Ditching the Data Center: Cloud Migration Is Step One for a More Robust Cyber Security Program

In the face of a series of recent high-profile cyber-attacks, from the Colonial Pipeline to JBS Foods, companies globally will likely be looking inward and wondering what they can do to better protect their companies from similar attacks.

The truth is that in many cases, companies’ approaches to cybersecurity were likely developed at a time when cyber threats were much different. Perhaps the more alarming truth, however, and the one the industry most has to reconcile itself with, is that with the rate of change from a technological perspective unless your security systems are incredibly malleable, you will almost always be on the back foot when it comes to protecting your company and its data.

Introducing that level of adaptability to your security systems requires a more holistic approach to your broader technology systems themselves, specifically, an approach that acknowledges that cybersecurity is about more than just firewalls and encryption.

This will also mean looking at the underlying structure of your internal systems – mainly looking at where your data actually “lives” and how it’s accessed by you and your employees.

When looking at some of these major cyberattacks, the first question is always where and how did they get into the system. At a fundamental level, if you can pinpoint exactly where your data is stored, so can an attacker. In the case of the Colonial Pipeline attack, for example, the “door” into their system was a series of computers literally running along the line connected to one another through the public internet.

If you can effectively hide or mask the location of your data, you immediately make it much more difficult to attack you. This is, perhaps, the strongest argument in favor of migrating your internal systems to the cloud, if they aren’t there already.

In a carefully structured cloud-based system, your data doesn’t exist on any physical machine, making it much more difficult to access. In effect, every time a machine attempts to access your data, you have to go through an authorization process to prove you are who you say you are, and only then can you access that one specific part of data that you’ve requested.

If you can’t see or touch the machine that holds your data, other people can’t either. Of course, simply migrating to the cloud doesn’t make you and your data immune from a cyberattack, but it does allow your data to be fundamentally harder to access.

What’s more, the flexibility a cloud-based foundation affords also allows for a faster response time, more effective warning signals, and the ability to cut off access to your data almost instantaneously – if you use it right.

It’s important to design your cloud infrastructure in such a way that the machines being used to access your data in each instance can also be instantly terminated, meaning, if someone does manage to maliciously get access to your data through a machine, you can cut off that access right away.

This way, once the bad actor has had their access cut off, you can simply start back up from a new, clean machine. The ability to repeatedly, quickly and easily shut down your system and restart it from your last backup is absolutely crucial to your ability to prevent and protect against a cyberattack.

This also means that snapshots and backups of your virtual machine data are also very important to ensure that the disruption from having to take a machine offline is minimized. Cloud backup technologies are extremely sophisticated and can create incremental intraday snapshots that are secure and durable, this makes it very easy to restore state)

It must be said that not every business has the resources to build this one their own, but there is a multitude of cloud providers and technology partners who can help businesses find an effective, and more cost-efficient, a solution that doesn’t require the same level of internal resources as building it themselves.

The added bonus of working with a partner is, in many cases, they will add an extra layer of security, simply because they have to protect their own data as well. If you were to use AWS or Microsoft for your cloud services, you are essentially also using their security resources as well.

All of this is to say that effective cybersecurity is not about anyone given piece of code or software – protecting your business requires a truly holistic way of thinking about data and information, and an approach to system-building that allows for the greatest amount of flexibility and adaptability.

Building your systems on the cloud, while not a total security solution, does allow you to at the very least make your data more difficult for a bad actor to access. Taking it one step further, the cloud also affords you a higher level of that adaptability that allows you to respond quicker and more effectively than an “old-style” data center.

Of course, simply moving your data to the cloud doesn’t make you impervious to an attack, but it’s an important first step towards making your business that little bit more secure.