Advances in cloud computing have revolutionised the ways in which businesses can operate. From data gathering and storage to interconnected, convenient working to fast scalability, they offer huge advantages that streamline processes, support flexible and sustainable growth, improve customer experiences, and boost competitiveness – among many others.

However, with more and more organisations relying on cloud-based technologies to conduct business – an estimated 94% of enterprises use a cloud service – it’s imperative that leaders invest in securing their systems against cyberattacks and other threats.

With cybercrime rates growing in tandem with widespread cloud adoption – tech giant Microsoft reportedly detects 1.5 million attempts a day to compromise its systems – companies are on the look-out for talented computer science and cybersecurity specialists who can help safeguard their assets.

What are the main security risks of cloud computing?

As well as being expensive, disruptive to business operations and damaging to brand reputation, cloud hacks can result in compromised confidential data, data loss and regulatory compliance failure. 

Whether it’s a public cloud, private cloud, multi-cloud or any other type, understanding the risks and security threats associated with cloud applications as a whole is critical. After all, an awareness of common risks ahead of time will help digital teams to better prepare for any eventuality.

Here are some of the most common security risks associated with cloud-based operations:

• Unmanaged attack surface. The move to the cloud and an increase in remote work have fragmented attack surfaces, making it easy for attackers to find unmanaged assets with critical exposures. Each new workload that connects with these public networks presents a new, unmanaged attack surface.
• Data breach. Data is the primary target of most cyberattacks – for example, internal documents that could sabotage a company’s stock price or cause reputational damage, and personally identifiable information (PII) and personal health information (PHI) which can lead to identity theft. Data breaches involve sensitive information being taken or compromised without the knowledge or permission of the owner.
• Misconfiguration. Cloud service providers (CSP) – such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud and IBM Cloud are numerous and diverse, with many organisations choosing to use more than one. This can bring with it a degree of risk, as different default configurations and implementations can lead to critical system vulnerabilities – which cybercriminals and hackers will exploit.
• Human error. Human error can present a huge risk when building any business application, and ever more so in relation to hosting cloud resources. In fact, Gartner estimates that by 2025, 99% of all cloud security failures will result from some degree of human error. For example, users may use unknown or unmanaged application programming interfaces (insecure APIs), inadvertently creating holes in cloud perimeters and leaving networks and sensitive data resources open to attack.

There are, of course, any number of other security risks and cloud security threats: denial-of-service (DoS) attacks, malware, phishing, data leakage, cloud vendor security risk, unauthorised access, insider threats, limited visibility of network systems and many more.

How can cloud security issues be managed?

While risk cannot be completely eliminated, it can certainly be managed.

As well as choosing a cloud service provider wisely, the following risk management and risk assessment strategies will help reduce the risks associated with using cloud environments:

• Cloud penetration testing. Proactive testing is an effective method to assess the cloud’s current security measures by attempting to exploit vulnerabilities. It may also indicate areas for improvement ahead of a real attack, such as reinforcing a firewall or boosting other security software.
• Data security audit. How often are routine security audits conducted? Complete transparency regarding cloud security measures – including how effective they are at protecting personal data and files and how they are implemented – is key.
• Contingency planning. Is a business continuity plan in place that details a strategy for protecting cloud data and systems in the event of an emergency – and how often is it tested? Are there regular backups of cloud storage? Emergencies will vary but should include events such as natural disasters and catastrophic cyberattacks.
• Security training. Can your CSP provide training to help upskill staff and protect against potential security risks? Team members who understand how their employer’s cloud storage and data management system works – and what the best practices are, such as enabling two-factor authentication and limiting access controls – will be better prepared to avoid attacks on their personal data, information and files.

Organisations should not be scared of using cloud software, but they should understand the risk and ensure the right risk management strategies are in place. From this strong position, they can maximise the benefits of transformational cloud technologies and use them to drive the business towards its goals.

Where can I learn more about good cloud security?

IT and cybersecurity professionals can find out more about how to implement robust cloud security from three key international frameworks.

The International Organization for Standardization (ISO) provides checklists that can help with establishing new cloud systems and cloud infrastructure.he National Institute of Standards and Technology (NIST) presents new system frameworks and supports troubleshooting of specific problems. Cloud Security Alliance (CSA) offers operational standards and resources for auditing and vetting systems.

