Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/25/2018
09:00 AM
Paul Martini
Paul Martini
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Cloud Misconceptions Are Pervasive Across Enterprises

Shadow IT is rampant at many organizations that rely upon cloud-delivered tools and services to enable remote work, according to a new study. Here's what security teams need to do about it.

Everyone understands the benefits of the cloud, and the recent iboss 2018 Enterprise Cloud Trends Report shows adoption is increasing, with IT decision makers (ITDMS) planning to increase their SaaS spend from 21% of the overall IT budget to 28% over the next year. Despite this vote of confidence in the cloud from IT, the findings indicate that there is still a fundamental misunderstanding about the cloud that’s creating a disconnect – and misplaced concerns – among office workers and ITDMs.

While virtually all the ITDMs surveyed (99%) say that there is at least one positive driver motivating them to explore more cloud-based solutions, they still by-and-large acknowledge that their organization’s security policies need to improve to operate fully in a cloud environment (91%). This reservation hasn’t slowed down the use of SaaS and cloud products across the enterprise; every office worker polled views cloud and SaaS favorably, often bringing these applications into the network workflow with or without the approval of IT.

In fact, the survey shows that Shadow IT is rampant at most organizations, especially those that rely upon cloud-delivered tools and services to enable remote work. As many as 82% of the office worker respondent group admits to accessing SaaS applications when working remotely without using their company’s VPN, in violation of an acknowledged remote work policy. Those who have circumvented their company’s VPN do so to usurp restrictions enforced by IT, or because the security functions of the VPN cause latency issues that inhibit work.

Almost three quarters (72%) of surveyed office workers agree that it is more important for them to get access to the cloud and SaaS applications they need to do their job effectively than to tell the IT department what applications they are using. This is creating an environment where the security teams that are tasked with protecting network resources could be blind to glaring vulnerabilities because of inappropriate worker activity.

The challenges to overcoming this disconnect begins with every stakeholder – from office workers to ITDMs – gaining a more complete understanding of what the cloud means and how SaaS tools are delivered. Many of the top concerns that ITDMs hold about cloud – despite their inability to throttle the rate of SaaS adoption to meet business goals – are misguided, as these teams are only considering old-school cloud architectures that feature built-in security flaws.

The truth is, there are a multitude of ways that cloud-based services can be delivered to businesses without putting the organization at greater risk for data theft.

For starters, companies should investigate cloud tools that leverage “dedicated” cloud environments, as opposed to the multi-tenant, shared-cloud settings that pool customer data and cloud capacity among users. This will alleviate fears regarding data privacy (top concern for 62% of ITDMs) by ensuring that content is never mixed in that cloud setting so long as office workers continue to use approved, single-tenant cloud products.

There also needs to be fewer workarounds for employees looking to usurp network security protocols such as  VPNs for remote work. By leveraging cloud-based security or web gateway products, for instance, teams can retire VPNs altogether and redirect remote traffic to gateways in-the-cloud rather than backhaul connections. This will simplify network security architectures, retire the need for backhaul networks, and limit the opportunities for remote workers to inadvertently compromise network security.

Paul Martini is the CEO, co-founder and chief architect of iboss, where he pioneered the award-winning iboss Distributed Gateway Platform, a web gateway as a service. Paul has been recognized for his leadership and innovation, receiving the Ernst & Young Entrepreneur of The ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
iboss has created the first and only web gateway as a service specifically designed to solve the challenge of securing distributed organizations. Built for the cloud, the iboss Distributed Gateway Platform leverages an elastic, cloud-based node architecture that provides advanced security for todays decentralized organizations with more financial predictability. Backed by more than 110 patents and patents pending, and protecting over 4,000 organizations worldwide, iboss is one of the fastest growing cybersecurity companies in the world. To learn more, visit www.iboss.com.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-8298
PUBLISHED: 2018-09-24
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
CVE-2018-14825
PUBLISHED: 2018-09-24
A skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable...
CVE-2018-17437
PUBLISHED: 2018-09-24
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVE-2018-17438
PUBLISHED: 2018-09-24
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVE-2018-17439
PUBLISHED: 2018-09-24
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.