. Strengthening Risk Reporting

If business stakeholders are to make fully informed decisions, they need to be aware of critical IT risks and controls in the cloud. CISOs can help ensure that these insights are delivered in a timely manner by establishing a granular IT risk governance and reporting system that encapsulates all IT assets, including cloud-based applications. The system should be built to handle all IT risk and compliance reporting related requirements, as well as their correlation with business operations. Robust analytics and dashboards can also be invaluable in helping enterprises transform raw risk and compliance data into actionable business intelligence for quicker and better decision-making.

4. Ensuring a Business Continuity Plan

One of the biggest challenges CISOs face is to detect and respond to a cyberattack or other IT disruption as quickly as possible, so that its impact is minimized. With cloud-based infrastructure, quick incident response is even more critical. To ensure that any and all disruptions are managed in a tightly coordinated and swift manner, CISOs need to have a clear incident response strategy and handbook that are closely aligned with the cloud implementation, and are based on the results of a pre-conducted business impact analysis. A system for mass notifications and incident tracking is also critical in ensuring that all disruptions are handled and resolved smoothly.

5. Acquiring a Cyber-Insurance Policy

Given the tremendous impact that a cyberattack can have on reputation and revenue, many companies are opting for cyber insurance to protect themselves. The current US standalone cyber insurance market is estimated at $2.5 -$3.5 billion annually and is expected to grow by another $2 billion over the next three years. CISOs would do well to proactively monitor the need for cyber insurance, and counsel business stakeholders accordingly. For many companies, cyber insurance is an important hedging strategy in minimizing possible financial losses from data security related lawsuits, business disruptions, and losses.

To Sum Up

With digital transformation increasing, cybersecurity has become one of the most important business and social issues. The CISOs of tomorrow will need to gain sustained support and focus from the top management if they want to succeed in their cyber-fortification efforts. They will also need to ensure that cybersecurity strategies are evolving in line with the business and its wider financial and strategic objectives. The most critical question is not “are we doing enough today,” but rather, “are we thinking enough about tomorrow?”