Cloud misconfigrations leave enterprises vulnerable to data loss: study

McAfee has released its Cloud Adoption and Risk Report, which analysed billions of events in anonymised customers production cloud use to assess the current state of cloud deployments and to uncover risks.

The report revealed that nearly a quarter of the data in the cloud can be categorised as sensitive, putting an organisation at risk if stolen or leaked. Coupled with the fact that sharing sensitive data in the cloud has increased 53 percent YoY, those who do not adopt a cloud strategy that includes data loss protection, configuration audits and collaboration controls, will endanger the security of their most valuable asset—data—while exposing themselves to increased risk of noncompliance with internal and external regulations.

The study found that while organisations aggressively use the public cloud to create new digital experiences for their customers, the average enterprise experiences more than 2,200 misconfiguration incidents per month in their infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) instances. Cloud service providers only cover the security of the cloud itself, not customer data or customer use of their infrastructure and platforms. Companies are always responsible for securing their data wherever it is, hence highlighting the need to deploy cloud security solutions that span the whole cloud spectrum, from SaaS (software-as-a-service) to IaaS and PaaS.

“Operating in the cloud has become the new normal for organisations, so much so that our employees do not think twice about storing and sharing sensitive data in the cloud,” said Rajiv Gupta, senior vice president of the Cloud Security Business, McAfee.

“Accidental sharing, collaboration errors in SaaS cloud services, configuration errors in IaaS/PaaS cloud services, and threats are all increasing. In order to continue to accelerate their business, organisations need a cloud-native and frictionless way to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS.”

According to the study, cloud services like Box and productivity suites like Office 365 are used to increase the fluidity and effectiveness of collaboration. However, collaboration means sharing, and uncontrolled sharing can expose sensitive data. It found that 22 percent of cloud users share files externally and sensitive data sent to a personal email address have increased by 12 percent YoY.

To secure sensitive data in cloud storage, file-sharing and collaboration applications, organisations must first understand which cloud services are in use, hold their sensitive data, and how that data is being shared and with whom.

Once organisations have gained this visibility, they can then enforce appropriate security policies to prohibit highly sensitive data from being stored in unapproved cloud services and provide guardrails that prevent non-compliant sharing of sensitive data from approved cloud services, such as when data is shared with personal email addresses or through an open, public link.

With SaaS, securing data, user identity and access to data is primarily the customer’s responsibility. With IaaS, customers take on a much larger share of security responsibility that includes data, identity, access, applications, network controls and host infrastructure. While this provides customers with an opportunity to have greater control over their cloud infrastructure, it also increases the organisation’s surface area for security risks and their responsibility for the same. IaaS providers, like Amazon Web Services (AWS), provide several infrastructure and platform services, each having deep and complicated security settings. Magnifying the IaaS/PaaS security challenge is the fact that organisations use multiple IaaS/PaaS vendors running several instances of each vendor’s product.

McAfee found that 94 percent of IaaS/PaaS use is AWS, but 78 percent of organisations using IaaS/PaaS have both AWS and Azure. It noted that enterprise organisations have an average of 14 misconfigured IaaS/PaaS instances running at one time, resulting in over 2,200 individual misconfiguration incidents per month.

The firm recommends that organisations continuously audit and monitor their AWS, Azure, Google Cloud Platform and other IaaS/PaaS configurations as a standard security practice, while protecting data stored in IaaS/PaaS platforms. IaaS/PaaS use is growing rapidly as an alternative to on-premises data centers. Businesses need to get ahead and address their security responsibilities—data protection and threat defense as they would for SaaS cloud services and also configuration compliance and workload protection for IaaS/PaaS cloud services—before they experience a security incident.

The study also revealed that most of the threats to data in the cloud result from compromised accounts and insider threats.

The average organisation generates over 3.2 billion events per month in the cloud, of which 3,217 are anomalous behaviors and 31.3 are actual threat events. Threat events in the cloud, such as a compromised account, privileged user, or insider threat, have increased 27.7 percent YoY, McAfee revealed.

Eighty percent of all organisations experience at least one compromised account threat per month. The study also found that 92 percent of all organisations have stolen cloud credentials for sale on the Dark Web and threats in Office 365 have grown by 63 percent YoY.

To get ahead of comprised accounts and insider threats, organisations should understand how cloud services are used. They should also identify anomalous behavior, such as when the same user accesses the cloud from disparate locations simultaneously, which could indicate a compromised account threat.

As a first step towards protecting data in the cloud, cloud access security brokers (CASB) should be implemented. CASBs are cloud-native services that enforce security, compliance and governance policies for cloud services. They help organisations leverage and extend their existing security controls where appropriate and define and deploy new cloud-native ones where appropriate to enable enterprises to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS.