2024 in cloud security: learnings, developments and predictions

Simon Edward • 4 November 2024

What did 2024 mean for cyber security? Explore key learnings, developments and predictions in our roundup.

These days, cyber security is tougher than ever, right? Right. This is no reason, however, for businesses to rest on their laurels.

You see, the unprecedented strength of cyber security available to businesses of all sizes as we move into 2025 can sometimes lead to complacency.

Businesses will tell you, for instance, that they've outsourced security to their cloud providers. But the prevalent model of "shared responsibility" isn't the same as outsourcing. It means that the risk is shared, not transferred.

The plain fact of the matter is that cybercriminals are always looking for new and nefarious ways to compromise IT systems and steal data. The fact you're now on the cloud doesn't mean you're automatically more secure.

This is borne out by the UK government's Cyber Security Breaches Survey 2024. Among much else, this report revealed the following:

"Half of businesses (50%) and around a third of charities (32%) report having experienced some form of cyber security breach or attack in the last 12 months. This is much higher for medium businesses (70%), large businesses (74%) and high-income charities with £500,000 or more in annual income (66%)."

These figures are far from small fry. It's no wonder the government describes cyber security breaches as a "common threat".

So, what can be done about it? To answer that question, we need to look at what the cyber security world has learnt recently, along with developments in cyber security and predictions for the near future.

Learnings

The UK government report found that most businesses and charities in the UK have a wide range of "cyber hygiene" measures in place. These include such security essentials as up-to-date malware protection, cloud backups, network firewalls, admin rights restrictions and password management.

Smaller businesses, however, tend to overlook these measures. They perhaps feel the data they hold isn't substantial enough to attract a hacker. Either way, a data breach can lead to a fine under GDPR as well as unwanted reputational damage.

Picture of Man looking stressed at a laptop.

These findings relate to precautions businesses are taking. But what about the aftermath of a cyber attack? It seems this is an area where many businesses have room for improvement.

"While a large majority of organisations say that they will take several actions following a cyber incident," the report says, "in reality, a minority have agreed processes already in place to support this." As with cyber hygiene, the effectiveness of these processes goes up the bigger the company is.

Businesses of all sizes, however, fall behind on external reporting. Just around a third of businesses and charities report breaches to an outside body – and this body tends to be either external cyber security or IT provider.

This is something for businesses to consider going forward – especially as more and more organisations shift to hybrid or multi-cloud environments.

On top of these concerns, businesses need to be aware of changing risks. This could be achieved through internal upskilling, getting a cloud security consultant on board or a combination of the two.

Developments

Perhaps the most pressing and widespread development in the world of cloud security is the large-scale shift to complex hybrid and multi-cloud environments.

Cyber security has a tendency to get complicated, fast. But on this topic, it's easy to see why complex cloud environments present more complex security challenges. The more clouds you use, the more you need to secure.

Once upon a time, security was a case of erecting a digital perimeter to keep out unwanted traffic. In today's decentralised world, the perimeter looks more like a mad scribble. This is why businesses need to embrace zero-trust principles and micro-segmentation if they haven't already.

Another development affecting businesses is the rise of serverless computing. This lets businesses run applications and services but not the underlying server infrastructure. The cloud service provider takes over administrative roles such as scaling. This introduces novel security challenges, no matter how big or small the business in question.

Then there's the question of visibility. Businesses now hold huge amounts of data, often in multiple cloud environments. It can be hard for IT to get a good look at everything. It's not hard to see why this presents security threats – after all, you can't protect what you can't see.

The problem of visibility is related to two areas where sprawl is an increasing problem: data management and tool management.

It's hard to overstate the sheer volume of data that businesses deal with these days. It can be invaluable in driving decision-making. However, traditional security tools just don't cut it anymore. Innovation and forward thinking are the orders of the day.

The same goes for tools. There's even a name for the proliferation of tools: "tool sprawl". Too often, IT infrastructure resembles an untidy desk, with tools scattered here and there. The difference is that the proliferation of virtual tools can lead to administrative silos, decreasing visibility and weakening a business's security posture.

None of these problems is insurmountable. But they all require a robust security posture and a willingness to invest, experiment and adapt.

Predictions

So that's what the cyber security landscape looks like in 2024. But what's next?

First of all, we predict that serverless computing will become inseparable from cloud strategy. Done well, this will speed up time to market and unlock developmental potential.

Secondly, it seems almost inevitable that AI will become increasingly integrated into cloud security – in particular, the use of large language models (LLMs) for troubleshooting and online assistance.

AI, however, will bring its own challenges. AI tools can help businesses automate threat detection and response. But cybercriminals are using those same tools to make their malware more effective. We've seen this already in AI-generated phishing emails that conventional filters can't catch.

Whatever happens, the next few years will be an interesting time for cloud security. We'll be taking notes and letting you know of any important developments.

Are you looking for help with your cloud security strategy? At Ascend Cloud Solutions, we help organisations of all sizes improve their security posture and stay safe in the cloud. Get in touch today for a free, no-obligation consultation.

< Older Post

Newer Post >