Stay ahead of the latest security measures and developments to protect against cybercrime

Want to learn to develop and implement effective security controls to help organisations protect their assets and remain compliant?

Gain key understanding of computational thinking – and develop specialist understanding of cybersecurity challenges and solutions – with the University of York’s online MSc Computer Science with Cyber Security programme.

If you’re ready to switch to a career in the computer science and cybersecurity sector and develop skills and expertise applicable to almost any industry, our flexible course is the ideal choice for you. You’ll become adept at problem solving and addressing critical, real-world scenarios as you advance your knowledge of software, hardware, artificial intelligence, digital infrastructure, network systems, data science and data security.

The Internet of Things (IoT) refers to ‘the concept of connecting any device that has an on/off switch to the Internet and other connected devices’. This huge wireless network of internet-connected devices and people enables data collection and sharing on a vast, global scale, encompassing both how electronic devices are used and how users interact with environments. The IoT includes smart devices – the common, physical objects connected within the IoT ecosystem via Wi-Fi or Bluetooth – such as smart watches, smartphones, smart vehicles and smart home appliances.

However, while IoT provides convenience and accessibility on a colossal scale, it also brings with it a great number of risks. Without sufficient protection, IoT devices that are allowed to connect to the internet can be susceptible to various critical vulnerabilities and exploitations – a fact businesses and service providers must be aware of if they are to protect against security risks.

What is IoT security and why is it important?

The ever-expanding number of pathways between IoT systems and devices creates a greater capacity for ‘threat actors’, such as cybercriminals and hackers, to intercept and interfere with digital technologies. Cyberattacks are a matter of national and international security, as businesses and individuals who fall victim to cybercrime risk having their identities, money, data or other properties stolen.

Issues of cybersecurity and cybercrime continue to pose critical threats to organisations and individuals across the world, as recent statistics illustrate.

• The average cost of a single ransomware attack is $1.85 million – and cybercrime will cost companies worldwide an estimated $10.5 trillion by 2025.
• The rate of detection or prosecution of cybercriminals is as low as 0.05%.
• 43% of cyber attacks are aimed at small businesses, but only 14% are sufficiently prepared to defend themselves.

Such attacks have the potential to disrupt usual business operations, cause damage to important assets and infrastructure, lead to extortion, and demand a huge amount of budget and resources to remedy – resources many businesses simply do not have.

IoT security, therefore, refers to the broad range of strategies, protocols, techniques and actions used to mitigate the increasing risk of threats all modern businesses face. It aims to secure IoT devices and connected networks and operating systems from threats and breaches by protecting, identifying and monitoring risks across all attack surfaces, as well as assisting to resolve security weaknesses.

What are the main security issues facing IoT systems?

According to the National Crime Agency, the most common attack types include: hacking, phishing, malicious software and distributed denial of service (DDoS) attacks. Security threats are as numerous as they are creative, and their exact nature can vary across industries and the types of device, use cases and systems under threat. For example, the healthcare sector relies on IoT devices that feature some of the highest share of security issues, such as medical imaging systems, patient monitoring systems, and medical device gateways. Other key contenders across other industries include energy management devices, IP phones, consumer electronics, printers and security cameras.

The most common IoT security threats can be divided into three main categories.

1. Exploits, accounting for 41% of threats: examples include network scans, remote code executions, command injections, buffer overflows, SQL injections and zero-days.
2. Malware, accounting for 33% of threats: examples include worms, ransomware, backdoor trojans and botnets (such as Mirai).
3. User practice, accounting for 26% of threats: examples include password vulnerabilities, phishing and cryptojacking.

In practice, these threats are often due to:

• weak, guessable or hardcoded passwords
• insecure network services
• insecure ecosystem interfaces
• lack of secure update mechanisms
• use of insecure or outdated components
• insufficient privacy protection
• insecure data transfer and storage
• lack of device management
• insecure default passwords and settings
• lack of physical hardening.

Fortunately, there are a whole host of real-time security measures organisations can adopt and implement to protect their network-connected systems, assets and workforces.

What are the most important IoT security solutions?

IoT security is often described as ‘the backbone of the internet’. Threats, challenges and IoT attacks are real and require the immediate attention of all businesses. IoT system vulnerabilities and threats keep mutating – so our security solutions must do the same.

