In a June 2019 report, telecommunications equipment provider Ericsson predicted that there will be 8.3 billion mobile broadband subscriptions by the end of 2024, which translates to 95 percent of all subscriptions by then. Total mobile data traffic will reach 131 exabytes per month (1 exabyte = 1 billion gigabytes), with 35 percent carried by 5G networks.

While mobile phones will consume the bulk of the data, the sheer number and wide variety of devices that will be connected via 5G technology is likely to pose security threats not faced by previous generations of mobile networks, explains Professor Robert Deng at the SMU School of Information Systems.

“When 5G becomes pervasive, the majority of the devices connected to mobile networks will not be mobile devices anymore,” he says, referring to things such as household appliances, lightbulbs, or indeed something mobile like an autonomous car that is itself filled with smaller IoT devices such as sensors. “Some of them will be as powerful as the mobile device we’re using today, while some will have minimal computational and communication capability.

“Given the variety of IoT devices, given their different capabilities and deployment environments, the security requirement of solutions will be very, very different.”

Solving cybersecurity concerns, in the mobile world and on the cloud

Professor Deng is the Director of the Secure Mobile Centre (SMC), which hosts the National Satellite of Excellence in Mobile Systems Security and Cloud Security (NSoE MSS-CS). As he runs the research initiative aimed at building “a mobile system security and mobile cloud security technology pipeline for smart nation applications”, Professor Deng points out the main questions that need answering when designing security solutions:

What is the application context?
What is the threat model, i.e. who is going to attack you?
What are the risks?
He elaborates: “When the IoT becomes pervasive, the requirements will be very different from those for today’s mobile applications. You have to come up with new security solutions for any particular type of IoT application, [which necessitates] differentiated security services.”

The resource constraint of some IoT devices also poses cybersecurity challenges. A lot of existing security solutions would not work on a surveillance camera mounted on a lamp post, which is much more limited in computational and storage capabilities.

“Given that kind of devices, how do you add in security?” Professor Deng points out. “I have the IoT devices but there’s no user interface. How do I perform user authentication? Those are the new requirements we are going to deal with.”

Bigger devices such as cars and drones also demand attention, Professor Deng says. With the advent of autonomous cars, vehicles need to have the capability to stop themselves in the event of emergencies even if they are infected by malware. Similarly, a drone must be able to execute critical operations such as returning to home base in the event it is hacked.

The other main concern of the NSoE MSS-CS is mobile cloud security, especially when “data records in real time monitoring system may contain sensitive information”.

“As a data owner, I upload my data to the cloud. How do I know that data is still under my control and not under the control of the service provider or my adversaries?” asks Professor Deng, who is also the AXA Chair Professor of Cybersecurity at SMU. That is the reason for cybersecurity experts’ continuing efforts to build stronger encryption capabilities, but which also leads to the difficulty in sharing critical data. He notes:

“My folder is encrypted and I want to share my folder with you, but you must have the decryption key. But how do I pass the key to you? We are designing a solution where I don’t even have to pass the key to you, but it automatically gives you all the permission to access my folder even if it’s encrypted. The other issue is how do you do the computation to process and access the data that is encrypted? Those are the things we do.”

Co-operation

The SMC is one of seven research projects funded by Singapore’s National Research Foundation (NRF) aimed at developing research expertise and capabilities in cybersecurity. While technical challenges in designing solutions are obvious obstacles to the stated aim, Professor Deng highlights structural and ecosystem concerns that should not be overlooked.

“Because most of the Principal Investigators are professors and academics, how do you get in touch with partners who will quiz you?” muses Professor Deng. “You may have an interest in a solution, but that interest may only be a component of the solution. It’s not the whole solution.

“How do you integrate your novel component solution with a larger system so that the larger system can improve? And how do you turn the solution into a product? It’s a challenging process.”

He concludes: “All this requires close collaboration between the university researchers, government agencies and also the industry. These are the practical challenges for technology transformation.”

Why Cloud Security Matters More Than Ever

Cloud storage and cloud computing have become foundational to how modern businesses operate. Organizations rely on the cloud for everything from photo and document storage to payroll processing, SaaS tooling, and cross-team collaboration—all running on shared, remote networks of servers.

That concentration of sensitive data in shared infrastructure makes cloud environments a high-value target for attackers. Research from the RedLock Cloud Security Trends report found that the vast majority of organizations were not doing enough to protect their cloud environments at the time of publication—a finding that remains relevant as cloud footprints continue to expand.

Understanding what attackers are after, how they get in, and what your team can do about it is the first step toward a defensible cloud posture.

