CIOs have no clue how many cloud apps their employees use
Just as information technology shops are increasingly turning to hosted applications and services so, too, are hackers and criminals eyeing the cloud as fertile territory for conducting cyberattacks.
That’s according to Symantec’s new Internet Security Threat Report. Making matters even thornier is how little grasp IT executives have on cloud usage among employees.
“At the end of 2016, the average enterprise organization was using 928 cloud apps, up from 841 earlier in the year,” Symantec noted in the report. “However, most CIOs think their organizations only use around 30 or 40 cloud apps.”
[Also: Hospital datacenters: Extinct in 5 years?]
Symantec’s research included many industries, healthcare among those, and it holds that as more and more hospital employees adopt cloud applications, it becomes difficult to stay on top of unknown risky user behaviors.
The security vendor’s Symantec CloudSOC, in fact, determined that a quarter of all the information employees place in the cloud without IT knowing about it gets “broadly shared” among users, thereby making it more vulnerable to exposure.
Symantec’s analysis is based on investigating more than 1.3 billion emails and 176 million documents spanning 20,000 cloud apps.
The vendor also found that Microsoft’s Office 365, Google, and Dropbox were the most commonly used cloud apps among enterprises during 2016. Even though those popular services are widely considered to be secure, Symantec noted that sticking with just those does not mitigate all risk and CIOs should, instead, enforce data governance policies then monitor how all cloud data is used.
That will only get more important as shadow IT continues gaining traction and employees increasingly adopt cloud technologies without keeping information technology shops in the loop — and as cybercriminals find new ways to launch attacks that capitalize on cloud vulnerabilities.
In its report, Symantec pointed to high-profile security incidents last year, notably the Mirai botnet denial of service against Dyn that crippled Twitter, Netflix, Spotify and others as well as attacks against cloud-based Mongo DB databases, as attacks that signal what the future might hold.
“While cloud attacks are still in their infancy,” Symantec wrote, “2016 saw the first widespread outage of cloud services as a result of a denial of service (DoS) campaign, serving as a warning for how susceptible cloud services are to malicious attack.”
Twitter: SullyHIT
Email the writer: tom.sullivan@himssmedia.com