If effective and lasting solutions to security threats are to be developed and implemented, organisations must take into account the entire IoT security lifecycle: understand IoT assets, assess IoT risks, apply risk reduction policies, prevent known threats, and detect and respond to unknown threats.

With this knowledge and insight in place, cybersecurity professionals can begin rolling out IoT security best practices including:

• tracking and managing all devices
• conducting patching and remediation efforts
• updating passwords and credentials
• using up-to-date encryption protocols
• conducting penetration testing and evaluation
• understanding the endpoints
• ensuring segmentation of networks
• enabling multi-factor authentication.

These are just some of the many methods that can reinforce IoT device security. Using specialist software and tools, such as Microsoft Defender for IoT, is another option organisations can also invest in for more comprehensive coverage.

Gain the skills to protect against cyberattacks and enforce network security

Develop key computational thinking skills – and learn how to safeguard systems against cyber security challenges, threats and techniques – with the University of York’s online MSc Computer Science with Cyber Security programme.

Designed for individuals who don’t have a computing or IT background, our 100% online, flexible course equips you with the knowledge, skills and understanding to move into a career in the computer science sector. You’ll develop a keen theoretical and practical understanding of programming techniques, computer and network infrastructure, security risks and security engineering, and explore cyber concepts such as cryptography, cloud security, memory and resource management, password protection and DoS. Every aspect of your learning will have critical, real-world application, and you’ll be supported by experts in the field throughout your online studies.

Choose from modules including security engineering, advanced programming, cyber security threats, artificial intelligence and machine learning, algorithms and data structures, and much more.

Network security is the term used for the collection of policies, practices, and technologies that are used to protect computer networks – and the data they transmit – from unauthorised access, misuse or disruption.

Network security works to secure both the physical and virtual components of a network – including routers, servers, gateways, wireless networks, and other devices connected to the network infrastructure – from threats and breaches.

In an interconnected world where information flows seamlessly between devices and networks, network security has become a fundamental tool for protecting against cyber threats.

Why is network security important?

Network security is one of the most effective tools available in the fight against hackers and other cybercriminals. And, with technology central to most of our daily activity, network security is now a critical consideration in all digital development. Network security works to:

• Protect sensitive data. Network security safeguards sensitive information such as financial data, personal records or intellectual property from unauthorised access and disclosure, ensuring privacy and confidentiality.
• Mitigate financial loss. Effective network security measures help prevent financial losses – including penalties and fines – resulting from data breaches. These measures can also prevent the financial losses that arise from disruptions to business activities, operations, or services.
• Preserve organisational reputation and trust. A breach in network security can severely damage an organisation’s reputation, eroding trust among customers and stakeholders.
• Ensure regulatory compliance. Many industries have specific regulations regarding data protection and security. Implementing network security measures helps organisations comply with these regulations and avoid legal consequences.
• Maintain business continuity. Network security measures such as backups and disaster recovery plans can ensure the continuity of operations and minimise downtime in the face of security incidents.

Common threats to network security

Network security systems may face a range of threats and cyber attacks that aim to exploit vulnerabilities, gain access to networks and data or disrupt network operations.

Understanding these threats is the first step towards implementing effective network security measures.

Common threats include:

• Phishing. Phishing attacks trick users into revealing sensitive information such as login credentials or financial details by posing as legitimate entities via email or deceptive websites.
• Denial of Service (DoS) and Distributed Denial of Service (DDoS). DoS and DDoS attacks overwhelm network resources, rendering services inaccessible and causing widespread disruption. These are targeted attacks that flood a system with traffic in an effort to crash it and make it inaccessible to legitimate users.
• Malware. Malicious software including viruses, worms, and ransomware, can infiltrate systems and compromise network security, leading to data breaches and system damage.
• Unauthorised access. Hackers can exploit weak access controls or vulnerabilities to gain unauthorised entry into networks, potentially compromising sensitive data or launching further attacks.

Common network security measures

There are many types of network security measures, and network security systems will typically employ a variety of them to fortify defenses and mitigate potential risks. 

