Organizations continue to move their data to the cloud at increasing rates, year after year. While the types of data migrating to the cloud have stayed largely the same (social security numbers, credit card information, or other sensitive data), the threats to data stored in the cloud continue to evolve. To consider data truly protected, organizations must approach the unique challenges facing cloud storage with attention, research, and a willingness to invest in effective defenses.

Why Security Strategies for Cloud Storage Need to Change

• Your Most Important Assets Live in Storage: Personally Identifiable Information (PII), regulated data, and other sensitive information such as trade secrets and intellectual property are contained in storage. The loss of a single Amazon Simple Storage Service (Amazon S3) bucket containing purchase orders could generate hundreds of hours of work for operations personnel looking to retrieve that information from a backup, and if leaked, signal to a competitor market data or new products in production.
  
  

• Data Continues to Grow: As cloud storage becomes cheaper, more accessible, and easier to use, the volume of data stored in the cloud increases. A consequence of this growth is that new data must be stored in a greater number of storage repositories. Each time a new repository is created, organizations must ensure a security strategy is applied or that expansion can become a major liability.
  
  

• Traditional CNAPP Solutions Don’t Cover Cloud Storage: While cloud native application protection platform (CNAPP) solutions provide visibility into applications, users, workflows, and infrastructure, their coverage of the storage layer is often slim and shallow, if present at all. Without additional coverage, a CNAPP solution itself will leave your ‘security strategy’ exposed to unforeseen vulnerabilities.

  WATCH NOW: Building a Strategy to Secure Your Cloud Storage  

This session discusses how security for storage is different from security for servers, networks, and endpoints; what a security strategy should include; and considerations for evaluating solutions.

Considerations When Building a Security Strategy for Cloud Storage 

Cloud storage poses unique difficulties that require different considerations and protection methods than with servers, networks, and applications. Unique aspects of cloud storage include:

• A Vast Attack Surface: Storage can be accessed by employees, customers, partners, and other parties.

• Data Exists Everywhere: Data is distributed between a number of file, block, and object storage instances.
• Here Today, Gone Tomorrow: Cloud storage resources are designed to be flexible, scalable, and  disposable.
• Threats are Hidden: Malware and sensitive information within files are not typically discoverable until those files are scanned, or downloaded and executed.

When it comes to cloud storage, it is critically important that all security strategies account for all of the above factors. The best security strategies appreciate the unique challenges of cloud storage while remaining easy-to-implement and are simple by design.

Considering these factors, the front line of protection for cloud storage resources must be a malware protection solution. Legacy protection methods, such as firewalls, are not adequate or relevant, as malware can be ingested from a trusted source and distributed downstream in an instant. Remediation after downstream distribution can be costly, and any potential zero-day threats may not be found however thorough the search may be.

The Front Line of Storage Protection

Malware protection for cloud storage, while similar to legacy OS-layer antivirus solutions in terms of ease of installation and use, is dissimilar in its configuration and intent. When selecting a malware protection solution for cloud storage, it is important to consider a number of technical factors:

• What Scale of Protection is Needed? Data landing outside of object storage services, like Amazon S3, need to be protected as well. If your organization ingests data into Amazon Elastic File Service (Amazon EFS) or Amazon FSx, malware scanning must be conducted on that data in addition to any data ingested into Amazon S3. It is also important to consider the ingestion patterns of this data. For example, if new data needs to be scanned upon arrival and periodically afterwards to meet compliance requirements, a solution that provides both event-based and scheduled protection models is required.

• What Level of Protection is Needed? Based on internal and external requirements, including the usage of US Cybersecurity & Infrastructure Security Agency (CISA) Continuous Diagnostic & Mitigation (CDM) Program approved malware scanning engines, one or multiple open-source or premium malware scanning engines may be required. Using multiple engines can also help reduce false-positives and negatives, providing better clarity and accuracy.
  
  
• What Other Requirements Need to be Satisfied? If internal or external requirements mandate that data needs to be scanned in place and can not otherwise be copied or viewed by a solution provider, an in-tenant solution is required. If protection needs to extend to other cloud platforms, provide automated quarantining/remediation, and scan data of any size, a malware scanning solution must address these requirements.

Cloud Storage Security (CSS) provides in-tenant malware protection that covers all major AWS storage types (Amazon S3, Amazon EBS, Amazon EFS, and Amazon FSx) as well as Microsoft Azure Blob. Our solution is built with security in mind, featuring premium, CISA-vetted malware scanning engines, a number of configurable scanning models, and robust quarantining and remediation options. To learn more, get in contact with an SME at cloudstoragesecurity.com/contact.

  WATCH NOW: Building a Strategy to Secure Your Cloud Storage  

This session discusses how security for storage is different from security for servers, networks, and endpoints; what a security strategy should include; and considerations for evaluating solutions.

About Cloud Storage Security

Cloud Storage Security (CSS) protects data in the cloud so that businesses can move forward freely and fearlessly. Its robust malware detection and data loss prevention solutions are born from a singular focus on, and dedication to, securing the world’s data, everywhere. Serving a diverse clientele spanning commercial, regulated, and public sector organizations worldwide, CSS solves security and compliance challenges by identifying and eliminating threats, while reducing risk and human error. CSS’s modern, cloud-native solutions are streamlined and flexibly designed to seamlessly integrate into a wide range of use cases and workflows, while complementing and bolstering existing infrastructure and security frameworks. CSS holds certifications including SOC2, AWS Public Sector Partner with an AWS Qualified Software offering, AWS Security competency, and AWS Authority to Operate.