Traditional on-premises approaches to cybersecurity can put organizations at risk when applied to the cloud. An updated, modern strategy for cloud security should mitigate risk and help achieve your business objectives.

Cloud service providers such as Amazon Web Services (AWS) place a high priority on the security of their infrastructure and services and are subject to regular, stringent third-party compliance audits. These CSPs provide a secure foundation, but clients are still responsible for securing their data in the cloud and complying with their data protection requirements. This theory is substantiated by Gartner, which estimates that, through 2020, workloads hosted on public cloud will have at least 60% fewer security incidents than workloads hosted in traditional data centers, and 95% of cloud security failures through 2022 will be the fault of customers.

Key Takeaways

  • Cloud service providers like AWS secure the infrastructure itself, but customers remain responsible for securing their own data in the cloud under the shared responsibility model.
  • Gartner estimated that through 2020, public cloud workloads would see at least 60% fewer security incidents than traditional data centers, and that 95% of cloud security failures through 2022 would be the customer's fault.
  • Most cloud data breaches stem from customers misunderstanding their data protection responsibilities and applying poor cloud security practices, not from CSP infrastructure weaknesses.
  • AWS maintains compliance programs for standards including ISO 27001, PCI DSS, SOC 1/2/3, FedRAMP, FISMA, and HIPAA, which organizations can use as reference architectures to close security skills gaps.
  • Effective cloud security requires a DevSecOps culture shift — breaking down silos between development, operations, and security teams — plus executive buy-in and governance aligned to business risk appetite.

Traditional approaches to cybersecurity weren’t designed for the cloud – it’s time for an update

Updating how you think about cybersecurity and the cloud

Despite the significant security advances made by CSPs since the birth of cloud, users still need a deep understanding of the cloud’s shared responsibilities, services, and technologies to align information security management systems (ISMS) to the cloud. Today, the majority of data breaches in the cloud are the result of customers not fully understanding their data protection responsibilities and adopting poor cloud security practices. As the public cloud services market and enterprise-scale cloud adoption continues to grow, organizations must have a comprehensive understanding of not just cloud, but cloud security specifically.

Through 2022, at least 95% of cloud security failures will be the customer’s fault

Source: Gartner

The cloud can be secure – but are your policies?

A poor grasp of the core differences between on-premises and cloud technology solutions resulted in a number of misconceptions during the early days of cloud adoption. This lack of understanding helped fuel one of the most notable and pervasive cloud myths in the past: that it lacked adequate security. By now, most people have come to realize that cloud adoption and digital transformation do not require a security tradeoff. In fact, the cloud can provide significant governance, risk, and compliance (GRC) advantages over traditional on-premises environments. A cloud-enabled business can leverage the secure foundation of the cloud to increase security posture, reduce regulatory compliance scope, and mitigate organizational responsibilities and risk.

It is common to see enterprise organizations lacking the necessary expertise to become cloud resilient. Companies can address this skills gap through prescriptive reference architectures. AWS, for example, has created compliance programs for dozens of regulatory standards, including ISO 27001, PCI DSS, SOC 1/2/3, and government regulations like FedRAMP, FISMA, and HIPAA in the United States and several European and APAC standards. Beyond these frameworks, consultants and managed service providers can work with organizations to provide guidance or architect environments to meet their compliance needs.

Regardless of the services leveraged, the cloud’s shared responsibility model ensures that the customer will always be responsible for protecting their data in the cloud.

Making the change

Similar to the challenges and benefits of implementing DevOps (discussed here by our CEO, Robb Allen), effective cloud security requires a culture change with the adoption of DevSecOps, shifting the thinking in how teams work together to support the business. By eliminating the barriers between development, operations, and security teams, organizations can foster a unified approach to security. When everyone plays a role in maintaining security, you foster collaboration and a shared goal of securely and reliably meeting objectives at the speed of the modern business.

When everyone plays a role in maintaining security, you foster collaboration and a shared goal of securely and reliably meeting objectives at the speed of the modern business.

Additionally, cloud-specific services and technologies can provide autonomous governance of your ISMS in the cloud. They can become a security blanket capable of automatically mitigating potential security problems, discovering issues faster, and addressing threats more quickly. These types of services can be crucial to the success of security programs, especially for large, dynamic enterprises or organizations in heavily regulated industries.

Implementing the right cloud tools can lead to significant reductions in security incidents and failures, giving your teams greater freedom and autonomy to explore how they use the cloud.

The way to the promised land

Security teams and organizations as a whole need to have a deep understanding of cloud security best practices, services, and responsibilities to create a strategic security plan governed by policies that align with business requirements and risk appetite. Ultimately, however, a proper cloud security strategy needs buy-in and support from key decision-makers and it needs to be governed through strategic planning and sound organizational policies. Your cloud security strategy should enable your business to scale and innovate quickly while effectively managing enterprise risk.

Frequently Asked Questions

Who is responsible for securing data in the cloud — the provider or the customer?

Both, under the shared responsibility model: cloud providers like AWS secure the underlying infrastructure, but customers are responsible for securing their own data in the cloud and meeting their data protection requirements.

Is the cloud less secure than traditional on-premises infrastructure?

No — the article cites Gartner data showing public cloud workloads have historically had significantly fewer security incidents than traditional data centers, and that the large majority of cloud security failures are attributable to customer error, not the cloud platform itself.

What compliance standards does AWS support?

The article lists ISO 27001, PCI DSS, SOC 1/2/3, and government regulations including FedRAMP, FISMA, and HIPAA, among others.

What is DevSecOps and why does it matter for cloud security?

DevSecOps integrates security into development and operations workflows rather than treating it as a separate function; the article argues it's necessary because it eliminates silos between teams and creates shared ownership of security outcomes.

What's the most common cause of cloud security failures?

According to the Gartner data cited in the article, customer error — such as misconfigured settings or poor security practices — accounts for the large majority (95% through 2022) of cloud security failures, not weaknesses in the cloud provider's infrastructure.