Two-thirds of IT pros don't believe cloud environments are as secure as on-premises environments

Tim Wilson, Editor in Chief, Dark Reading, Contributor

November 2, 2011

2 Min Read

Enterprises are using cloud infrastructures, but they aren't very confident in their ability to secure them, according to a study to be published Wednesday.

Fewer than half of enterprises believe their organizations have adequate technologies to secure their cloud infrastructures, according to a survey of 1,000 IT security practitioners and enterprise compliance officers conducted by the Ponemon Institute and sponsored by encryption vendor Vormetric.

According to the report, entitled "Data Security in the Cloud Survey of U.S. IT Operations, IT Security and Compliance Practitioners," only one-third of IT security practitioners believe cloud infrastructure (IaaS) environments are as secure as on-premise datacenters, while half of compliance officers think IaaS is as secure.

Twenty-one percent of compliance officers said they are responsible for defining security requirements, but 22 percent of IT respondents think this responsibility belongs to business unit leaders.

Fewer than a third of respondents said they encrypt data in the cloud. IT practitioners said encryption should be used to make data unreadable by cloud service providers, but compliance officers said encryption should be used to enforce separation of duties to prevent IT administrators from accessing data they do not need to perform their jobs.

"While we were surprised by the different attitudes towards cloud security among IT practitioners and compliance officers, the findings did reveal that security in the cloud is a concern for both groups, especially in IaaS environments," said Larry Ponemon, chairman and founder of the Ponemon Institute. "What is most troubling is the fact that while respondents feel they lack adequate technologies to secure their IaaS environments, ownership for security in the cloud is dispersed throughout the organization."

Data in IaaS cloud environments is perceived as a greater security risk, while SaaS (software as a service) is considered by both groups to be more secure.

More than half of respondents said their organizations' internal audit review does not provide feedback on the security in cloud infrastructures, the study says.

Have a comment on this story? Please click "Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Read more about:

2011

About the Author(s)

Tim Wilson, Editor in Chief, Dark Reading

Contributor

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights