Study explores cloud risk and security practices

• Print

Details

Published: Thursday, 28 July 2016 07:36

The Ponemon Institute has published a new study ‘The 2016 Global Cloud Data Security Study.’ Commissioned by Gemalto, the study surveyed more than 3,400 IT and IT security practitioners worldwide to gain a better understanding of key trends in data governance and security practices for cloud-based services.

According to 73 percent of respondents, cloud-based services and platforms are considered important to their organization's operations and 81 percent said they will be more so over the next two years. In fact, 36 percent of respondents said their companies' total IT and data processing needs were met using cloud resources today and that they expected this to increase to 45 percent over the next two years.

Although cloud-based resources are becoming more important to companies' IT operations and business strategies, 54 percent of respondents did not agree that their companies have a proactive approach to managing security and complying with privacy and data protection regulations in cloud environments. This is despite the fact that 65 percent of respondents said their organizations are committed to protecting confidential or sensitive information in the cloud. Furthermore, 56 percent did not agree their organization is careful about sharing sensitive information in the cloud with third parties such as business partners, contractors and vendors.

Key findings

Cloud security and shadow IT

According to respondents, nearly half (49 percent) of cloud services are deployed by departments other than corporate IT, and an average of 47 percent of corporate data stored in cloud environments is not managed or controlled by the IT department. However, confidence in knowing about all cloud computing services in use is increasing. 54 percent of respondents are confident that the IT organization knows all cloud computing applications, platform or infrastructure services in use - a 9 percent increase from 2014.

Conventional security practices do not apply in the cloud

In 2014, 60 percent of respondents felt it was more difficult to protect confidential or sensitive information when using cloud services. This year, 54 percent said the same. Difficulty in controlling or restricting end-user access increased from 48 percent in 2014 to 53 percent of respondents in 2016. The other major challenges that make security difficult include the inability to apply conventional information security in cloud environments (70 percent of respondents) and the inability to directly inspect cloud providers for security compliance (69 percent of respondents).

More customer information is being stored in the cloud and is considered the data most at risk

According to the survey, customer information, emails, consumer data, employee records and payment information are the types of data most often stored in the cloud. Since 2014, the storage of customer information in the cloud has increased the most, from 53 percent in 2014 to 62 percent of respondents saying their company was doing this today. 53 percent also considered customer information the data most at risk in the cloud.

Security departments left in the dark when it comes to buying cloud services

Only 21 percent of respondents said members of the security team are involved in the decision-making process about using certain cloud application or platforms. The majority of respondents (64 percent) also said their organizations do not have a policy that requires use of security safeguards, such as encryption, as a condition to using certain cloud computing applications.

Encryption is important but not yet pervasive in the cloud

Seventy-two percent of respondents said the ability to encrypt or tokenize sensitive or confidential data is important, with 86 percent saying it will become more important over the next two years, up from 79 percent in 2014. While the importance of encryption is growing, it is not yet widely deployed in the cloud. For example, for SaaS, the most popular type of cloud-based service, only 34 percent of respondents say their organization encrypts or tokenizes sensitive or confidential data directly within cloud-based applications.

Many companies still rely on passwords to secure user access to cloud services

67 percent of respondents said the management of user identities is more difficult in the cloud than on-premises. However, organizations are not adopting measures that are easy to implement and could increase cloud security. About half (forty-five percent) of companies are not using multi-factor authentication to secure employee and third-party access to applications and data in the cloud, which means many companies are still relying on just user names and passwords to validate identities. This puts more data at risk because 58 percent of respondents say their organizations have third-party users accessing their data and information in the cloud.

Recommendations for data security in the cloud

The new realities of Cloud IT mean that IT organizations need to set comprehensive policies for data governance and compliance, create guidelines for the sourcing of cloud services, and establish rules for what data can and cannot be stored in the cloud.

IT organizations can accomplish their mission to protect corporate data while also being an enabler of their Shadow IT by implementing data security measures such as encryption that allow them to protect data in the cloud in a centralized fashion as their internal organizations source cloud-based services as needed.

As companies store more data in the cloud and utilize more cloud-based services, IT organizations need to place greater emphasis on stronger user access controls with multi-factor authentication. This is even more important for companies that give third-parties and vendors access to their data in cloud.

About the survey

The survey was conducted by the Ponemon Institute on behalf of Gemalto and surveyed 3,476 IT and IT security practitioners in the United States, Brazil, United Kingdom, Germany, France, Russian Federation, India, Japan and Australia who are familiar and involved in their company's use of both public and private cloud resources.