1. Introduction
The cloud has revolutionised the way companies design and use their IT infrastructure. With promises of scalability, cost efficiency and flexibility, cloud and SaaS services attract companies worldwide. But how secure is your data in the cloud really? The increasing shift of sensitive information to external cloud environments poses new challenges for data security. Is your data sufficiently protected against unauthorised access, data loss or cyberattacks? In this blog, we shed light on the key security aspects of the cloud and show how a structured approach to risk assessment and data-centric security measures can help companies protect their data effectively and use the benefits of the cloud without compromising on security.
Many of our customers are uncertain when it comes to assessing the data security of SaaS and other cloud services. Discussions are often based more on belief than on facts. There is a widespread misconception that cloud services are fundamentally more secure than one's own infrastructure. This fallacy can have serious consequences.
In this blog, we want to provide clarity and show how a structured approach to the risk assessment of data security in the cloud, together with the implementation of data-centric security measures, can help to identify the actual risks and mitigate them effectively. With these two essential components, companies can develop a well-founded security strategy that ensures both the detection and the reduction of threats in their cloud infrastructure.
2. The need for a structured approach
A structured approach to risk assessment is essential to ensure the security of company data in the cloud in the long term. Instead of relying solely on trust in the service provider and mere belief, or blind trust, a systematic analysis enables an objective and comprehensive identification of the potential risks. Cloud services are often complex and dynamic, and the providers' internal security measures and processes remain largely opaque to outsiders. Without a structured assessment, there is a danger that critical threats will be overlooked or that assumptions and misjudgements will lead to inadequate security measures.
A structured approach offers several decisive advantages:
Complete risk inventory: all potential threats are systematically recorded and assessed, so that no significant risks are overlooked.
Prioritisation of risks: by assessing the likelihood of occurrence and the potential impact, companies can address the most urgent risks first.
Well-founded basis for decisions: based on objective data, well-founded decisions can be made and targeted security measures implemented.
Transparency and traceability: the documented analysis increases transparency and allows the decisions taken to be clearly traced.
Efficient resource allocation: resources can be invested specifically in the most important security areas, avoiding unnecessary expenditure.
Continuous improvement: a structured approach encourages regular review and adjustment of the security strategy in order to be able to respond to new threats and changes in the business model.
By implementing a structured risk assessment approach, companies can gain self-determination over their data security instead of relying solely on the providers' security promises. This reduces dependence on external factors and strengthens resilience against unforeseen threats. Ultimately, a well-founded risk assessment helps to build a robust security architecture that meets the complex requirements of modern cloud environments and increases confidence in one's own security strategy.
3. Comprehensive risk assessment of cloud and SaaS services
The use of cloud and SaaS services offers numerous advantages, but also entails considerable risks. A comprehensive risk assessment is indispensable for identifying and assessing these risks and taking appropriate measures. This article describes 25 core risks in detail, assesses them quantitatively and qualitatively, analyses trends and discusses the reversibility of the impacts.
3.1 The 25 identified core risks
We have identified 25 key risks that can arise when using cloud and SaaS services.
3.2 Explanation of the risk assessment
The risk assessment provides a structured overview of the identified risks and how they are rated. It comprises various columns that show both quantitative and qualitative aspects of each risk. To make the table easier to understand, you will find an explanation of the individual columns below:
Quantitative assessment
Likelihood (L): Description: the likelihood assesses how probable it is that a particular risk will occur. It is quantified on a scale of 1 to 5, where 1 stands for very unlikely and 5 for very likely.
Impact (I):Description: the impact measures the potential extent of damage if the risk occurs. It is also rated on a scale of 1 to 5, where 1 stands for very low and 5 for catastrophic.
Risk score (RS):Description: the risk score is the product of likelihood and impact: RS = L * IIt serves to quantify and prioritise risks. A higher RS means a higher risk.
Qualitative assessment: risk level
Description: based on the risk score, each risk is assigned a risk level. This qualitative assessment helps to gauge the urgency and priority of a risk.
