Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

4/4/2017
04:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

As Cloud Use Expands, So Do Security Blind Spots, Studies Show

Three-quarters of IaaS and SaaS apps aren't monitored.

Cloud usage continues to spread throughout some of the most critical parts of IT infrastructure, but even as the workloads grow in importance, the security practices are not necessarily improving at the same pace.

All evidence shows that there still remains a shocking lack of visibility into what enterprise data goes into the cloud, how it's used, and what controls are in place to keep it safe. Several new reports released in the last week shed more light on the issue, including one out from Bitglass today, which shows fewer than one in four organizations regularly monitor cloud infrastructure for security risks.

"Enterprise cloud apps lack critical controls for data security that could significantly reduce the risk of a breach," said Nat Kausik, CEO of Bitglass. "While some organizations can identify potential leaks after the fact, few organizations can remediate threats in real-time.”

According to a survey conducted on behalf of Bitglass by CyberEdge Group among 3,000 IT professionals, just 24% of them reported that their organizations routinely monitor SaaS and IaaS apps for security risks. That's less than half the rate of those organizations that routinely monitor the network perimeter.

It's no wonder that so many organizations list a lack of visibility as one of their number one concerns about cloud security, according to different survey results released by AlienVault last week. Among over 900 participants, 42% named visibility woes as their top security worry.

It's particularly troubling given the types of data making it into the cloud these days. The industry is well beyond simply depending on SaaS for ticky-tack productivity software or simple document sharing. And as DevOps and Agile efforts gain steam, organizations increasingly depend on IaaS and PaaS to run the critical workloads that are at the heart of their application development and digital transformation efforts. According to a survey conducted by RightScale earlier this year, companies now run 79% of their workloads in the cloud, with 41% running in the public cloud.  

Meanwhile, a different study by Crowd Research Partners released last week found that 39% of organizations store customer data in the cloud, 35% store employee data, 22% store financial corporate data, and the same percentage store intellectual property. The top benefits cited by participants in the Crowd Research study were flexible scalability, improved availability, and cost reduction. The trouble is that too many organizations hear the siren call of cloud's upside without even considering the risks.

"It’s not all sunshine and roses," writes Javvad Malik in the AlienVault study from last week. "When improperly used and managed, the cloud has the potential to pose a serious security risk to enterprises, and these risks are barely understood by most organizations, and are often not considered at all."

In many instances, organizations don't attempt to fix the visibility problem because there's an out-of-sight, out-of-mind attitude that permeates a lot of organizational cultures.

"There's very much an attitude of 'I don't need to be as vigorous monitoring stuff as in my own data center because it's in somebody else's SAS 70,' and if something goes sideways I'll just hold my provider's feet to the fire," says George Wrenn, CEO and founder of CyberSaint Security and a research affiliate for MIT in its (IC3) Critical Infrastructure Protection Program. "There's some plausible deniability and there's a bit of a myth that (the provider) is taking care of everything. But that's not the reality. You're still on the hook for monitoring, measuring, and managing your risk posture in those environments."

[Need advice on how to hold your cloud computing service providers accountable without relying on them to rescue your whole security program? Then don't miss "Herding Vendors and Implementing Third-Party Risk Programs," and other sessions at the Interop ITX conference in Las Vegas, May 15-19.]

One of the difficulties that organizations face in establishing better visibility and control over systems residing in the cloud is that they can't simply port over old security technologies to cloud infrastructure. The Crowd Research survey shows that 78% of respondents report that their traditional security solutions don't work or have limited functionality in the cloud. However, that's not to say they don't have any options for improving the situation. That may have been true five years ago, but at this point there's a growing ecosystem of third-party monitoring options available for bridging the visibility gap between on-premises data centers and cloud infrastructure. Not only that, but cloud providers themselves are offering more built-in tools than ever - organizations just need to learn to use them.

"The great news is that cloud providers like AWS, are doing great things in the security space to help their users understand better what is going on. If you are running on AWS, you can get tools such as CloudTrail to audit all the API calls on your account, you can use AWS Config in order to audit your systems and ensure they meet your compliance rules," Pete Cheslock, head of operations and support teams at Threat Stack, told software development site InfoQ recently. "In many cases, the tools are there to be more secure running in the cloud, users just need to learn what they all are."

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marc Wilczek
50%
50%
Marc Wilczek,
User Rank: Author
4/25/2017 | 4:28:41 AM
Risks are still underestimated
Gartner recently predicted that by 2020, a third of successful cyber-attacks experienced by enterprises will be on their shadow IT resources. Safeguarding the estate and putting monitoring in place is not a "nice to have" type of thing. The risks associated with a security incident (reputation, financial damages etc.) still seem to be widley underestimated.
Catherine Hudson
50%
50%
Catherine Hudson,
User Rank: Apprentice
4/8/2017 | 2:31:37 AM
Ways to solve the problem
Great piece! You've raised a topical issue, thank you. The majority seems to concentrate on the benefits of the cloud and ignore its threats which are plenty, as you noted. I think, SAM tools, such as Binadox, are able to facilitate the problem solving, as they monitor SaaS (cloud services) usage, log all subscription and usage events, intercept Terms of Service (ToS) and analyze those ToS to help businesses reveal potential liabilities and act proactively.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.