Introduction

How many people of a certain (fabulous) age, remembering having the internet for the first time back in the late nineties/early noughties, have the soundtrack of that era suddenly start playing in their head?! The whirr and screech of the dial-up connection and then dad bellowing up the stairs to ‘get off that thing!’ as he’s trying to ring your uncle? Happy days, simpler times maybe, but in reality, we were all stepping into the minefield that was the unknown world of cyber space.

October 29 marks International Internet Day and how things have developed since Infoseek, GeoCities and downloading the club remix of your fave ballad from Napster! The internet has become central to life in many ways and from a business perspective has broken down barriers for growth and potential for reaching vast audiences. Files are shared in mere moments; collaboration can happen without leaving the sofa and businesses can take up space faster than ever.

Cloud services make it easier to work in a flexible manner and access the information at just a click or tap of a button which is of course super handy. But a compromised password or an incorrectly configured security setting can be a field day for a cybercriminal wanting to create all kinds of problems. Can’t have anything, can we?

The likes of Google, Microsoft, Amazon Web Services (AWS), DropBox and Salesforce make things better and more efficient for business life but that doesn’t mean because you’re using a particular provider that all responsibility shifts from yourself.

Understanding shared responsibilities

Many do not realise that between your business and your cloud providers, cyber security is a shared responsibility. How it is shared varies from service to service, but in general the provider manages the infrastructure and services it operates, while your business remains responsible for how those services are used, configured and accessed, and how your data is protected.

We encourage you to make the effort to know what the provider manages, what your business needs to take care of and how data is protected. The National Cyber Security Centre (NCSC) has some great information about the shared responsibility model, which explains how responsibilities are divvied up between provider and customer.

Let’s break it down a little more.

Cloud provider responsibilities

This isn’t a definitive list, so do double check what is covered by your provider to avoid any nasty surprises.

• Physical security: protecting the data centres, servers and network equipment they operate
• Underlying infrastructure: maintaining and securing the hardware and other components the provider manages
• Service maintenance: operating the services and addressing security issues within the parts of the services it provides
• Built-in security services: providing the security controls and tools for services, which a business may need to configure or enable

Responsibilities for your business

Every business plays a key role in keeping good cyber security standards for protecting information, accounts and devices.

• User accounts and access: restrict access to those who need it and remove anyone who leaves or changes role. Have multi-factor authentication (MFA) enabled
• Security settings: check permissions, sharing options and admin accounts. Private information is to remain that way
• Data protection and supplier checks: understanding what information you’re storing, where it’s held, who can access it and how it’s protected. Check your provider meets your business’s data protection requirements, too
• Devices: keep software up to date, enable automatic updates where appropriate and keep equipment secure
• Backups and recovery: familiarise yourself with your cloud provider’s backup and recovery features and decide if additional security is needed and test that you can actually restore critical information
• People: help employees to recognise phishing emails, suspicious links and other common threats
• Incident response: do you have a plan if suspicious activity is detected or if something major goes wrong?

Shared responsibilities

There is some overlap but it’s knowing where your business needs to pick up the baton and whether the level of protection is enough. For example, a cloud provider may offer encryption, but it may be that you enable and configure it to cover your business requirements.

When choosing or reviewing your cloud services, have these three questions in mind:

1. What does the provider manage for me?
2. What do I need to enable, configure, manage or arrange myself?
3. If something does go wrong, what’s my recovery plan and who is responsible for helping?

Ways to improve cloud security

A good place to start for tightening up security is with the areas that matter most.

• Review access: check to see who has access to which business accounts and files. Do they need it to do their job? If not, revoke the access. Remove old accounts, review administrator permissions and enable MFA particularly for emails and accounts which hold sensitive information

• Check security settings: default settings are not always right for what your business needs. File-sharing permissions, access controls and security features need to be looked at and checked so that they are configured to protect the information correctly

• Where is your data kept?: make sure you know where business information is stored in the cloud, the services which hold it and who can access it. Keep it to necessary people only

• Test that backups work: while cloud storage, synchronisation and version history help to recover lost or changed files, it’s not always the full backup strategy. Find out what the cloud provider protects, how long data can be recovered for, and what happens if information is deleted accidentally, corrupted or affected by a cyber-attack. Consider additional, separate backups and test, test, test, that data can be restored.

• Have a plan: it’s better to be prepared for problems than to be caught off guard so know who to contact if data does go awry, there’s an attempted breach or an account is compromised. Set out who will make the decisions, how to keep the issue contained, how you will recover essential data and how the business will keep running while the situation is being dealt with.

Summary

Cloud security is a shared responsibility, but that doesn’t mean you can simply leave everything to the provider. As a business owner, understanding where your responsibilities begin and end, where potential gaps exist and how to address them is all part of keeping your business secure.

This doesn’t mean you’re expected to be a cyber sensei either, but we can guide you in strengthening your security know-how without getting lost in technical instructions or hieroglyphics.

How Pracsys can assist

We’re here so that you don’t have to do any of this alone. Pracsys helps you build your knowledge, confidence and practical skills to manage cyber security more effectively.

Our Security Coach packages are tailored to where your business is now, helping strengthen the approach, understanding priorities and building capability for the long term. Our team is with you on the journey, providing as much or as little support as you need.