Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/25/2018
09:00 AM
Paul Martini
Paul Martini
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Cloud Misconceptions Are Pervasive Across Enterprises

Shadow IT is rampant at many organizations that rely upon cloud-delivered tools and services to enable remote work, according to a new study. Here's what security teams need to do about it.

Everyone understands the benefits of the cloud, and the recent iboss 2018 Enterprise Cloud Trends Report shows adoption is increasing, with IT decision makers (ITDMS) planning to increase their SaaS spend from 21% of the overall IT budget to 28% over the next year. Despite this vote of confidence in the cloud from IT, the findings indicate that there is still a fundamental misunderstanding about the cloud that’s creating a disconnect – and misplaced concerns – among office workers and ITDMs.

While virtually all the ITDMs surveyed (99%) say that there is at least one positive driver motivating them to explore more cloud-based solutions, they still by-and-large acknowledge that their organization’s security policies need to improve to operate fully in a cloud environment (91%). This reservation hasn’t slowed down the use of SaaS and cloud products across the enterprise; every office worker polled views cloud and SaaS favorably, often bringing these applications into the network workflow with or without the approval of IT.

In fact, the survey shows that Shadow IT is rampant at most organizations, especially those that rely upon cloud-delivered tools and services to enable remote work. As many as 82% of the office worker respondent group admits to accessing SaaS applications when working remotely without using their company’s VPN, in violation of an acknowledged remote work policy. Those who have circumvented their company’s VPN do so to usurp restrictions enforced by IT, or because the security functions of the VPN cause latency issues that inhibit work.

Almost three quarters (72%) of surveyed office workers agree that it is more important for them to get access to the cloud and SaaS applications they need to do their job effectively than to tell the IT department what applications they are using. This is creating an environment where the security teams that are tasked with protecting network resources could be blind to glaring vulnerabilities because of inappropriate worker activity.

The challenges to overcoming this disconnect begins with every stakeholder – from office workers to ITDMs – gaining a more complete understanding of what the cloud means and how SaaS tools are delivered. Many of the top concerns that ITDMs hold about cloud – despite their inability to throttle the rate of SaaS adoption to meet business goals – are misguided, as these teams are only considering old-school cloud architectures that feature built-in security flaws.

The truth is, there are a multitude of ways that cloud-based services can be delivered to businesses without putting the organization at greater risk for data theft.

For starters, companies should investigate cloud tools that leverage “dedicated” cloud environments, as opposed to the multi-tenant, shared-cloud settings that pool customer data and cloud capacity among users. This will alleviate fears regarding data privacy (top concern for 62% of ITDMs) by ensuring that content is never mixed in that cloud setting so long as office workers continue to use approved, single-tenant cloud products.

There also needs to be fewer workarounds for employees looking to usurp network security protocols such as  VPNs for remote work. By leveraging cloud-based security or web gateway products, for instance, teams can retire VPNs altogether and redirect remote traffic to gateways in-the-cloud rather than backhaul connections. This will simplify network security architectures, retire the need for backhaul networks, and limit the opportunities for remote workers to inadvertently compromise network security.

Paul Martini is the CEO, co-founder and chief architect of iboss, where he pioneered the award-winning iboss Distributed Gateway Platform, a web gateway as a service. Paul has been recognized for his leadership and innovation, receiving the Ernst & Young Entrepreneur of The ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30481
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
CVE-2021-20020
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.