How and where we work has changed a huge amount in the last few years. The impact this change has had on what we do with our data is widespread and fundamental. We now want to be able to work wherever and whenever we want and that means being able to access data and applications from anywhere, rather than everyone logging on from a central office location.
Key takeaways
- Effective data management is crucial for businesses to save costs and improve efficiencies, especially in today’s work-from-anywhere environment.
- Public cloud migration can help businesses facilitate remote work and improve access to data and applications, but it’s important to maintain good hygiene and security protocols.
- Maintaining good patching protocol, updating applications, and using the right tools can help businesses optimise their public cloud infrastructure and prevent security breaches.
- User education is critical in ensuring the success of any security measure, and organisations should establish processes to deal with security incidents swiftly and efficiently. Multi-factor authentication and backup and recovery plans should also be implemented to prevent and mitigate security breaches.
To facilitate this kind of access a lot of businesses have already or are now looking to migrate their infrastructure to more of a public cloud environment. This process isn’t ever the same. It’s unique to every business and runs in line with their overall strategy.
Of course there are absolutely valid grounds for organisations to stick with a more traditional host exchange approach. You might have concerns about data sovereignty or be running legacy applications with compatibility issues for example.
But if you have either already moved, are thinking about moving or are actually in the process of moving it’s important that the hygiene of your public cloud environment is shipshape and Bristol fashion.
It can be a daunting task though, especially if it’s new to you. But there are some relatively straightforward things you can do to ensure you at least have a decent starting position.
Patching vulnerabilities and updating apps
This one might seem obvious but it’s amazing how often it slips down the priority list. It’s the boring everyday stuff like maintaining good patching protocol and ensuring that all applications are up to date and running the latest security software that can often make the biggest difference in terms of ensuring all the back doors are close.
This can be a particularly challenging issue for host exchange and on-premise customers who may be running bespoke or legacy apps that can be more difficult to keep up to date.
Taking advantage of the right apps for the right things
When working within a public cloud infrastructure, especially when combined with a SaaS product like 365, there are usually hundreds of tools to help get the most out of your set up. It’s very unlikely that you’ll need all of them but, depending on what you’re trying to achieve, some of them can be extremely useful.
Most of these tools don’t come ready to use out of the box though. There is normally a level of configuration required, without which the tools almost certainly won’t work as they should. While it is unlikely that these unoptimized apps will lead to any serious damage in terms of your security, They can become seriously counterproductive when it comes to you achieving your goals.
Adopt an ‘assume breach’ mentality
Assume breach is a position advised by the National Cyber Security Centre (NCSC). The concept encourages organisations to build and operate systems on the basis that something will go wrong at some point, will have to be dealt with.
Establishing processes to swiftly and efficiently deal with an incident allows you to effectively minimise the damage. If these processes aren’t established ahead of time then it can have an extremely detrimental impact on your ability to deal with the situation as it unfolds.
Having good visibility of activity on your cloud, using detection tools such as Microsoft Defender for example, means you can react quickly (because you know when it happened) and effectively (because you know exactly what was impacted).
Backup and recovery
With the security landscape more complex and dangerous than ever, many security experts are advising organisations to adopt a when not if approach to their security. In other words, no matter how robust your preventative measures are you should always have recovery plans in place. That means that even if the worst does happen and you suffer a serious breach you can quickly return to a recent backup with minimal disruption.
Of course this doesn’t happen on its own and requires a lot of planning, training and preparation to ensure that everyone knows their role when a breach does occur.
Crucially, most public cloud suppliers do not provide a comprehensive backup service so you should do plenty of due diligence to ensure that what you have in place in adequate and fit for purpose.
Multi factor authentication (MFA)
It’s often said that there is no silver bullet when it comes to security but MFA is perhaps as close as you’ll get. Look at just about any breach which is picked up by the media and 99 times out of 100 it would have been prevented if MFA was properly implemented.
It might seem like a basic precaution but it is extremely effective and could make the difference when it comes to your organisation getting breached or not.
User education
Of course, none of these steps are going to be effective if the people using the system on a daily basis aren’t properly trained. Speak to any IT manager and the likelihood is they’ll say their biggest security concern is their users.
If your staff know the reason for a measure being in place, how to use it and that it is configured in such a way as to have the least impact on their day-to-day activities as possible then the chances of them making a basic mistake that leads to disaster will be greatly reduced.
It’s also really important that end users know how to report suspicious emails or contact and who to report it to. If they know these things, then whatever the piece of content is can quarantined and removed from the inboxes of other users who might not have the same level of vigilance.
This may all seem fairly basic but don’t underestimate its importance. It should be a key part of your organisation’s technology strategy.
So, there you have it, some basic tips to help keep your cloud environment working safely, securely and efficiently.