Four trends shaping cloud security in 2023

Let’s take a detailed look at each of these.

As more organizations plan their journey to the cloud, more questions around data privacy and custody begin to come to the forefront of the security discussion. This is not a new discussion. It has been around data centers for years, as organizations from the public and private sectors began to use technology to store user and customer data. The US has industry-specific standards and processes for handling data privacy (such as HIPAA for healthcare), while Europe has GDPR to protect the personal information of individuals.

In addition to privacy, governments want to protect data from being exposed and decrypted during a seizure of information. This concern was amplified by laws enacted in countries that wanted the legal authority to seize information from local companies that are doing business internationally.

Initiating data sovereignty protects this data by containing it within a country’s geographic boundaries to protect user privacy as a fundamental human right, such as through GDPR. If legal compliance is necessary to hand over the data, its sovereignty and privacy is protected by encrypting all hosts, operating systems and data utilizing external third-party key management systems.

Some hyperscalers provide confidential computing systems with encrypted processors and memory chipsets. They also provide separation of duties by managing keys with hardware security module (HSM) key management solutions. These HSMs are then managed in the sovereign geographic jurisdiction, requiring additional legal requests to obtain cryptographic information.

Maintaining digital sovereignty and data privacy for users continues to be a growing concern and will be an emphasis in cloud security in 2023 and beyond.

There is no way to avoid malicious behavior. There will always be bad actors that want to either do harm or simply prove to someone that they can. As all our identities move online, these behaviors will continue to trend upward and require security personnel to stay one step ahead.

Organizations that have traditionally operated their own data centers are planning to make either a partial or full data center exit — but why would they want to do this, with malicious behavior continuously increasing? Simply put, they want to leverage hyperscaler scalability and compute capabilities for data analytics, AI and machine learning. It then becomes the security team’s responsibility to detect threats and malicious activity before any damage is done.

In most cases, traditional on-premises security controls do not transfer to cloud infrastructures. It requires a mix of controls for a hybrid infrastructure to protect both cloud and on-premises resources. As organizations move to expand their cloud footprint and become more cloud native, the use of cloud security controls will expand — many of which can be used to monitor and manage security posture on-premises and in other cloud providers.

This growth of cloud security controls for both cloud and on-premises infrastructures will continue to trend upwards in 2023.

Rather than expanding, the workforce seems to be decreasing globally. This talent shortage is very apparent within cloud security and infrastructure. The combination of individuals leaving the workforce and rapidly changing technology has amplified the gap. Many organizations have attempted to offset these gaps by outsourcing talent through managed security service providers (MSSP). Unfortunately, many of these organizations are facing the same challenge in training and retaining talent.

One way to combat this issue is to invest in upskilling your current talent. This is an approach that organizations and MSSPs have taken over the past few years as cloud adoption accelerated. Another approach is to utilize more automation to minimize the dependency on a small group of individuals to protect an organization.

Implementing automation within your organization enables you to eliminate mundane and repetitive tasks. Automation can be used to detect and respond to threats by utilizing artificial intelligence and machine learning (AI/ML) to identify unusual user behavior. It can also be leveraged to deploy organizational standards and best practice security controls when deploying infrastructure to avoid misconfigurations that may create vulnerabilities.

Automation will continue to be used to address the talent shortage as more organizations move to cloud-native security controls and tools. Eliminating repetitive tasks and allowing personnel to focus on more complex attack investigations may have a positive impact on talent retention as well.

We live in a connected world. Everyone has more Internet-connected devices in their house and office than they did ten, or even five, years ago. This operational technology (OT) continues to increase year-over-year. Ten years ago, who would have thought that your refrigerator could recognize that you need milk and order it from your local market?

About 15 years ago, we had concerns when printers began to be connected to networks, enabling us to scan to email and file servers. There were news reports about malicious attacks against these multi-function printers that enabled attackers to access and obtain sensitive information that had been printed.

Today, we have smart lightbulbs, thermostats and digital assistants in our homes and offices. This increase in connected OT collects data that can be used for good — like when a business wants to understand temperature variations in a manufacturing facility or ensure that a life-saving vaccine is being transported at a safe temperature. This is the positive side of how OT is being used.

Unfortunately, this data and the volume of data being collected is intriguing to attackers. Maintaining proper levels of security for these edge devices is a growing necessity of cloud and hybrid infrastructure security. Monitoring connections for malicious activity and utilizing a private connection from these devices to the cloud infrastructure will be a growing trend in the coming years.

The hyperscalers were asked a follow-up question about emerging technologies that could impact cloud security in 2023.

Whether you are attempting to maintain sovereignty of your data, protect your hybrid and edge infrastructure, or increase your level of automation, these hyperscalers are ready to assist. Leveraging their capabilities, Atos’s cloud and cybersecurity expertise and solutions to address these trends, you will be better poised to protect your organization in 2023 and beyond.