There’s no doubt that 2020 saw a significant growth in the adoption of cloud services and infrastructure across many sectors. Back in April, Microsoft CEO Satya Nadella was quoted as saying his company had seen, “two years of digital transformation in two months”. In fact, Microsoft hosted more than 200 million Teams participants on a single April day – a figure illustrative of the wider shift to the cloud.
While this helps demonstrate how effectively service providers and their customers have been able to implement and expand their use of cloud, it also renews questions about whether organisations are properly equipped to defend themselves as these technologies take centre stage.
A recent survey of IT and security professionals set out to understand their top security concerns and identify the actions that enterprises are taking to protect data in the cloud. The results give pause for thought and should encourage leaders to look closely at whether their cloud security strategy is keeping pace with changes at a strategic level.
Two-thirds of survey respondents said data leakage was their leading cloud security concern. Indeed, the potential for data leakage is a problem that sits at the heart of some of the other major issues. For example, data flowing to undesirable locations can violate data privacy and lead to regulatory noncompliance, while concerns about compromised credentials are typically rooted in a fear of unauthorised access to corporate systems and, consequently, data.
However, the deployment of data loss prevention (DLP) was surprisingly low at 31%, given the fact that data leakage was the leading cloud security concern. Additionally, single sign-on (37%) and multi-factor authentication (47%) are basic requirements for proper authentication in the cloud and, by extension, intelligent, granular security. Consequently, they, along with cloud access security brokers (29%), are examples of underutilised but critically important technologies.
Similarly, it seems that some organisations still focus on the wrong tools (on-premises solutions) such as firewalls (44%), network encryption (36%), and network monitoring (26%) to secure their use of the cloud.
Expanding cloud footprints are broadening risk
Looking at the public cloud specifically, almost all respondents to the survey (93%) were moderately to extremely concerned about the security of the public cloud. However, 73% of them said that cloud applications were as secure or more secure than on-premises apps. This apparent contradiction illustrates that while organisations recognise the public cloud is inherently safe, many are struggling with their ability to use it securely.
When asked about the importance of cloud-based architectures, 94% of respondents said architecture either moderately or extremely affects performance, scalability, and uptime. The problem is, 82% of respondents said that legacy network security tools and appliances provide limited to totally ineffective security in the cloud.
Even though maintaining visibility over corporate data and user activity is a core requirement for ensuring effective cybersecurity, many organisations clearly lack the ability to track and log key activities in the cloud. For instance, roughly half of respondents are unable to maintain visibility into file downloads (45%), file uploads (50%), DLP policy violations (50%), and external sharing (55%) in the cloud. In addition, 81% of companies cannot identify cross-application anomalous activity, something which will continue to grow in importance as organisations increasingly expand their cloud footprints.
Leaving the legacy
For a variety of reasons, organisations often use outdated or ill-suited tools to secure cloud environments. For example, most survey respondents rely upon endpoint protection (65%) or native threat protection built into cloud resources (57%) in order to defend against malware in the cloud.
The problem with this is that endpoint antivirus tools are not designed for the cloud and are poorly suited to personal devices, while most IaaS offerings and SaaS applications lack native malware protection. Instead, organisations should consider cloud access security brokers (CASBs) and other specialised technologies in order to defend against malware in the cloud.
Organisations are also relying upon poorly suited tools and strategies to secure cloud data on employees’ personal devices. The most common methods are the 40% who employ agent-based tools such as Mobile Device Management (MDM), or who block all personal device access (23%). The problem is, MDM invades user privacy when deployed on such endpoints, while blocking personal devices altogether impedes organisational productivity and effectiveness – hindering the user experience. Instead, organisations should safely enable BYOD with agentless security solutions and data loss prevention capabilities in order to effectively bolster their security.
The common thread that emerges from this research is that while increasing cloud adoption brings many advantages, organisations need to adopt the right security tools and processes that are specifically built for the cloud. This includes leveraging multi-faceted security platforms that are capable of providing comprehensive and consistent security for any interaction between any device, app, web destination, on-premises resource, or infrastructure.
This not only saves time for administrators, but these platforms can also be deployed in the public cloud, maximising performance, scalability, and uptime, eliminating the need for hardware appliances, and saving money at a time when budgets are increasingly stretched.
Anurag is the CTO of Bitglass and expedites technology direction and architecture. Anurag was director of engineering in Juniper Networks’ Security Business Unit before co-founding Bitglass. Anurag received a global education, earning an M.S. in computer science from Colorado State University, and a B.S. in computer science from the Motilal Nehru National Institute Of Technology.