• Firewalls. Firewalls act as gatekeepers within a network. They monitor and filter incoming and outgoing network traffic based on predefined security rules, prevent unauthorised access to the network and protect it against potential threats.
• Intrusion detection systems (IDS). Intrusion detection systems alert organisations when suspicious activity is detected within a network.
• Intrusion prevention systems (IPS). Intrusion prevention systems work to block malicious activity.
• Virtual private networks (VPNs). VPNs establish secure, encrypted connections over public networks, ensuring confidentiality and privacy for remote access and communication.
• Antivirus and anti-malware software. These tools detect, prevent, and remove malicious software such as viruses, Trojans, spyware, ransomware and other threats to network security.
• Data loss prevention (DLP) tools. DLP solutions monitor and control sensitive information. In doing so, they can prevent unauthorised disclosure, ensure regulatory or legal compliance, and minimise data breach incidents. 

• Network access controls. Network access is an important area of network security. It encourages strong authentication mechanisms such as passwords, multi-factor authentication or biometrics to verify an authorised user’s identity and grant appropriate access privileges within the network.
• Security policies. Comprehensive security policies outline important areas of internal network security such as guidelines for acceptable use, data handling, email security, password management and security awareness training for employees.
• Network segmentation. Network segmentation divides networks into isolated segments. Doing so limits the potential impact of a security breach because it prevents unauthorised movement within the wider network.
• Endpoint security. Endpoint security ensures that network endpoints such as computers, laptops and mobile devices have up-to-date antivirus software, regular patches and secure configurations.
• Application security. Application security works to safeguard individual organisational apps for providers.
• Encryption. Encryption protects sensitive data from unauthorised interception and maintains its confidentiality during transit and storage.
• Behavioural analytics. Behavioural analytics are a proactive network security measure. They assess network traffic and user behaviour to detect anomalies and potential security threats, ensuring that issues are identified and addressed as soon as possible. 

The future of network security

As cyber threats continue to evolve, so too must the technologies, processes and network security solutions that network administrators use to address them. This includes:

• Regularly updating security controls.
• Staying informed about emerging vulnerabilities and best practices.
• Harnessing new technologies, such as artificial intelligence-powered security information and event management (SIEM), as they become available.

Network security must continue to advance in line with new and emerging cyber security threats. This means keeping up with and using the latest technologies such as those in artificial intelligence, machine learning, deep learning and automation, so those responsible for information systems are well prepared to manage threats of the future.

Keep networks secure with a career in computer science

Break into the cyber security sector with the 100% online MSc Computer Science with Cyber Security from the University of York. This flexible Masters degree is aimed at working professionals and graduates from other disciplines who want to build a career in computer science and develop expertise in cyber security.

Explore programming techniques, computer and network infrastructure and protocols, security risks, and security engineering alongside a range of cyber concepts and solutions. You will also develop an understanding of typical cyber threats and a range of technologies that can help to reduce risk, increase protection, and remain compliant.

Mobile security is the term used for the various measures that protect mobile devices – such as smartphones and tablets, as well as their data and their associated networks – from unauthorised access or other forms of cyberattack.

Mobile device security measures safeguard any sensitive data stored on or transmitted by mobile devices, and have become crucial now that smartphones have become such an integral part of people’s daily lives.

Why is mobile security important?

Smartphones are everywhere, and have become essential for navigating the modern world. Whether it’s completing an online banking transaction or scanning a QR code to order at a restaurant, people are on their phones all the time – and that’s not even factoring in all of the personal and professional communication that happens on mobile devices, from emails and text messages, to social media apps.

It’s clear today’s phones have evolved beyond mere communication devices and are now repositories of personal, financial and professional information. The implications of mobile data breaches can be severe, including identity theft, data loss, loss of device functionality and financial loss. But by prioritising mobile security, individuals and organisations can mitigate these risks and maintain control over their digital lives.

Common threats to mobile security

There are a number of common risks to mobile security, and these can apply to any mobile device regardless of make or model:

• Malware. Malicious software, commonly referred to as malware, poses a significant threat to mobile security. It can infiltrate devices through compromised apps, infected websites, or malicious links, allowing cybercriminals to gain access to sensitive data or even grant criminals control over the device.
• Phishing attacks. Phishing is a technique used by cybercriminals to deceive people into revealing sensitive information such as passwords or credit card details. They often do this by disguising themselves as legitimate organisations in emails, SMS text messages, or on fake websites.
• Public Wi-Fi networks. While convenient, public networks can be insecure and prone to digital eavesdropping. Hackers can intercept data transmitted over these networks, potentially gaining access to usernames, passwords and other confidential information.

