Over the last year, MSPs have started to rely heavily on the cloud. However, the increase is causing security dilemma.
As customers migrate to the cloud, so do cybercriminals. Recent research from Sophos shows that 70% of organizations having suffered a cloud security incident in last 12 months. Attackers are extending what works already to the new attack surface, meaning that threats such as ransomware are just as topical in the cloud as on premises.
Additionally, the cloud has created space for new risks to emerge, including misconfigurations of cloud resources. Misconfigurations like open ports on cloud workloads and unrestricted network traffic, as well as public data storage are now being exploited by attackers to gain entry. This presents an issue because organizations don’t have adequate visibility to monitor for these errors, which is why according to Gartner, 95% of cloud security failures are the fault of organizations.
Threat detection in the cloud is difficult, and while MSPs are well positioned to make this easier, they also have their own challenges to overcome when managing customers’ public cloud environments:
Complexity of Multi-Cloud Environments
73% of organizations are using two or more public cloud providers. Organizations typically choose to adopt multiple cloud platforms to take advantage the technology best suited for their applications, while also retaining leverage over cloud service providers. But the challenge soon becomes that MSPs need visibility across all public cloud environments to properly monitor configurations, services, and traffic to protect their customers from every angle.
Short-Lived Resources
Five to ten years ago, resources deployed on a virtual or bare metal machine would exist for months or even years, making it simple to go back and look at logs or remote desktop in. Now, resources are much shorter lived with serverless functions that exist for micro-seconds, and containers that exist for minutes. Without this record, it makes it more difficult for MSPs to identify the root cause of a security incident or pinpoint where an abnormality began and stop a threat in its tracks before it can cause damage.
More Services Means More Data
With hundreds, if not thousands of cloud resources and services, MSPs also struggle to aggregate all of the data from disparate sources and identify the high-priority events that could turn into a security incident or run up large usage invoices from the cloud provider. Unfortunately, the volume of data created and shared through the cloud today makes it completely inefficient and nearly impossible for humans to manually sort through the noise and make decisions based on meaningful analysis.
To overcome these public cloud security challenges, MSPs need a Synchronized Security system where all cloud data, monitoring, and management are brought together in one place. By looking at the cloud from this holistic standpoint, it doesn’t matter if a customer has workloads on premise, in the cloud, or in a hybrid environment, and MSPs can start to offer true cloud security posture management.
Deploying Sophos Cloud Optix enables MSPs to continually monitor customers’ entire cloud infrastructure and its configurations to detect insecure deployments, suspicious access events, over-privileged IAM roles, unusual network traffic, and any sudden spikes in cloud spend. Cloud Optix offers the visibility that MSPs need to secure multiple public cloud environments by leveraging AI to highlight and mitigate threat exposure in cloud infrastructure, all in one centralized location.
Adding human eyes on top of this system also creates an extra layer of protection for customers in the cloud, which is why Sophos also offers Sophos Managed Threat Response with 24/7 threat monitoring, detection and response from a team of expert threat hunters. And in the event a cloud security incident does occur, Sophos Rapid Response can immediately identify and neutralize active threats.
The cloud is complex and unfortunately cloud providers have not caught up with the broad variety security risks presented by public cloud environments, but by partnering with a vendor that provides a comprehensive approach to cloud security posture management, MSPs can ensure their customers are fully protected.
Guest blog courtesy of at Sophos. Read more Sophos blogs here.
