Enterprises Are Leaving Cloud Security Policies To Chance

Only a third have a strategy for securing a mix of different data center and cloud deployment scenarios.

As the lines blur between data center and cloud provider facility, very few organizations are keeping up with policies and technology geared to handle the shift to dynamic data centers, reports
a new study out by the SANS Institute
last week. The report shows that even at the most basic level, planning is scarce: fewer than a third of organizations have a strategy in place to tailor security requirements to the mix of environments they use.
“Security teams need to do a lot of thinking to keep up with the rapid diversification  of enterprise computing into a variety of private, public, cloud and traditional environments,” says Dave Shackleford, SANS analyst and author of the report. “Teams that are ahead of the game have already developed strategies describing how traditional and cloud computing models fit together, typically outlining what data or other assets can go to which type of external provider and what conditions should be placed on providers of different types or security levels.”
Commissioned by Illumio, the survey polled over 400 organizations to get the full picture on the state of security in today’s environments. As things stand, over half of organizations surveyed utilize Infrastructure-as-a-Service (IaaS) and almost a third use Platform-as-a-Service. While most of these services operate under a shared responsibility model that requires users to protect environments contained within, the truth is that the amount of security technology used within the cloud remains low compared to similar assets on premise; in most major categories it is half or less.
For example, while 75 percent of organizations utilize identity and access management tools on premises, only 31 percent use it in the cloud. And while 63 percent of organizations use a SIEM to track security events across traditional data center assets, just 25 percent do the same with cloud assets.
“This seeming reduction in use of security tools is a huge issue for many organizations today, given the fact that many public cloud providers don’t currently offer or support many security tools considered standard by most security teams,” Shackleford says. “While some cloud providers do have security offerings available, they fall far short of the security stack used by most survey respondents.”
Of course, that may not completely be the fault of the organizations themselves. Two of the biggest challenges cited by respondents in setting up security in the cloud was visibility into cloud provider practices and cooperation from cloud providers in supporting the customers’ security technology.

Last News
▸ Glasgow Council fined for weak security. ◂ Discovered: 26/12/2024 Category: security	▸ NSA PRISM causes controversy, yet seems lawful. ◂ Discovered: 26/12/2024 Category: security	▸ Google increases bug bounty rewards. ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Enterprises Are Leaving Cloud Security Policies To Chance