Most cloud services are putting businesses at risk
Posted on 11 April 2014.
A new Skyhigh Networks report analyzes usage data from more than one million users across more than 40 companies spanning the financial services, healthcare, high technology, manufacturing, media, and professional service industries to quantify the use of cloud services and the security risk that they pose to enterprises.


A key finding was that enterprises used an average of 588 cloud services. Even if one were to ignore the EU data residency requirements, only 9% of the cloud services in use provide enterprise-grade security capabilities, while the remaining 91% (more than 9 out of 10) pose medium to high security risks to organizations.

From a data privacy and data residency perspective, only 1% of the cloud services in use both offer enterprise-grade security capabilities and store data in Europe’s jurisdictional boundaries, and the remaining 99%, either store data in countries where data privacy laws are less stringent or don’t have enterprise-grade security capabilities, or both.

Much of the cloud adoption within European organizations occurs under the radar of the CIO or CISO – leading to a situation where Shadow IT is widespread and uncontrolled. The ease with which employees can now consume cloud applications means that there is often little consideration for the security implications or impact on wider business policies. When CIOs examine the use of cloud services across the organization, they generally find Shadow IT is 10 times more prevalent than they initially assumed.

Key findings from the report include:
  • Only 5% of cloud services in Europe are ISO 27001 certified, posing compliance issues for those organizations unaware that their employees are using uncertified services.
  • 25 of the top 30 cloud services in the collaboration, content sharing, and file sharing categories were based in countries (United States, Russia, China) where the privacy laws are far less stringent compared to Europe.
  • 49 different services in use are tracking the browsing behavior of employees on the Internet. This exposes organizations to the increasingly prevalent watering hole attack.
“Cloud services certainly enable agile, flexible, and efficient businesses, and employees should be encouraged to use services that best suit their working style and enhance their productivity,” said Rajiv Gupta, CEO Skyhigh Networks. “However, it is evident from this study that too many employees are still unaware of the risks associated with some cloud services, and could even be jeopardizing the overall security position of their organization. Of the services that we analyzed, 72% stored data in the US – which could have legal and compliance implications for certain organizations in Europe. The bottom line is that businesses need to get smarter about the cloud. IT needs to develop a greater understanding of the cloud services in use and the risk they present, and play a leadership role in educating users and guiding the organization to securely embrace the cloud.”





Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals it’s our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //