Risk //


12:33 PM
Connect Directly

20% Of 'Broadly Shared' Data Contains Regulated Info

Forget shadow IT. The new risk is "shadow data."

You're already worried about "shadow IT" -- the applications, mobile devices, and cloud services your users are using without your OK -- but what about "shadow data"? Even if your users are only using the file-sharing technology you gave them, you're not necessarily protected from over-sharers -- the people who share data (even sensitive data) with the entire organization, external parties, or the general public.

Twenty percent of such "broadly shared files" contain regulated data, according to research released today by Elastica. Of that data, 56% was personally identifiable information, 29% was personal health information, and 15% was PCI-protected credit card data.

That all adds up. On average, each user has over 2,000 files stored on the cloud, and 185 of those (about 9%) are "broadly shared," according to the research. Yet averages, in this case, are misleading -- which is good news.

"Most [data sharing] violations," says Elastica CEO Rehan Jalil, "are casually coming from a small group of users." In fact, 85% of the total risk exposures are attributable to only 5% of users. Identify and rope in those users, and most of the problem is treated. (The research cannot tell us whether or not those 5% share any common characteristics, from company to company, because the data was anonymized before it was analyzed.)

"The most surprising thing [about the research] was that, even for IT-blessed file-sharing applications, users' behavior is very casual at this point," says Jalil. "They share [files] however they want."

Some of the ways in which files are over-exposed include shared folders that are accessible to employees who don't need access to the data, folders in the cloud that continue to be accessible to users who have left the company, direct links to files emailed to people inside and outside the company, or unchanged default settings that make files public.

Jalil says that protecting against shadow data in the cloud requires IT security professionals to adopt "a completely new mindset, because on the surface, it looks like a managed service," but in truth, it isn't managed very well.

Read the full report, in the form of an infographic, here.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 12:15:01 PM
Re: The other Elastica
Netskope reported some recent research recently on the explosion of sharing activity recently. The data revealed sharing activity that went beyond what people typically think of sharing via cloud storage -- such as enterprise financial, human resources, project management and productivity apps . Interesting data. More here in a Dark Reading commentary  for whoever is interested. 
User Rank: Apprentice
10/28/2014 | 10:44:40 AM
Re: The other Elastica
I love the band Elastica! The songs Connection and Car Song consisted of many playlists and burned cds Sara, you have great taste in music. :)

Shadow IT is definitely a concern we've seen with many customers and with constant changes to regulatory compliance like PCI DSS and HIPAA, Shadow IT will need to be controlled and monitored closley but in a way that doesn't inhibit the business either. We want IT to be seen as a business enabler and operating in this environment is possible so long as IT is assessing, auditing and protecting data on the move. It also helps to have compliance and security awareness training in place that stripes people, process and techonology. All too often we see human error contributing to failed audits or breaches, which is unfortunate because most people are well intended. A littie information on what is considered sensitive data can go a long way. 

Thanks for covering a great topic.

Jessica Morrison, GRC Sr Product Marketing Manager, Dell
User Rank: Moderator
10/24/2014 | 2:00:27 PM
Re: The other Elastica
Nice, it's been awhile but I did own their CD back in the day. 

Shadow Data is indeed a huge concern, and most employees are probably guilty of at least one count of oversharing data that probably shouldn't be even stored in any cloud storage offering.  I've always been a fan of whitelabelling, putting data tags to hopefully reduce the ability for misuse of data, but the reality is that there ar eso many ways to circumvent systems and policies that this will always seem to be a headache for IT and security folks.
User Rank: Ninja
10/23/2014 | 7:54:54 PM
Changing the Format of Sensitive Data
While these statistics for over-shared data may appear small, there is another issue that is hinted at here not often talked about.  That is, the format of the data.  What makes certain types of data so attractive to share is the format used to store it.  For instance, the MP3 is so easily passed amongst users that millions of songs exchange hands everyday without a second thought.  The same is true of books in PDF format.  The nature of the "file" as we know it today, whether that is on a UNIX or Windows file system, contributes to this very over-sharing.

Now consider the alternative.  For all types of data that are regulated by nature, there is an opportunity to standardize how that is delivered, stored and viewed to not include "files", thus causing over-sharing to no longer be possible.  If not a file, then what?  Well, we shall see...  Add on top of this variable encryption and decryption schemes and biometric-based access and you could all but eliminate the misuse of regulated information.  Too expensive to implement?  I suspect that depends upon how much regulated data integrity is worth to you, and how much it costs every year to deal with cases of over-sharing.  


Thomas Claburn
Thomas Claburn,
User Rank: Ninja
10/23/2014 | 6:43:18 PM
Re: The other Elastica
If we're going to highlight British bands of yore, I'd vote for Shriekback (which is still around and about to release its 13th recording).

Sara Peters
Sara Peters,
User Rank: Author
10/23/2014 | 4:25:44 PM
The other Elastica
I know this has nothing to do with data security, but does anyone remember the British band Elastica? I listened to their first album incessantly in 1995. www.youtube.com/watch?v=ilKcXIFi-Rc
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Norsk Hydro Shuts Plants Amid Ransomware Attack
Kelly Sheridan, Staff Editor, Dark Reading,  3/19/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version that could allow a malicious user with local access to execute code with administrative privileges.
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.