Cybercriminals know and exploit the rift between CSPs and enterprises, so the model needs a comprehensive ecosystem approach.

Cybersecurity is topmost in business leaders minds the world over (‘Leading in the digital-first world’ Report), more so in the new paradigm we are in today. With cybercrime expected to cost $10.5 trillion annually by 2025, the criticality of securing data is at a totally new level of magnitude.

While cloud-based digital transformation is revolutionizing the digital economy, the sudden shift to remote-working has put these benefits into sharp scrutiny. The need to fortify businesses has become that much more critical.

The business burden of the shared responsibility model

For most of the history of the cloud, enterprises have worked under the ‘shared responsibility’ model for cloud security with clearly defined security responsibilities for cloud service providers (CSPs) and businesses engaging their services: while CSPs take a large share of cloud security responsibility, more aspects are under the purview of businesses.

CSPs are in charge of securing the backbone to protect the hardware, software, networking, and data center facilities. The individual businesses need to take care of all other security mandates including protecting endpoints, network traffic, access, applications, procuring security controls, monitoring security incidents, and complying to regulations. This very often leads to enhancing expertise levels as well as adding resource costs that become an impediment for many enterprises.

With a growing list of increasingly complex security tasks, and a shortage of cybersecurity talent availability in the market, enterprises are that much more challenged.

Furthermore, with hybrid working looking to soon replace traditional working models for many, this legacy ‘shared cloud responsibility’ has to evolve to mitigate the risk of cyber threats and the drain on resources that can lead to attacks.

Cybercriminals have long been aware of the responsibility division between CSPs and enterprises, its lacunae and challenges. As a result, they consciously attack infrastructure that is under the businesses’ purview. Hence, businesses must move quick to win the security race to protect themselves. A transformation of the two-party approach of the traditional shared responsibility model helps achieve this.

An evolved shared cloud security responsibility

Transforming the security ecosystem at scale and speed is imperative and this is coming with the evolution of the Managed Security Service Providers’ (MSSP) role. These MSSPs:

• Act as third-party service providers between enterprises and their CSPs to provide strategic direction and support and, effectively oversee various cloud challenges such as end-to-end security, cyber threats, compliance, scalability and skills gap, to name a few.
• Support enterprises at every step of their cloud journey from initial assessment and migration, through to day-to-day management including monitoring and governance.
• Serve as advocates for enterprises, ensuring cloud strategies are aligned with each business’ priorities and pace along their digital transformation journey. They are constantly monitoring and testing an enterprise’s defenses and shields for a better understanding of probable and possible threat types, in order to prepare risk mitigation strategies and ensure cyber threat protection.

A shared cloud security model helps enterprises ease the burden of managing in-house cloud security talent and skillsets while availing the best guardrails. For instance, MSSPs can be enlisted to take over the rapid scaling up or down of services – a task that has several complicated challenges such as misconfigurations and inconsistent policy enforcements.

This allows enterprises to focus on its core business – employees, customers and the future of their enterprise – with peace of mind and agility.

An ecosystem approach for greater agility

As enterprises scale their businesses, so too will the volume and complexity of operations increase. This makes continuous and consistent evaluation of cloud infrastructure security a critical need. To achieve this, MSSPs leverage an ecosystem of cloud-native and third-party applications to provide constant and comprehensive security.

The evolved model explained herein is a Comprehensive Responsibility Model that highlights a mindset shift to cloud security and outlines the many areas MSSPs bring expertise to support businesses. These include governance, risk mitigation, compliance, procurement and implementation of comprehensive security.

With these security responsibilities no longer weighing businesses down, a whole new realm of possibilities is opened up for enterprises: they can focus on innovation; deliver better and more secure customer services and capabilities; optimize cost; and reduce worker efforts, to name just a few benefits.

In the landscape of the ‘cloud security shared responsibility’ there will be enterprises attempting to achieve digital transformation by investing large amounts of time and resources to combat increasing cyber threats and manage vital responsivity toll. And there will be the enterprises supported by a modified, comprehensive responsibility model where MSSPs help to ease the pressure to divert resources towards cloud challenges but instead be empowered to focus on employee/user experiences, innovation and business agility.

As we craft the new world, an evolved shared security responsibility is the answer for enterprises to drive collective success of the cybersecurity ecosystem for a better and safer future.