New research from The Cloud Security Alliance (CSA) and Proofpoint finds that organisations are struggling to sufficiently secure new cloud environments implemented during the pandemic and adapt their overall cybersecurity strategy to the evolving threat landscape.
For the “Cloud and Web Attacks” study, we queried more than 950 IT and security professionals at organisations of different sizes and in various locations to better understand the industry’s knowledge, attitudes and opinions regarding cloud- and web-delivered threats.
Organisations substantially accelerated their digital transformation initiatives to accommodate a remote workforce in the wake of COVID-19. These initiatives typically strive to improve worker productivity and other business objectives, but frequently present unintended consequences and challenges because of the large-scale structural changes required.
One of those challenges is developing a cohesive approach to cloud and web threats while managing legacy and on-premises security infrastructure. The cloud-first mentality had already thrust workers into “remote access” scenarios while they were still in the office prior to the pandemic lockdown, effectively ending traditional perimeter security. Hacking opportunities increased when employees were suddenly exported from their desks at work to their home offices.
Risks and threats through the supply chain increase as organisations continue to migrate to the cloud and increasingly rely on third parties and partners. The “Cloud and Web Attacks” study indicates that 81% of responding organisations are moderately to highly concerned about risks surrounding suppliers and partners.
Partners and other third parties are not tightly bound to enforce organisations’ enterprise policies and are difficult to monitor for compliance, making them a critical weak link in the chain of business processes. Almost half (48%) of the IT and security professionals we surveyed specifically cited their concern about supply chain attacks or data loss through the supply chain. A whopping 58% of organisations indicated that third parties and suppliers were the targets of cloud-based breaches in 2021.
Protect sensitive data all costs
Customer data and intellectual property exposures are the golden prize for hackers. Once obtained, especially by attacking an individual employee’s access, it’s hard tracing the original provenance of the breach when users are loosely managed from remote locations. The tools available to IT at the time of the lockdown weren’t designed to comprehensively protect remote users working with cloud applications from devices that might not be fully managed by their employers.
Not surprisingly, defending data is a key focus for businesses, with 47% of survey respondents listing “sensitive data loss” as their most concerning outcome of cloud and web attacks. The specific types of data organisations are most concerned with are customer data, credentials and intellectual property. Forty-three percent of organisations cited protecting customer data as their primary cloud and web security objective for 2022. Nonetheless, only one-third (36%) of the organisations surveyed reported that they have a dedicated enterprise data loss prevention (DLP) solution in place.
Are legacy systems truly the problem?
Almost half of IT and security professionals we surveyed (47%) blame dealing with legacy systems as a main concern with their cloud security posture. However, this doesn’t tell the entire story as legacy, on-site systems were subject to stronger controls prior to the pandemic.
Companies often exacerbate problems they already face by jumping into cloud-first commitments without a proportional investment in cloud and remote work security. Not surprisingly, the survey reveals that two-thirds of organisations rated their cloud security to be at risk.
Half of the surveyed organisations have insufficient levels of technical support for cloud security, yet these organisations are betting their future viability on cloud commerce. The idea of treating cloud security as a secondary process while betting the future on cloud commerce is extremely risky.
Less than half of the respondents surveyed for the “Cloud and Web Attacks” study had significantly invested in teams dedicated to cloud security. At the same time, less than half of the respondents said they believe current solutions to defend against cloud-originated threats are meeting their needs. We can only conclude that too few companies invest in cloud security and that those who do have little confidence in their investments.
People are the new perimeter
The main source of risks to security is—and always will be—the users of the enterprise IT systems. As a result, technology that helps protect a user from their own mistakes is critical to any organisation using cloud technology. To protect themselves against cloud and web threats, organisations most commonly use security awareness training (49%).
People are the new perimeter. It is an organisation’s responsibility to properly train and educate employees and stakeholders on how to identify, resist and report attacks before damage is done. Cultivating a culture of security around your organisation, coupled with the use of multiple streamlined solutions, is critical to effectively protecting people against cloud and web threats and defending organisational data.
How to move forward
Here are several recommendations for organisations to improve their security, based on the findings from our new “Cloud and Web Attacks” study:
- Evaluate what additional security is required based on the use case
- Invest in staff with cloud and remote work security expertise
- Require authentication that blocks attack entry points
- Re-evaluate security vendor investments for cloud security capabilities and track records
- Improve support to individual users regardless of location and platform
- Make cloud workflow a primary factor in current and future business risk assessment
Download our free report today.
Learn more about Proofpoint cloud security solutions.