McAfee's new Cloud Adoption and Risk Report has found that nearly a quarter of the data in the cloud can be categorised as sensitive, putting an organization at risk if stolen or leaked.
The report, which analyzed billions of events in anonymized customers production cloud use to assess the current state of cloud deployments and to uncover risks, found that sharing sensitive data in the cloud has increased 53% YoY.
According to the report, this means that those who do not adopt a cloud strategy that includes data loss protection, configuration audits and collaboration controls will endanger the security of their most valuable asset — data — while exposing themselves to increased risk of noncompliance with internal and external regulations.
The study found that while organizations aggressively use the public cloud to create new digital experiences for their customers, the average enterprise experiences more than 2,200 misconfiguration incidents per month in their infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) instances.
Cloud service providers only cover the security of the cloud itself, not customer data or customer use of their infrastructure and platforms. Companies are always responsible for securing their data wherever it is, hence highlighting the need to deploy cloud security solutions that span the whole cloud spectrum, from SaaS (software-as-a-service) to IaaS and PaaS.
“Operating in the cloud has become the new normal for organizations, so much so that our employees do not think twice about storing and sharing sensitive data in the cloud,” McAfee SVP of cloud security Rajiv Gupta said.
“Accidental sharing, collaboration errors in SaaS cloud services, configuration errors in IaaS/PaaS cloud services, and threats are all increasing. In order to continue to accelerate their business, organisations need a cloud-native and frictionless way to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS.”
According to the report, 21% of all files in the cloud contain sensitive data. The sharing of sensitive data with an open, publicly accessible link has increased meanwhile 23% YoY, and sensitive data sent to a personal email address increased by 12% YoY.
Organizations have more than 2,200 individual misconfiguration incidents per month in their public cloud instances (IaaS/PaaS), and threat events in the cloud (such as compromised account, privileged user and insider threats) have increased 27.7% YoY, with threats in Office365 growing by 63% YoY.
Cloud collaboration a blessing and a curse
Cloud services bring a momentous opportunity to accelerate business through their ability to quickly scale, allowing businesses to be agile with their resources and provide new opportunities for collaboration. Cloud services like Box and productivity suites like Office 365 are used to increase the fluidity and effectiveness of collaboration. However, collaboration means sharing, and uncontrolled sharing can expose sensitive data.
Once organizations have gained this visibility, they can then enforce appropriate security policies to prohibit highly sensitive data from being stored in unapproved cloud services and provide guardrails that prevent noncompliant sharing of sensitive data from approved cloud services, such as when data is shared with personal email addresses or through an open, public link.
First published in Enterprise Innovation