Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/25/2018
09:00 AM
Paul Martini
Paul Martini
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Cloud Misconceptions Are Pervasive Across Enterprises

Shadow IT is rampant at many organizations that rely upon cloud-delivered tools and services to enable remote work, according to a new study. Here's what security teams need to do about it.

Everyone understands the benefits of the cloud, and the recent iboss 2018 Enterprise Cloud Trends Report shows adoption is increasing, with IT decision makers (ITDMS) planning to increase their SaaS spend from 21% of the overall IT budget to 28% over the next year. Despite this vote of confidence in the cloud from IT, the findings indicate that there is still a fundamental misunderstanding about the cloud that’s creating a disconnect – and misplaced concerns – among office workers and ITDMs.

While virtually all the ITDMs surveyed (99%) say that there is at least one positive driver motivating them to explore more cloud-based solutions, they still by-and-large acknowledge that their organization’s security policies need to improve to operate fully in a cloud environment (91%). This reservation hasn’t slowed down the use of SaaS and cloud products across the enterprise; every office worker polled views cloud and SaaS favorably, often bringing these applications into the network workflow with or without the approval of IT.

In fact, the survey shows that Shadow IT is rampant at most organizations, especially those that rely upon cloud-delivered tools and services to enable remote work. As many as 82% of the office worker respondent group admits to accessing SaaS applications when working remotely without using their company’s VPN, in violation of an acknowledged remote work policy. Those who have circumvented their company’s VPN do so to usurp restrictions enforced by IT, or because the security functions of the VPN cause latency issues that inhibit work.

Almost three quarters (72%) of surveyed office workers agree that it is more important for them to get access to the cloud and SaaS applications they need to do their job effectively than to tell the IT department what applications they are using. This is creating an environment where the security teams that are tasked with protecting network resources could be blind to glaring vulnerabilities because of inappropriate worker activity.

The challenges to overcoming this disconnect begins with every stakeholder – from office workers to ITDMs – gaining a more complete understanding of what the cloud means and how SaaS tools are delivered. Many of the top concerns that ITDMs hold about cloud – despite their inability to throttle the rate of SaaS adoption to meet business goals – are misguided, as these teams are only considering old-school cloud architectures that feature built-in security flaws.

The truth is, there are a multitude of ways that cloud-based services can be delivered to businesses without putting the organization at greater risk for data theft.

For starters, companies should investigate cloud tools that leverage “dedicated” cloud environments, as opposed to the multi-tenant, shared-cloud settings that pool customer data and cloud capacity among users. This will alleviate fears regarding data privacy (top concern for 62% of ITDMs) by ensuring that content is never mixed in that cloud setting so long as office workers continue to use approved, single-tenant cloud products.

There also needs to be fewer workarounds for employees looking to usurp network security protocols such as  VPNs for remote work. By leveraging cloud-based security or web gateway products, for instance, teams can retire VPNs altogether and redirect remote traffic to gateways in-the-cloud rather than backhaul connections. This will simplify network security architectures, retire the need for backhaul networks, and limit the opportunities for remote workers to inadvertently compromise network security.

Paul Martini is the CEO, co-founder and chief architect of iboss, where he pioneered the award-winning iboss Distributed Gateway Platform, a web gateway as a service. Paul has been recognized for his leadership and innovation, receiving the Ernst & Young Entrepreneur of The ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...