Low: RS 1 - 5
Medium: RS 6 - 10
High: RS 11 - 15
Very high: RS 16 - 20
Critical: RS 21 - 25
Trend analysis
Description: the trend analysis indicates how the risk is expected to develop in the future. It makes it possible to respond proactively to changes.
▲ (rising): the risk is increasing and requires greater attention.
▬ (stable): the risk remains at its current level.
▼ (falling): the risk is decreasing.
Reversibility of the impacts
The reversibility of the impacts assesses the extent to which the negative consequences of a risk that has occurred can be reversed, remedied or at least mitigated. It indicates whether damage is temporary or permanent.
✗ for irreversible
◑ for partially reversible
✓ for reversible
The table in the following chapter summarises the identified risks, including their assessment in terms of likelihood (L), impact (I), risk score (RS), risk level, trend and reversibility.
3.3 Risk descriptions and assessments (example)
In this chapter, the identified core risks are described and assessed in detail. However, to keep the scope of the blog post manageable, we present a comprehensive analysis of risk no. 1 as an example: data loss and corruption.
Description:
This risk relates to the possibility of data being lost or corrupted while it is stored or transmitted in the cloud. Causes can be hardware failures, software errors, human error or natural disasters. Without adequate backups and recovery plans, such incidents can lead to irreversible losses of important business data, impairing business operations and causing financial losses.
Assessment:
L: 3 (Possible)
I: 4 (High)
RS: 12
Risk level: High
Trend: Stable
Reversibility: Partially reversible (with backups), otherwise irreversible
Analysis:
As the complexity of cloud environments increases, the risk remains constant. The impacts can be partially mitigated by regular backups and recovery plans.
3.4 Summary risk table
The summary risk table provides a structured overview of the 25 identified core risks associated with the use of cloud and SaaS services. It combines both quantitative and qualitative assessments to gauge the urgency and priority of each risk. This table serves as the basis for prioritising the risks and developing effective mitigation strategies.
Notes on the table:
Rising trends are particularly critical, as the risks will increase in the future.
Irreversible impacts require special attention, as they cannot be reversed.
Critical and very high risks should be treated as a priority.
4. Data-centric security
4.1 What is data-centric security?
The data-centric security approach focuses on protecting the data itself, regardless of where it is located or how it is transmitted. In contrast to traditional security models, which concentrate on the perimeter protection of networks and systems, data-centric security places information at the centre of the protection strategy.
By implementing the highest security standards, such as end-to-end encryption and on-premises key management, companies can ensure that their data is protected against interception, manipulation and unauthorised access. This means that the data is always encrypted during transmission and storage and that control over the encryption keys remains exclusively with the company.
This approach not only prevents access by external attackers, but also offers protection against insider threats, as neither cloud providers nor their employees or subcontractors have access to unencrypted data. Restricted access authorisation minimises the risk of human error or malicious actions.
Compliance and legal certainty are further decisive aspects. The data-centric approach helps companies meet regulatory requirements and data protection laws such as FINMA (Swiss Financial Market Supervisory Authority), DORA, the revised Swiss Federal Act on Data Protection (FADP), the GDPR and local regulations. By controlling data location and data access, legal risks can be reduced considerably.
Despite high security requirements, companies must remain agile. The approach enables flexibility and integrations by supporting the processing of encrypted data for efficient business processes. Secure interfaces for sending emails and other integrations ensure that data is only decrypted where it is absolutely necessary.
The company's future-proofing is ensured by its ability to adapt to new threats and changes in the law. Scalability is possible without compromising on security, so that companies are prepared for growth and change.
4.2 Advantages of the data-centric approach
The data-centric security approach offers effective solutions for mitigating the many risks involved in using cloud and SaaS services. Through continuous encryption, on-premises key management and the ability to process data in encrypted form, companies can preserve their data sovereignty, meet compliance requirements and significantly strengthen their security posture.
End-to-end encryption protects data against interception and manipulation.
On-premise key management prevents access by third parties, including cloud providers.
Restricted access: neither cloud providers nor their employees or subcontractors have access to unencrypted data.
Minimisation of risks from human error or malicious actions.