There are also threats and scams that are more likely to target particular devices, such as Android or Apple devices.

Common threats to mobile security on Android devices

Android is the most-used operating system across mobile devices worldwide. It’s also a very open system – virtually anyone can create an app for Android, and it’s relatively straightforward to add an app to the Google Play Store. Because of this, Android devices are more susceptible to malicious mobile apps, which can contain hidden malware or gather sensitive data with a user’s knowledge or permission.

Android’s popularity also makes it a lucrative target for cybercriminals who want to exploit vulnerabilities in the operating system to bypass security measures and gain access to private data or control over a device.

Common threats to mobile security on Apple devices

Apple devices are locked down, which means that they’re less open to customisation when compared to products offered by Android, but it also means they’re better protected against cyber threats. Although Apple’s App Store has stringent security measures in place however, malicious apps occasionally manage to slip through. These apps may contain malware or engage in unauthorised data collection.

Another risk is known as jailbreaking. Jailbreaking an iPhone or iPad is often intentionally done by the owner of an Apple product in order to gain access to the device’s operating system and customise its interface or install software that’s unsupported or unavailable through Apple:

“Apple’s ‘walled garden’ approach to its software has always been in contrast to the variety of options provided by the Android OS for customization,” say cybersecurity experts Kaspersky. “A key motivation of many jailbreakers is to make iOS more like Android.”

Doing so, however, can make Apple’s security features more vulnerable and expose the device to security threats.

Common mobile security measures

While there are many threats to mobile security, there are also many safeguards that can protect mobile devices. These include:

• Security software. There are a variety of antivirus programmes and platforms that can be installed to protect devices and personal data. These programmes typically target a host of common threats such as ransomware and spyware. Most devices also typically have their own built-in security systems that are developed by their providers, such as Microsoft orApple.
• Authentication and encryption. Strong authentication mechanisms such as PINs, passwords, biometrics, or two-factor authentication add an extra layer of security to mobile devices. Encryption, meanwhile, ensures that data stored on devices or transmitted between devices over networks remains secure and unreadable to unauthorised parties while in transit.
• Mobile device management (MDM) systems. Organisations can implement MDM solutions to manage and secure corporate-owned mobile devices. MDM enables IT or cybersecurity professionals to enforce security policies, remotely wipe data and control access to sensitive resources. These systems are typically seen as safer than what’s known as bring your own device (BYOD), which allows people to use their own devices for work. BYOD makes things like endpoint security, email security, and application security more difficult for organisations and can potentially expose them to increased risk.
• Virtual private networks (VPNs). Using VPNs on mobile devices can be effective protection against unauthorised access to the device and its data. This is because VPNs effectively encrypt the connection between the device and the internet.

The future of mobile security

As technology continues to evolve, so do the threats to mobile security. This is why it’s important that individuals and organisations aim to stay one step ahead of cybercriminals, and that mobile security solutions continue to evolve and develop as well.

Ongoing areas of advancement include:

• Biometric security. Biometric methods of authentication such as facial recognition and fingerprint scanning are already becoming commonplace. They typically offer more secure access to mobile devices because they don’t rely on passwords or PINs that can be shared or stolen.
• Improved app security. App developers and stores continue to strengthen security measures to prevent the distribution of malicious apps and protect their users’ personal information.
• Cloud security integration. Mobile devices are increasingly relying on cloud services, a trend that necessitates the robust integration of mobile and cloud security measures to collectively safeguard any data stored and accessed from the cloud.
• Artificial intelligence and machine learning. These technologies are expected to play a crucial role in detecting and mitigating mobile security threats by analysing patterns, identifying anomalies and proactively defending against attacks.

Build secure mobile networks with a career in cybersecurity

Develop skills in computational thinking alongside an academic understanding of cyber security threats and techniques with the 100% online MSc Computer Science with Cyber Security from the University of York. This flexible Masters degree is aimed at working professionals and graduates from other disciplines who want to build a career in computer science and cyber security.

You will develop an understanding of typical cyber threats and a range of technologies that can help to reduce risk, increase protection and remain compliant. You’ll also explore computer and mobile networks, with discussions around networks and the internet, network architecture, communication protocols and their design principles, wireless and mobile networks, network security issues, networking standards, and related social, privacy, and copyright issues.