Cloud Security: Offers Better Security Controls than On-Premise but Comes with Unique Challenges

Cloud security beats on-premise security practices every time. Except when it doesn’t.

Cloud security has managed to turn around a reputation of high risk and poor security into one of puncture-proof security designed and implemented by security experts whose full-time focus is on getting security right. On-premise IT tends to be understaffed and overworked. The effort needed to keep current with the latest security threats and software patches becomes a major stretch. Cloud professionals have the edge, and that’s why many people say that putting data in the cloud is more secure than on premise.

For example, Richard Blanford, managing director at Fordway, said that “in most cases security fears are overstated, and most should be considered more general risk management than security. Most cloud service providers will implement and manage considerably better IT security controls that internal IT departments.”

Kevin Mandia, CEO at FireEye, agreed saying that “you should get better visibility and better controls in the cloud. And the reason why is you’re putting all your decentralized IP and value into one place. It’s easier to monitor it, and it’s easier to safeguard it. You don’t have distributed security controls at this point.”

But more recent hacks like SolarWinds show that the cloud has its own unique vulnerabilities too. The cloud has a unique set of issues with cloud configuration that enabled the hack. Misconfigurations are the Achilles’ heel of the cloud.

The SolarWinds attack wouldn’t have happened with on-premise, or at least the extent of the damage would have been more limited. A report into the causes of the SolarWinds incident blamed misconfiguration problems. Cloud infrastructure is complex and dynamic. Getting cloud security right and maintaining security with no slipups requires constant attention to security and policies.

Part of the problem is that the cloud has made it too easy to roll out new applications and services without adequate preparation. Rob Rachwald, director at Palo Alto Networks, wrote that “the cloud is inherently connected to the internet and it’s surprisingly easy for new publicly accessible cloud deployments to spin up outside of normal IT processes, which means they often use insufficient default security settings and may even be forgotten.”

So, is the cloud more secure than on-premise? It’s hard to say. Both on-premise and cloud have their unique issues. Michael Ritchken, principal consultant at NTT, told TechNewsWorld that “the adoption of any new technology involves challenges to overcome, such as knowledge, people, process, and tools.” Michael Dell, Founder and CEO of Dell Technologies, agreed saying that “public cloud is no more or less secured than on-premise. The reason is that security is about people, and people on both sides can make mistakes and compromise security.”