Compliance with regulatory requirements and data protection laws such as FINMA, DORA, the revised FADP, the GDPR and local regulations.
Reduction of legal risks through control over data location and access.
Processing of encrypted data enables efficient business processes.
Secure interfaces for sending emails and other integrations in which data has to be decrypted.
Adaptability to new threats and changes in the law.
Scalability without compromising on security.
Highest security standards
Protection against insider threats
Compliance and legal certainty
Flexibility and integrations
Future-proofing
By implementing the data-centric security approach, companies can not only massively improve their overall security, but also ensure flexibility and future-proofing. This approach makes it possible to meet the challenges of digital transformation effectively while maintaining the highest security standards.
5. Risk mitigation through data-centric security
Introducing the data-centric security approach can massively improve a company's overall security. Targeted measures effectively mitigate the identified core risks of using cloud and SaaS services.
5.1 Mitigation measures for the 25 core risks
We have developed specific mitigation measures for each identified risk:
Continuous encryption
On-premise key management
Local backups
Encrypted data remains unreadable
Keys are not in the cloud
Processing in encrypted form
Strict access controls
Encryption of the data
On-premise key management
Control over encryption keys
Data is unreadable for cloud providers
On-premise key management
Processing in encrypted form
Independence through own keys
Encryption minimises dependencies
Standardised encryption
Data portability through encrypted formats
Compliance with data protection laws
Demonstrable security measures
Local key management
Protection against misconfigurations through encryption
Encryption at data element level
Protection against ransomware through encrypted data
Data remains encrypted in the event of vulnerabilities
Key control prevents unauthorised decryption
Independent security measures
Encryption as an additional control
No access to unencrypted data
Keys are not held by the provider
Data is inaccessible to third parties
Keys remain on-premises
Use of strong algorithms
Key management by the data owner
Flexibility through own data control
Integration without security compromises
Efficient encrypted data processing
Reduced dependence on expensive services
Standardised encryption facilitates integration
Secure interfaces without decryption
Control over data and keys
Encryption protects against disclosure
Own key management
Independence in emergency measures
Adaptability through own control
Rapid implementation of new requirements
Training of internal staff
Own security measures
Encrypted data minimises impact
Data portability makes switching easier
No access to unencrypted data
Supplementary training
Encryption protects intellectual property
Control over data access
5.2 Updated risk assessment
By implementing the data-centric security approach, the identified risks are significantly reduced. We have reassessed the risks, taking into account the mitigation effect of the approach.
The assessment is carried out in the following steps:
Identification of the original risk score (RS).
Assessment of the mitigation effect (scale of 1 to 5).
Calculation of the new risk score:
Adjustment of the risk level based on the new RS.
Review of reversibility and how it changes through mitigation.
5.3 Summary table of risk reduction
Analysis of the overall risk reduction:
Reduction of overall risks: the overall risks were reduced by 122 points.
Improvement of risk levels: many risks have fallen from ‘Critical’ or ‘Very high’ to ‘High’, ‘Medium’ or even ‘Low’.
Improved reversibility: some risks have changed from irreversible to partially reversible or even reversible.
6. Conclusion
The idea that cloud services are inherently more secure is a dangerous illusion. Without a thorough risk assessment and appropriate security measures, companies expose themselves to considerable dangers. The data-centric security approach offers an effective solution for mitigating these risks and retaining control over one's own data.
Recommendations:
Implementation of the data-centric approach: protect your data effectively and stay in control.
Structured risk assessment: rely on facts rather than gut feeling.
Continuous monitoring and adjustment: stay agile and adapt your security measures to new threats and requirements.
Employee training: raise your team's awareness of security risks and train them in handling new security measures.
7. Note on its illustrative nature
The risk assessment and mitigation presented here serve as an example. Depending on the industry and the individual company context, additional risks may arise or existing risks may be assessed differently. It is crucial that every company carries out a risk analysis tailored to its specific circumstances.
Learn more about data-centric protection or Prewen's data security offering.
Questions on this topic? We look forward to talking with you.
Get in touch