Cloud security and IoT are the new peanut butter and jelly

by Christine Parizo, writer, Tech Pro Research, October 2017

For enterprises using cloud services with IoT, it’s critical to adhere to as many security practices as possible. Experts weigh in on the best approaches to take.

The Internet of Things (IoT) adds another sticky layer to the question of cloud security. Most organizations think in terms of the devices themselves, rather than the services offered through the cloud, as potential vulnerability points. However, with all the data being gathered through IoT devices, organizations will find that utilizing cloud services may be the best way to alleviate strain on their in-house infrastructures. That opens up a whole new can of worms–and experts advise getting on top of cloud security now, rather than later, to prevent costly breaches.

IoT devices will monitor, communicate, and respond according to their environments, according to Paul Hill, senior consultant at SystemExperts. While many of these IoT devices are consumer-oriented, more enterprises are embracing IoT devices for a variety of applications.

“Potentially, IoT will double, or even increase by an order magnitude, the number of devices appearing on an enterprise network,” Hill said. Gathering and analyzing that information will easily exceed most IT departments’ in-house server capacity, leading organizations to cloud data centers. But that comes with its own perils.

Shore up network controls before introducing IoT

The Cloud Security Alliance (CSA) has formed a working group to offer best practices, and experts offer a few of their own tips to prevent cloud security from being the weak link in an IoT deployment: handling traffic, understanding the security around cloud services, and more.

For example, Hill recommended segregating IoT traffic from other network traffic. “Just as most secure organizations segregate their data traffic from their voice traffic, the IoT traffic should also be segregated from other network traffic,” he said, noting that an IoT gateway can be used for this purpose.

In addition, IoT network traffic needs to be monitored and managed once it’s segregated, just like any other traffic on the network. “Many enterprises lack a complete understanding of the network traffic generated by IoT devices and the cloud services they may access,” Hill said. “Tools will be needed to detect whether–and when–compromised credentials or unmanaged devices are used to access cloud services,” as well as to verify that sensitive IoT data and systems are securely handled.

Some insight into traffic can be gleaned from DNS, firewall, and web proxy logs. However, more advanced tools, like intrusion detection systems, intrusion prevention systems, and cloud access security broker systems, should be considered, Hill said.

Advantages of cloud computing include lowered operational costs, greater technological flexibility, and the ability to rapidly implement new systems or services. However, cloud computing has also opened up new opportunities for impact by security threats or lost data. This policy provides guidelines for secure and effective cloud computing operations to ensure the integrity and privacy of company-owned information. Free for Tech Pro Research subscribers.

To read the complete article, click here.