How not to become the next Capitol One

Tips for employing effective cloud security

In the aftermath of the Capital One data breach, blamed on a hacker taking advantage of a misconfigured firewall—a standard digital security tool—businesses of all sizes should waste no time in examining their comprehensive risk strategy.

Though it is often larger companies with more prominent brands—most recently Capital One and Equifax—that are caught in the spotlight for these breaches, the fact is that any business can be targeted by a malicious actor. Statistics detailing the number of companies attacked go up every day, along with the accompanying costs for repairing the damage. For example, 31 percent of organizations have experienced cyberattacks on operational technology, and in companies with more than 50,000 compromised records, the average cost of a data breach is $6.3 million.

Business leaders can and should do more to help prevent these types of breaches, where simple misconfigurations can lead to catastrophic data loss. Much as businesses invest in insurance policies to protect their legal and financial assets, they need to invest in a risk management strategy as an insurance policy to protect their data, networks, and systems—their most critical assets. Without such a strategy, organizations can face disastrous consequences and an uphill battle to recover lost information, restore customer trust and repair their reputation.

How to employ effective cloud-based security

Like Capital One, a growing number of businesses are adopting cloud-based technologies, taking advantage of the increased flexibility, agility and mobility, monitoring, quicker disaster recovery, and reduced costs this environment offers.

But the Capital One security breach is reported as being caused by an exploitable misconfiguration in the firewall settings of its managed cloud environment. Capital One, much like other businesses moving to the cloud, may have suffered from common misconceptions concerning the security of their cloud environment and their own need to manage their risk.

However, this can be  a costly and dangerous error: organizations should not rely on the cloud service provider for cyber security protection. Ultimately, the responsibility for cyber protection is the responsibility of the business itself, not the cloud provider.

“As more organizations move to the cloud, we continue to see companies that are not prepared to protect their most precious assets: critical data,” said Baan Alsinawi, TalaTek president and founder. “Businesses need to invest in a comprehensive risk management strategy to ensure data is protected. Without one, they are leaving themselves open to cyber threats and breaches. Smart enterprises are realizing that this is the only way to safeguard their systems.”

So how can enterprises keep their data safe and prevent a breach while in the cloud? Here are several crucial steps:

• Carefully assess the risks to their new environment and not assume that the cloud is safe or that their third-party cloud service provider is providing the protection they need.
• Implement a proper risk management strategy and be proactive in monitoring their cloud environments.
• Employ measures such as penetrating testing and cyber threat hunting to preemptively identify weaknesses in their cyber presence and mitigate such weaknesses before others, such as the Capital One hacker “Erratic,” finds and exploits them.
• Consider the benefits of the Federal Risk and Authorization Management Program—FedRAMP—a cybersecurity program whose primary objective is to protect businesses’ critical assets as they make their migration to the cloud. FedRAMP establishes baseline standards for security assessment, authorization, and continuous monitoring for the cloud-based products and services that the federal government uses and are also applicable to the private sector.

Whether an organization already has its data residing in the cloud or plans to do so in the future, it’s critical to have a proper risk management strategy in place in order to build a strong foundation for your cybersecurity program. This comprehensive approach is the best defense against becoming the next statistic in today’s volatile cybersecurity environment.