The Main Threats to Cloud Data

Data Breaches

The classic threat is a data breach—unauthorized access to data stored in the cloud. This can include personally identifiable information (PII), payment card data, health records, trade secrets, and intellectual property. As security reporter Fahmida Y. Rashid noted in an InfoWorld analysis of cloud security threats, breaches involving health information or IP can be particularly devastating. The severity of the damage ultimately depends on the sensitivity of the exposed data.

Account Hijacking

Once attackers gain a foothold, they may hijack legitimate user or administrator accounts entirely. From that position, they can eavesdrop on activity, manipulate transactions, modify or delete data, or use the compromised account to pivot and launch further attacks against other systems.

A particularly stealthy variant of this is the Advanced Persistent Threat (APT)—a long-running intrusion in which attackers quietly establish a presence inside a system and slowly exfiltrate data over an extended period before being detected.

Payroll and Financial Data Exposure

Many organizations use cloud-based payroll platforms. A successful breach of a payroll service can expose employee Social Security numbers, bank account details, salary information, and tax data—a rich target for identity theft and financial fraud. Payroll data breaches can also carry significant regulatory liability depending on jurisdiction.

How Attackers Get In

Compromised Credentials and Weak Authentication

Stolen or weak credentials remain one of the most common entry points into cloud environments. If an attacker obtains valid login credentials—through phishing, credential stuffing, or purchasing leaked passwords—they can operate as a legitimate user and go undetected for a long time. RedLock researchers found that administrative accounts in a significant percentage of public cloud environments showed signs of potential compromise, underscoring how frequently this vector is exploited.

Flaws in authentication systems themselves—such as misconfigured identity providers, overly permissive IAM roles, or missing multi-factor authentication (MFA)—compound the problem.

Misconfigured Storage and Services

Misconfiguration is one of the leading causes of cloud data exposure. When organizations move workloads to the cloud, shared infrastructure means that memory, databases, and services run in close proximity to those of other tenants. A single misconfigured access control on a storage bucket—such as an Amazon S3 bucket left publicly readable—can expose gigabytes of sensitive data instantly.

The RedLock report found that more than half of organizations using cloud storage services had inadvertently left one or more services exposed due to misconfiguration. This is a preventable class of vulnerability, but it requires rigorous configuration reviews and automated policy enforcement to catch reliably.

Mobile Device Risk

A large proportion of employees access corporate cloud accounts from personal mobile devices. As Priya Viswanathan noted at Lifewire, this introduces a mobile security hazard: the security of any cloud interaction is only as strong as the weakest link in the chain—the device itself, the network connection, and how the user handles their credentials.

Unmanaged personal devices may lack endpoint security controls, run outdated operating systems, connect over untrusted Wi-Fi, or store credentials insecurely—each of which creates an opening for attackers.

How to Reduce Your Cloud Security Risk

No single control eliminates cloud risk, but a layered approach significantly reduces your attack surface. The following practices address the threat categories described above:

• Enforce multi-factor authentication (MFA) on all cloud accounts, especially administrative ones. MFA is the single most effective control against credential-based attacks.
• Apply the principle of least privilege. Users, services, and roles should have only the permissions they actually need. Audit IAM policies regularly and remove unused permissions.
• Audit storage configurations continuously. Use your cloud provider’s native tools (such as AWS Config, Azure Policy, or Google Cloud Security Command Center) or a third-party Cloud Security Posture Management (CSPM) tool to detect and alert on publicly exposed buckets, databases, or services.
• Encrypt data at rest and in transit. Ensure that sensitive data is encrypted using strong, current algorithms, and that encryption keys are managed securely—not stored alongside the data they protect.
• Implement a Mobile Device Management (MDM) policy. For organizations where employees access cloud resources from personal devices, MDM solutions can enforce minimum security baselines—screen locks, OS patching, remote wipe capability—before granting access.
• Monitor for anomalous behavior. Cloud-native logging (AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs) combined with a SIEM or threat detection platform can surface unusual access patterns—such as logins from unexpected locations or bulk data downloads—that may indicate a compromise.
• Patch and update dependencies promptly. Application-level vulnerabilities in code running on cloud infrastructure are a real attack surface. Keep runtimes, libraries, and container base images updated.
• Train employees on phishing awareness. Since credential theft often starts with a phishing email, regular security awareness training reduces the likelihood that an employee will hand over their credentials.

The Bottom Line

Cloud environments offer enormous operational benefits, but they also concentrate sensitive data in ways that attract sophisticated attackers. The threats—data breaches, account hijacking, APTs, misconfigured services, and mobile vulnerabilities—are well understood. What varies between organizations is whether they treat cloud security as an ongoing operational discipline or an afterthought.

The good news is that the most common attack vectors are preventable with consistent application of foundational controls: strong authentication, least-privilege access, continuous configuration auditing, encryption, and security monitoring. Starting with these basics will eliminate the majority of your cloud risk exposure.