Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/25/2018
09:00 AM
Paul Martini
Paul Martini
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Cloud Misconceptions Are Pervasive Across Enterprises

Shadow IT is rampant at many organizations that rely upon cloud-delivered tools and services to enable remote work, according to a new study. Here's what security teams need to do about it.

Everyone understands the benefits of the cloud, and the recent iboss 2018 Enterprise Cloud Trends Report shows adoption is increasing, with IT decision makers (ITDMS) planning to increase their SaaS spend from 21% of the overall IT budget to 28% over the next year. Despite this vote of confidence in the cloud from IT, the findings indicate that there is still a fundamental misunderstanding about the cloud that’s creating a disconnect – and misplaced concerns – among office workers and ITDMs.

While virtually all the ITDMs surveyed (99%) say that there is at least one positive driver motivating them to explore more cloud-based solutions, they still by-and-large acknowledge that their organization’s security policies need to improve to operate fully in a cloud environment (91%). This reservation hasn’t slowed down the use of SaaS and cloud products across the enterprise; every office worker polled views cloud and SaaS favorably, often bringing these applications into the network workflow with or without the approval of IT.

In fact, the survey shows that Shadow IT is rampant at most organizations, especially those that rely upon cloud-delivered tools and services to enable remote work. As many as 82% of the office worker respondent group admits to accessing SaaS applications when working remotely without using their company’s VPN, in violation of an acknowledged remote work policy. Those who have circumvented their company’s VPN do so to usurp restrictions enforced by IT, or because the security functions of the VPN cause latency issues that inhibit work.

Almost three quarters (72%) of surveyed office workers agree that it is more important for them to get access to the cloud and SaaS applications they need to do their job effectively than to tell the IT department what applications they are using. This is creating an environment where the security teams that are tasked with protecting network resources could be blind to glaring vulnerabilities because of inappropriate worker activity.

The challenges to overcoming this disconnect begins with every stakeholder – from office workers to ITDMs – gaining a more complete understanding of what the cloud means and how SaaS tools are delivered. Many of the top concerns that ITDMs hold about cloud – despite their inability to throttle the rate of SaaS adoption to meet business goals – are misguided, as these teams are only considering old-school cloud architectures that feature built-in security flaws.

The truth is, there are a multitude of ways that cloud-based services can be delivered to businesses without putting the organization at greater risk for data theft.

For starters, companies should investigate cloud tools that leverage “dedicated” cloud environments, as opposed to the multi-tenant, shared-cloud settings that pool customer data and cloud capacity among users. This will alleviate fears regarding data privacy (top concern for 62% of ITDMs) by ensuring that content is never mixed in that cloud setting so long as office workers continue to use approved, single-tenant cloud products.

There also needs to be fewer workarounds for employees looking to usurp network security protocols such as  VPNs for remote work. By leveraging cloud-based security or web gateway products, for instance, teams can retire VPNs altogether and redirect remote traffic to gateways in-the-cloud rather than backhaul connections. This will simplify network security architectures, retire the need for backhaul networks, and limit the opportunities for remote workers to inadvertently compromise network security.

Paul Martini is the CEO, co-founder and chief architect of iboss, where he pioneered the award-winning iboss Distributed Gateway Platform, a web gateway as a service. Paul has been recognized for his leadership and innovation, receiving the Ernst & Young Entrepreneur of The ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
Why the CISSP Remains Relevant to Cybersecurity After 28 Years
Steven Paul Romero, SANS Instructor and Sr. SCADA Network Engineer, Chevron,  11/6/2018
5 Reasons Why Threat Intelligence Doesn't Work
Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
iboss has created the first and only web gateway as a service specifically designed to solve the challenge of securing distributed organizations. Built for the cloud, the iboss Distributed Gateway Platform leverages an elastic, cloud-based node architecture that provides advanced security for todays decentralized organizations with more financial predictability. Backed by more than 110 patents and patents pending, and protecting over 4,000 organizations worldwide, iboss is one of the fastest growing cybersecurity companies in the world. To learn more, visit www.iboss.com.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16850
PUBLISHED: 2018-11-13
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.
CVE-2018-17187
PUBLISHED: 2018-11-13
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options...
CVE-2018-1792
PUBLISHED: 2018-11-13
IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code that could be executed with root privileges. IBM X-Force ID: 148947.
CVE-2018-1808
PUBLISHED: 2018-11-13
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.
CVE-2018-15452
PUBLISHED: 2018-11-13
A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrusions. To exploit this vulnerability, the ...