Threat events to Cloud Data increases to 28 percent Year-over-Year (YoY), McAfee reveals on their latest findings for Cloud Adoption and Risk Report at its Asia Pacific MPOWER Cybersecurity Summit held at Hilton Sydney on October 30 2018.
Its report analyzed billions of events in unnamed customers production cloud-use aimed at assessing the current state of cloud deployments and to determine the risks involved.
“The report revealed that nearly a quarter of the data in the cloud can be categorized as sensitive, putting an organisation at risk if stolen or leaked. Coupled with the fact that sharing sensitive data in the cloud has increased 53 percent YoY (Year over Year), those who do not adopt a cloud strategy that includes data loss protection, configuration audits and collaboration controls, will endanger the security of their most valuable asset — data — while exposing themselves to increased risk of noncompliance with internal and external regulations,” the cybersecurity company said.
Are organizations clue-less about the risks?
But the problem is that organizations now migrating — or already have — their data in the cloud have less clue about the risks.
Their data — more so the sensitive ones — are more exposed than what organizations think, the tech firm pointed out.
”Sensitive information stored in the cloud, SaaS (software-as-a-service) collaboration and IaaS/PaaS (infrastructure-as-a-service/platform-as-a-service) configuration mistakes, along with cloud threats, are at all-time highs — creating significant risks to enterprise data,” McAfee said.
Here are some of the report’s findings:
Key Findings:
- 21 percent of all files in the cloud contain sensitive data, demonstrating a steady increase year-over-year (YoY)
- The sharing of sensitive data with an open, publicly accessible link, has increased 23 percent YoY
- Organisations have more than 2,200 individual mis-configuration incidents per month in their public cloud instances (IaaS/PaaS)
- Threat events in the cloud, e.g., compromised account, privileged user and insider threats, have increased 27.7 percent YoY, with threats in Office 365 growing by 63 percent YoY
McAfee said the survey discovered even as “organisations aggressively use the public cloud to create new digital experiences for their customers, the average enterprise experiences more than 2,200 mis-configuration incidents per month in their infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) instances.”
Probably, here’s what customers should worry about
The American company pointed out that organizations providing cloud service do not give security to the data of its customers or to the use by customers of their infrastructure and platforms, with the organizations only providing security to their cloud service.
Nevertheless, McAfee said companies are always responsible for securing their data wherever it is, hence highlighting the need to deploy cloud security solutions that span the whole cloud spectrum, from SaaS to IaaS and PaaS.
Rajiv Gupta, senior vice president of McAfee’s Cloud Security Business, noted the increasing popularity of the cloud.
“Operating in the cloud has become the new normal for organizations, so much so that our employees do not think twice about storing and sharing sensitive data in the cloud.
“Accidental sharing, collaboration errors in SaaS cloud services, configuration errors in IaaS/PaaS cloud services, and threats are all increasing. In order to continue to accelerate their business, organisations need a cloud-native and friction-less way to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS,” said Gupta.”
Here’s the catch, though
Cloud collaboration is both a blessing and a curse, said McAfee.
“Cloud services bring a momentous opportunity to accelerate business through their ability to quickly scale, allowing businesses to be agile with their resources and provide new opportunities for collaboration. Cloud services like Box and productivity suites like Office 365 are used to increase the fluidity and effectiveness of collaboration. However, collaboration means sharing, and uncontrolled sharing can expose sensitive data.”
The report findings are a silent witness
- Twenty-two percent of cloud users share files externally, up 21 percent YoY
- Sharing sensitive data with an open, publicly accessible link, has increased by 23 percent YoY
- Sensitive data sent to a personal email address also increased by 12 percent YoY
The cybersecurity company’s advice
To secure sensitive data in cloud storage, file-sharing and collaboration applications, organisations must first understand which cloud services are in use, hold their sensitive data, and how that data is being shared and with whom. Once organisations have gained this visibility, they can then enforce appropriate security policies to prohibit highly sensitive data from being stored in unapproved cloud services and provide guardrails that prevent non-compliant sharing of sensitive data from approved cloud services, such as when data is shared with personal email addresses or through an open, public link.
Recommendation
McAfee recommends that organisations continuously audit and monitor their AWS, Azure, Google Cloud Platform and other IaaS/PaaS configurations as a standard security practice, while protecting data stored in IaaS/PaaS platforms. IaaS/PaaS use is growing rapidly as an alternative to on-premises data centers. Businesses need to get ahead and address their security responsibilities—data protection and threat defense as they would for SaaS cloud services and also configuration compliance and workload protection for IaaS/PaaS cloud services—before they experience a security incident. (McAfee/EKU)
