The transition to the public cloud is a major concern for security leaders, but many haven't adopted the tools to address their biggest fears.

Security firm Bitdefender polled 1,051 IT security pros to learn more about the pressures of cloud migration as part of its report "Virtualization's hidden traps: Security has become a battlefield for CISOs." Respondents represent large businesses (1000+ PCs and data centers) based in the United States, the UK, France, Italy, Sweden, Denmark, and Germany.

Senior eThreat analyst Bogdan Botezatu says the high number of respondents concerned with public cloud security doesn't hold within the bigger picture: when asked about the most concerning data points, 22% of respondents encrypt already-migrated data.

"This was the first finding that took us a little bit by surprise," he says. "Twenty-two percent of information encrypted is very, very low."

To put that number into context, about 82% of CISOs surveyed say encryption is the most effective security mechanism to protect public-cloud data. Security software was next, cited by 75% of those surveyed, followed by backups, trusted by half of respondents.

Researchers found one-third of US companies secure 31% to 60% of data stored in the public cloud. Only 20% encrypt all data stored there. Fifteen percent of CISOs don't deploy security in the public cloud, and 17% don't encrypt data in transit from their data center to an external one.

Why only encrypt part of the data? "Some companies only encrypt information they are legally required to encrypt," says Botezatu. This usually includes financial information but does not extend to emails, chats, communications, or anything beyond financial data.

"It's something we have seen in the past and could have anticipated … encryption requires more processing power and is more complicated than storing information in plaintext," he continues. "Companies that don't have access to hardware will prioritize what they encrypt and where they will store that information … it's a security versus performance tradeoff."

Security leaders' biggest security concern is information stored in the public cloud will unintentionally be made public. They are focusing more on data leaks and less on other types of cyberattacks like malware, phishing, or other threats that could affect their infrastructure.

A data leak could potentially be devastating, especially to an organization with fewer resources, says Botezatu, who cites the Ashley Madison incident as an example.

"There are plenty of other examples of smaller companies who don't have the financial powers of the big companies to defend their users against identity theft or misuse of their personal information," he explains.

Hybrid Cloud, Hybrid Problems

The rise of hybrid cloud, already in place at 70% of global companies, is giving way to a new set of security challenges. CISOs are exploring new technologies to fight zero-days, advanced persistent threats (APTs), and other types of related threats.

Some of the biggest challenges in securing the hybrid cloud include synchronizing the public and private clouds, determining what happens with interconnectivity in case of an outage, meeting legislation to ensure information doesn't illegally transfer to another data center, and protecting all of this information stored under such a large attack surface, Botezatu explains.

"People have realized backups are tricky and rarely validated, and access to the backup is also often not restricted," he continues. "When you have a cloud you can take backups everywhere -  chances are at some point, you forget about those backups and who has access to them."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

The question of who has access to backups, and who has access to virtual machine snapshots, are considered some of the biggest issues with virtualization. All of the virtual machines you create have users that could use them as backdoors if they become disgruntled employees.

Botezatu suggests perhaps encryption will become more broadly used when the EU's GDPR goes into effect in May 2018. Many businesses still struggle to comply with new regulations, which require data be adequately protected. When breaches occur, businesses must have notification capabilities that align with GDPR standards. Gartner anticipates by the end of 2018, more than half of companies affected by GDPR will not fully comply with the requirements.

More CISOs have started to become part of the board, which Botezatu says could help them implement good practices. Many CIOs and CISOs are confronted with underfunding because they typically answer to the financial department; not the board. A company should spend 20% of their revenue on ensuring security, he says, but "this never happens."

If the board understands security should be an important discussion, like a business operation, those 20% of investments will be granted. Securing the data center is as important as securing your own premises.

"They need to be very careful about their budgets and the way they invest in security," says Botezatu of business leaders. "They need to understand the days where companies operate in a brick-and-mortar building are over now."

Related Content: