Cloud computing has now become established for business-critical applications at companies. As a result, central security functions are also shifting to the cloud. This trend has intensified, not least due to the pandemic-related shift towards more remote and hybrid constellations. As a result, the cyber security approach has also changed. IT clients are moving away from legacy systems towards cloud solutions. This development is already part of everyday life in MVI SOLVE-IT projects. But what does this mean for IT security?
Despite all the advantages, the use of cloud services does not come without IT security risks. This is because cloud providers are a worthwhile target for attackers due to the high volume of data. The biggest risks are DDoS hacks (Distributed Denial of Service) – attacks in which cloud servers are overloaded, which can lead to disruptions for users. These attacks are on the rise, as shown by major DDoS attacks on Microsoft, Amazon and Google in 2023. C&C (command and control) servers remotely send malicious commands to a botnet or a network of compromised computers. The botnets can be used to collect sensitive information such as bank account numbers or credit card details or to participate in a DDoS attack. Protective measures are therefore crucial to prevent blackmail attempts and the misuse of customer data.
Nurdan Eren, Business Unit Manager for IT Security at MVI SOLVE-IT, confirms: “Yes, more and more companies are using cloud technologies and thus outsourcing the technical management of user data. If we relate this to IT security requirements, then the topic of IAM, Identity Access Management, is changing in particular.”
Legacy versus cloud technology
In the past, legacy systems were usually operated in-house, with technical security functions being managed and programmed by department managers themselves. This led to a lack of flexibility when it came to making necessary adjustments. In contrast, cloud providers already offer more functionality in the area of security, even if users become dependent on their IT security at the same time. Nevertheless, security monitoring in the cloud is easier compared to legacy systems. Encryption methods and monitoring tools are already among the standard functions in the cloud. “For many clients and IT departments, this means that they can integrate IT security into their systems in a much more modern and convenient way. However, with both legacy and cloud, care must be taken to ensure that all the necessary encryption is in place during data transfer,” explains Nurdan Eren.
Challenges of cloud systems for IT security
There are various special features that need to be taken into account when implementing cloud systems. This includes, for example, the need to set up VPCs (virtual private clouds) and configure them accordingly, which was not an issue with legacy systems. Key management is also essential to ensure that sensitive data is not passed on to cloud providers. There are also country-specific IT security requirements that cloud systems have to fulfil and external key management has to be integrated into the cloud structure for third-party integration, for example with external service providers.
MVI SOLVE-IT protects a local OEM’s business-critical systems
MVI SOLVE-IT is already implementing these technical requirements for a large number of systems at the client’s premises. These include customer and purchasing systems, systems with design data for the latest models, geodata (navigation systems with VIN numbers), customs systems with interfaces to authorities and production systems – all business-critical systems that need to be protected. “Basically, you can say that from an IT security perspective, the cloud is just as secure as legacy solutions. But you have to configure the cloud correctly to make it really secure. However, if you, like our developers and IT consultants, are very experienced in planning and implementing cloud architectures, then cloud solutions are a more convenient and suitable way to get security into your systems,” says Nurdan Eren.
MVI SOLVE-IT specialises in analysing the protection requirements of companies and offers comprehensive consulting and auditing services as well as threat modelling. Complete system audits are carried out at the customer’s premises as part of integration, migration and compliance projects as well as new software developments.
“Our expertise also extends to security incident and event management (SIEM), where we implement holistic solutions to monitor a company’s security,” adds Eren. At the same time, potential IT risks are identified, assessed, managed and monitored. The aim of IT risk management is to protect IT resources and minimise the security risk. The IT security expert confirms that “in more than 90 per cent of IT security projects, the testing of cloud systems is already an integral part of our services.”
The switch to the cloud is unavoidable as the legacy systems are gradually being switched off. Although cloud solutions offer many advantages, the beginning requires a major project effort together with the customer in order to precisely define and then implement the security requirements for the cloud.” IT security is a crucial aspect nowadays – and increasingly so in the context of the cloud.
