Cloud Security Officer:

The Up and Coming Cybersecurity Career

Why Career Opportunities in Cybersecurity are Growing

Today more and more companies are ditching their huge, dedicated server rooms and physical hard drive storage, for the more space saving, and cost-effective cloud based virtual networks and storage solutions. This has helped many companies reclaim space and provide flexibility and even save money, but cloud-based solutions have their own security challenges.

The average cost of a cloud -based data breach is 3.92 million.

Data Breaches

Data breaches are one of the most common security challenges for companies using cloud-based networks and storage solutions. The average cost of a data breach is $3.92 million (https://www.securit.biz/securit-news). According to the Cloud Security Alliance (CSA), data breaches are the top challenge in any cloud-based system. There have been several data breaches attributed to the cloud over the recent years. One is particular is 2019’s Capital One’s cloud attack in which a breach started between March 22^nd-March 23^rd and wasn’t discovered until almost 4 months later (July 2019). Credit card numbers, birth dates, addresses, names, phone numbers, transaction histories, 140,000 Social Security numbers and 80,000 bank account numbers. Capital One pointed out that it used standard data encryption, but the attacker managed to decrypt the information. A data breach could bring a company to its knees, causing financial issues, damage to its reputation and possibly legal consequences from the breach.

Misconfiguration and Inadequate Change Control

Misconfigurations, which include granting excessive permissions or persons who don’t change their default credentials can occur when computing assets and access are set up incorrectly. Misconfiguration of cloud resources is a leading cause of cloud security challenges and can result in deleted or modified resources and service interruptions. Because of the fluid nature of cloud-based computing, inadequate change control can cause cloud misconfigurations, and insecure storage issues.

Misconfiguration of cloud resources is a leading cause of cloud security challenges and can result in deleted or modified resources and service interruptions.

Lack of Security Architecture and Strategy

Over the last few years, organizations have jumped into using a cloud-based system without a sufficient security architecture and strategy in place. Before organizations take the leap to the cloud, they need to inform their customers and employees what threats they may be exposed to, how to properly use the cloud security and the in and outs of adapting to a cloud-based system.

Insufficient Identity, Credential, Access, and Key Management

A large amount of cloud security threats and cybersecurity threats in general are a result of identity and access management issues. This usually happens because there is improper credential protection, lack of automated password rotation, weak or multi-used passwords and the absence of a multifactor authentication. This has been multiplied by using cloud-based systems and the excessive admin accounts that a company has. Users will sometimes bypass identity controls, which can cause a vulnerability within the system.

Cloud Account Hijacking

Cloud account hijacking is the disclosure, accidental leakage, exposure, or other compromise of a cloud account that is critical to the operation, administration, or maintenance of a cloud environment. These highly privileged and sensitive accounts, if breached, can cause massive consequences.( https://searchcloudsecurity.techtarget.com/). Phishing scams are a major part of this issue. Attacks can send emails to employees or even customers with legit company logos and markings. Once open, they can have access to the entire system, which they are able to cause service disruptions and gain access to personal account information. One major example of a phishing attack is Sony Pictures. Just before the Thanksgiving holiday in 2014, attackers sent a series of “spear phishing” emails to Sony employees. “Spear phishing” emails are usually targeted at those employees who have significant or even root access to Sony’s network. The attackers researched employee names and titles on LinkedIn, they then posed as company colleagues, and sent malicious emails containing malware to the unsuspecting employees. In the end, more than 100 terabytes of company data were stolen, including newly released films, financial records, and customer data. All told, this phishing attack cost Sony more than $100 million. https://www.computerworld.com/article/2913805/sony-hackers-targeted-employees-with-fake-apple-id-emails.html

These security challenges are just a few that companies face when they move to a cloud-based system. Others can include insider threats, abusing the use of cloud services, limited cloud usage visibility and insecure interfaces.

Certified Cloud Security Officer is Born

Due to all these challenges, companies have started to employ a Certified Cloud Security Officer (CSSO). The CSSO, sometimes referred to as a Certified Cloud Security Professional (CCSP), is one of the more advance cloud security certifications in the information security atmosphere. The CSSO according to Certification Magazine has an average annual salary of $146,970 and is in very high demand, because of the knowledge that a CSSO is required to have.

What does a CCSO Do?

A CCSO understands that a virtual environment must be protected from threats, with efficient security controls to deter, prevent, detect, and correct any intrusions or vulnerability within the cloud-based system. They have the knowledge to plan, implement and report on cloud security controls focusing on “hardening” the environment by using identity management, physical security, privacy, penetration testing, access control, data integrity, and encryption. For example, in order recover or even sometime prevent data breaches, the CSSO will implement proper encryption to protect data, and have a strong well-tested incident response plan in the case of a data breach. CSSO’s also pay special attention to any data that is accessible via the internet and develop and implement a proper security architecture and strategy that is in line with the companies’ goals and objectives. They also will understand how to setup proper multifactor authentication and make sure all employees and customers use strong and revolving passwords to help prevent identity and access management issues. A CCSO has the knowledge to train, establish and adapt a unified company plan when it comes to cloud based security and conducts annual security awareness training for the company.

The Certified Cloud Security Officer is the line of defense against cloud-based security issues. As many companies begin the transformation to a cloud-based virtual network and cloud storage, they open themselves up to cyber-attacks. The CCSO certification from Mile2 covers every aspect of cloud and virtual security:

Cloud Computing and Architecture
Identification and Authentication
Access Control
Security and Models Evaluation
Vulnerability Assessments
Cryptography and Hashing
Network Connections
Network Protocols and Devices
Data Center Operations
Security Architecture and Attacks
Incident Response
Malware and Software Attacks
Application Security

Being a Certified Cloud Security Officer means that you are in high demand and can be a great opportunity when looking to advance your expertise. CCSO is also on the forefront of new technologies, ever evolving best practices and dealing with current and future security threats. Take the next step in your cloud career, with the CCSO certification from Mile2. Mile2.com/cloud-security-officer

Cloud Security Officer:

The Up and Coming Cybersecurity Career

Why Career Opportunities in Cybersecurity are Growing

Data Breaches

Misconfiguration and Inadequate Change Control

Lack of Security Architecture and Strategy

Insufficient Identity, Credential, Access, and Key Management

Cloud Account Hijacking

Certified Cloud Security Officer is Born

What does a CCSO Do?

Please Note: