Sol Cates | Principal Technologist, Data Protection
The pandemic merely accelerated what has been a long-term broad adoption of cloud environments, including multi-cloud and hybrid deployments. The benefits of cloud come with significant new security challenges for organizations. They need to understand how responsibilities are shared between provider and customer, how the threat models change, how internal stakeholders respond to cloud, and much more.
The Thales Cloud Security Study 2021 of more than 2,600 respondents from around the world tries to respond to key questions: How widespread is multi-cloud? What are the operational challenges of managing security across multiple clouds? Is cloud transformation as hard as it seems? How do I secure data in the cloud?
Widespread multi-cloud adoption
As more organizations adopt cloud-based environments, multi-cloud is now a reality. On a global basis, 57% of respondents indicated that they use two or more platforms of six large cloud providers for IaaS/PaaS. The proportion of multi-cloud usage grows with organization size and complexity. The research shows that there is an approximate correlation between organization size (as measured in revenue) and adoption of multi-cloud. nearly 70% of those in organizations with more than US$2bn in revenue indicated multi-cloud usage.
Those in healthcare represented the largest proportion of multi-cloud usage, while transportation and media/entertainment the lowest. Finally, the survey showed that the use of SaaS applications is widespread across all geographies, verticals and company sizes, with a global average of about 60 applications.
Gap between practitioners and executives
The survey indicated that there is a gap in perception in various areas related to cloud security. At a global level, there's a broad acceptance that security teams are tightly involved with policy definition (82%), but an almost even split in relation to enforcement; 37% believe it is the security team’s responsibility while 45% believe that policy enforcement is up to the cloud provider.
The same of discrepancy is witnessed at an organizational level. 39% of those in senior management state that security teams are responsible for both policy definition and enforcement, while only 32% of the staff thinks so. Staff respondents primarily indicated that security teams are responsible for policy definition (50%), but enforcement is up to others (41%).
This gap in perspectives is important because the lack of alignment between executives and staff can lead to deficiencies in security planning, management and operations, create confusion and a lack of coordination between teams during incidents.
Securing multi-cloud environments
Migrating to the cloud is an ongoing effort and many organizations still try to adapt to running securely their cloud environments. As a result, nearly half (46%) of global respondents agree that ‘it is more complex to manage privacy and data protection regulations in a cloud environment than on-premises’.
Complexity is also mirrored in how organizations secure their workloads which sprawl both on-premises and in the cloud. 66% of the respondents consider securing the combination of on-premises and cloud either “challenging” or “very challenging”.
Cloud security tools (cloud security posture management, cloud workload protection, cloud identity and entitlement management), data loss prevention, encryption, and multi-factor authentication (MFA) are the most common technologies used for securing cloud environments. Smaller organizations favored the use of cloud security tools and encryption. Financial services, media and transportation highlighted encryption as the most popular option, while MFA was listed first by technology respondents.
Overall, although MFA is widely acknowledged as the best practice in access management, acting as the thin line separating an attacker from compromising corporate resources and data, the survey findings indicate that we still have a long way to go for MFA to be broadly adopted. Only 16% of participants report that they use MFA to secure more than half of their cloud services, while this drops to 11% when securing on-premises applications.
Even though encryption is one of the key technologies identified for addressing cloud security needs, only 17% of the global respondents indicated that they encrypt more than 50% of sensitive data that they host on cloud environments. Sectors such as financial services, transportation, and media and entertainment are only marginally better at 21%.
Who’s responsible for encryption and key management?
Although it is the organization’s responsibility to ensure the effectiveness and robustness of encryption of data at rest and in transit, only 35% choose to use their own third-party encryption (BYOE) while 55% opt for using encryption offered by the cloud provider (at 55%).
Much like the deployment of encryption, there are different approaches to managing keys for cloud environments. The organization may use encryption provided by the cloud service provider but still retain control over how keys are created and managed, or they may choose to use provider-managed keys. At a global level, only 34% of respondents use their own encryption keys (BYOK), while 40% maintain control over key-generation material, with others leaving that control to the cloud providers.
Way ahead
All the report findings are important for businesses to review and compare with their own cloud security posture. The following suggestions might be handy:
- Supporting multi-cloud environments requires balancing security features provided by the cloud providers to deliver and centrally manage the same security outcomes across multiple platforms and organizational environments.
- There's a gap between practitioners and senior management in multiple areas, which, if left unaddressed, may create friction and noise on how to secure cloud adoption. Effective security requires alignment both at the operational level and within senior leadership.
- Since 40% of the organizations reported having “experienced a data breach involving data and applications that reside in the cloud”, they will need to have strong support for cloud environments in their incident detection and response capabilities.
- Protecting customer data is a priority. Organizations should strongly consider reviewing their strategies and approaches to proactively protect data in the cloud, especially sensitive data. This includes understanding the role of authentication, encryption and key management, as well as the shared responsibilities between providers and their customers.
- As data privacy and sovereignty regulations become more widespread, it will be paramount for organizations to have a clear understanding of how they remain responsible for data security and how they control the security of their sensitive data.
To review the full findings of this study and understand how Thales can help, download the full Thales Cloud Security Study. You can also join the virtual Thales Cloud Security Summit on November 17th and 18th, to hear the latest trends in cloud security and building trusted clouds. Register for free thought leadership and insights from security evangelists and technologists from 451 Research, Forrester, IDC, Google, IBM, Microsoft, PwC, Red Hat and Senetas