Private Cloud and Cyber Resilience
As targeted ransomware threats proliferate, organizations that are proactive, vigilant and cyber-resilient can take advantage of private cloud to gain agency over their cloud environments, mitigating risk and reducing downtime in the event of a cyberattack.
The 2022 Rackspace Technology® Cybersecurity Research Report found that cybersecurity outranks other serious issues confronting the business world, including runaway inflation and chronic supply-chain bottlenecks. Businesses face inherent risks when using the cloud, and with the brisk pace of cloud adoption and innovation, security must keep pace with these changes.
Our research found that while a majority (59%) of survey respondents cited cybersecurity attacks as the top business concern across the C-suite, less than half of respondents (43%) say that they are protecting critical data and assets from cyberthreats.
Underscoring the significance of these findings is the fact that customers often tell us that security is at the forefront of their decision-making processes. They want to ensure that they and their customers remain secure. Cybersecurity is their number one business concern, yet only a few companies feel protected.
Increased activity translates to increased threats
Cyberattacks have graduated from the opportunistic breaches of yesterday to the organized, persistent threat attacks we see today. Bad actors have organized and built capabilities into malware so that it moves automatically across networks. This helps to ensure that ransomware remains effective even after remediation at the point of the breach.
Cybersecurity Ventures cites 2021 research showing that a ransomware attack occurs every 11 seconds, costing global businesses billions. The Cybersecurity Venture study also projects that ransomware will cost industries $10.5 trillion worldwide by 2025.
Hyperscale public cloud providers like AWS, Microsoft® Azure® and Google Cloud do provide security. However, they cannot secure everything because third-party organizations are provisioning services, configuring them and using them.
The hyperscale public cloud providers speak openly about how their platforms are just as secure as any private cloud. We agree; they are just as secure — sometimes even more secure. However, on a hyperscale cloud platform, there is a shared responsibility for security between the cloud provider and the customer.
Using an air gap to facilitate fast recovery
It’s quite common to find significant gaps in an organizations’ cloud security practices. These gaps expose them to risk of a cloud breach. So, as cyberthreats evolve and the adoption of cloud applications accelerates, companies must constantly evaluate their processes to ensure that their security practices are keeping up.
One such solution, used by a financial services customer of ours, is an air gap solution we’ve nicknamed “business in a box.” While it’s not a solution for the customer’s entire environment, an air gap is a way to isolate core operations and code, and keep them separate and disconnected — offline — from primary systems.
In the event of a ransomware attack, this customer’s air gap solution can be activated, business operations can be restored, and end-users experience continued service, unaffected, while issues are resolved behind the scenes.
Taking action to protect healthcare
Because attackers will seek out any vulnerability they can find, security patches must be kept current and data backups become a critical element of your business continuity plan.
The frequency of ransomware attacks on healthcare and hospitals is increasing. One of the largest victims of the 2017 WannaCry ransomware attack was the UK’s National Health Service (NHS). Up to 70,000 devices in hospitals in England and Scotland — including computers, MRI scanners, blood-storage refrigerators and theatre equipment — may have been affected. NHS services such as appointment scheduling were lost, some facilities had to turn away non-critical emergencies and, in other instances, ambulances were diverted.
Although NHS had already applied critical Microsoft updates to patch its systems, backups became a key area of focus, and in some cases, required entirely new backup systems that were cloud-based. Working with a managed private cloud platform (like one from Rackspace Technology) that includes managed backup will, in most cases, create a level of separation that would be difficult for attackers to compromise.
Your organization can get in front of the issue by reducing accessibility to backup data. Plan your readiness today, whether it's attack- or remediation-oriented. An immutable backup is a backup file that attackers can't alter in any way. You should perform immutable backups and make them ready to deploy to production servers immediately in case of ransomware attacks or other data loss.
For added resilience, you can air-gap backup copies of data to create an additional level of isolation. An air-gapped backup is a copy of your company's offline and inaccessible data. An air gap makes it virtually impossible for hackers to remotely access your information when isolated from the public internet or a LAN. Your backup device cannot be remotely hacked or corrupted without an internet or other network connection because it is disconnected from the internet and inaccessible at all times.
Cyber-resilience is a proactive pursuit
Because ransomware attacks are increasingly frequent and precise, we must all remain vigilant and proactive in our pursuit of cyber resiliency. Eight in 10 survey respondents said that their employer spends between 9% and 14% of their IT budget on cybersecurity. We think these numbers are a little low given the complexity of the threat landscape, but the data shows that budgets are inching upwards.
Our research also shows 61% of organizations struggle to fill cybersecurity roles. This must change quickly. For cloud innovation to continue, security and proper budgeting must keep pace with cloud development and deployment. This means organizations must proactively budget for and implement cloud security, and manage risk with automated security tools to protect cloud data at a level commensurate with increasing cloud adoption and threats.
We must all be cyber-resilient.
How to Prepare Your Team to Leverage Cloud Operating Models
About the Authors
Solution Architect
Hiten Mistry
Hiten Mistry is a Solution Architect covering the multiple managed services offered by Rackspace Technology. He has over 23 years of experience in the managed hosting industry with expertise in designing solutions covering private cloud, Amazon Web Services, Microsoft Azure and Google Cloud. Hiten has Solution Architect Professional/Expert level certifications for all three of the public cloud platforms along with Network and Database specialty certifications for AWS. Hiten has worked with many global organizations and has built up experience in designing solutions for a wide variety of market segments and global regions. Hiten has a keen interest in the developments within public and private cloud platforms to help organizations solve complex IT challenges that they may be facing.
Read more about Hiten Mistry