How Big is the Cloud?

Between 2020 and 2021, uptake in the cloud user base grew exponentially as businesses went virtual in the wake of the pandemic. In 2022, 94% of all enterprises use cloud services, and a business may run an average of 1,000 virtual machines or more at a time in virtualized environments and public clouds. Alongside this, there are thousands of connected devices and multiple Software Design Infrastructure (SDI) components all spread across a global ‘cloud’ footprint. It’s predicted that by 2025, there will be over 100 zettabytes of data stored in the cloud.

That’s the same amount of storage as thirty-one billion two hundred fifty million, 32 GB Smartphones

Due to the rise in cloud usage, applications, objects, and devices, the number and variety of identities that an individual has to keep track of have skyrocketed. A person is no longer a single identity. Almost every person who uses computers or accesses the internet today has some form of a digital identity. This identity can comprise their email address and password combination, their history of Internet browsing, their shopping history and credit card information saved by an online store, or identifying characteristics stored in an identity and access management (IAM) system. A typical person may have upwards of 15 identities distributed across social media accounts, applications, cloud services, and mobile and physical devices.

One of the biggest problems associated with the cloud is that there are too many identities. Instead of just a handful of networks, the cloud has hundreds of thousands of identities with their own individual perimeters. Because there are so many of them, keeping track of and protecting cloud identities is a large-scale, never-ending inventory process where users are continuously added and removed. Moving into the cloud without proper identity management measures only exacerbates on-premises identity problems.

The global usage of the largest cloud storage services can give an idea of how many identities are stored in the cloud. In 2018, Google Drive surpassed one billion users, while in 2020, the Google Workspace cloud platform as a whole reached 2 billion users. The second most popular cloud storage service—Dropbox—has a huge following as well, with over 700 million reported users. If all 3.7 billion people using these cloud services also had a further 15 cloud identities, we could be looking at a minimum of 55.5 billion identities in the cloud—that’s over seven times the global population. Here are the number of user identities for several of the largest cloud services:

• Amazon Web Services (AWS) - Over 1 million active users
• Dropbox - 15.48 million paying users
• Google - 2 billion users
• Microsoft Azure - 715 million users
• iCloud (Apple) - 850 million users

While there are many benefits of cloud computing, as it offers businesses a convenient, scalable, and readily accessible service to its users, there are also risks associated with the cloud: 

• Unauthorized Access: The most common cloud security issues include unauthorized access through improper access controls and the misuse of employee credentials. Over-permissioned users—particularly administrators—and a lack of proper entitlement visibility, management, and governance are contributing factors. Insecure APIs and unauthorized access are perceived as the greatest sources of  security vulnerability in the cloud.

   

• Data Loss or Theft: When you store files and data in someone else's server, you're trusting the provider with your data. However, that doesn’t mean you have relinquished responsibility for your data in the event of loss due to system error or theft by cybercriminals. Cybercriminals can hack into servers or malware can render data unreadable by both humans and software. In many cases, this data cannot be recovered, so data loss prevention is an essential tool. 

   

• Denial of Service Attacks or Distributed Denial of Service: A denial-of-service (DoS or DDoS) attack aims to shut down a machine or network, making it inaccessible to its intended users. This can render systems inaccessible for users and severely disrupt business operations.

As users, we are largely responsible for generating the content and data that create our online identities. As a result, it’s reported that 88% of cloud breaches are due to human error. What can businesses do to help individuals stay safe using the cloud?

1. Establish an Identity Control Plane: Passwords are often the only barrier between a cybercriminal and your sensitive information. There are several programs attackers can use to guess or crack passwords or, even easier, to phish credentials. We recommend users follow NIST guidance on updating passwords, which is generally now once per year or after a known compromise. However, to really help mitigate credential sprawl, organizations should establish a global authentication authority to define access policies and apply SSO to its practical limit.  SSO (and even passwords) should be used with compensating controls such as MFA and risk signals.

    

2. Opt for Multi-factor Authentication (MFA) Verifications: Leverage MFA for logging in wherever possible. If passwords become compromised, enabling this extra layer of security will decrease the likelihood that cybercriminals who have stolen passwords can log into accounts. Furthermore, adding a layer of intelligence via risk signals will help to decrease MFA fatigue.

    

3. Control Privileged Access: Secure and manage administrative consoles and entitlements as well as secrets such as embedded credentials, keys, tokens, certificates, and API keys for human and machine identities.

    

4. File Encryption: Ensure that all important files are encrypted. To read an encrypted file, the user must have access to a secret code to enable decryption. This means no one other than an authorized user can see it—not even the software provider. This extra level of security will make breaches difficult for any potential attacker. 

People are just one part of the cloud. As cloud adoption has accelerated, there has been an explosion of non-people workforce identities. Machine identities—including bots, serverless functions, or infrastructure code—act intelligently and make decisions on behalf of traditional people identities. Due to the boom in digital transformation, there are now far more non-person identities than person identities. Machine identities play an integral role in digital transformations, helping businesses scale their workloads and increase their productivity. However, the upsurge in machine identities brings increased risk, and over 79% of organizations have reported that they have had an identity-related security breach in the past two years. According to the second-annual State of Machine Identity Management Report, 50% of respondents expect that their organizations are likely or very likely to experience machine identity theft or misuse in the next two years.

How to protect machine identities: 

1. Identify all of your identities and continuously inventory them.

2. Identify the effective permission for each and every one of your identities and constantly monitor for changes. 

3. Ensure identity security solutions are in place and configured to manage and govern privileged non-person identities.

Aubrey Turner at Ping Identity comments, “With an estimated 4.2 billion digital twins on the net, we need to be more vigilant when it comes to protecting our online identities. It’s reported that 88% of cloud breaches are due to human error, and by following the steps we’ve detailed above, we can help businesses avoid significant data breaches by cybercriminals. From the predictions, we can expect the future of business to be fully integrated on the cloud, and by being vigilant now, we can be prepared for what's to come.”