Survey: Companies Lack Adequate Policies To Protect Information In The Cloud

• Apr 06, 2010

Symantec Corp. and the Ponemon Institute, a privacy and information management research firm, recently announced the findings of a joint survey of IT professionals. The survey revealed that most organizations lack the procedures, policies and tools to ensure that sensitive information they put in the cloud remains secure.

Despite security concerns and the expected growth in cloud computing, only 27 percent of respondents said their organizations have procedures for approving cloud applications that use sensitive or confidential information.

In most organizations, large gaps exist between those currently evaluating cloud computing vendors and the IT and security business leaders that should ideally be responsible. Of the organizations surveyed, 68 percent indicated that ownership for evaluating cloud computing vendors resides with end users and business managers. Only 20 percent of the organizations surveyed reported that their information security teams are regularly involved in the decision making process and approximately a quarter said they never participated at all. However, 69 percent of the respondents indicated they would prefer to see the information security or corporate IT teams lead the cloud decision making process.

• The survey found that employees are making decisions without their IT departments' insights or full knowledge of the security risks involved. Only 30 percent of respondents evaluate cloud computing vendors prior to deploying their products.
• Organizations evaluate cloud services by word of mouth (65 percent), contractual agreements and assurances from the vendor (55 percent and 53 percent, respectively). Only 23 percent require proof of security compliance such as SAS 70, 18 percent rely on in-house security assessments and just six percent rely on third-party assessments by security experts or auditors.
• More than 75 percent of respondents noted that the migration to cloud computing was occurring in a less-than-ideal manner, due to a lack of control over end users. Lack of resources to conduct proper evaluations, lack of leadership to oversee the process and the low priority for evaluations were also factors.
• Only 19 percent of the respondents indicated that their company provides general data security training that discusses cloud applications. In addition, 42 percent of the respondents noted that their company offers general data security training that does not specifically discuss cloud applications.

"Cloud computing holds a great deal of promise as a tool for providing many essential business services, but our study reveals a disturbing lack of concern for the security of sensitive corporate and personal information as companies rush to join in on the trend," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "In order to properly address information security concerns we encourage organizations to immediately incorporate policies and processes for determining vendor qualifications. In addition, cloud computing vendors must also be willing to adopt a more transparent posture."

Recommendations:

• Ensure that policies and procedures clearly state the importance of protecting sensitive information stored in the cloud. The policy should outline what information is considered sensitive and proprietary.
• Organizations should adopt an information governance approach that includes tools and procedures for classifying their information and understanding risk so that policies can be put in place that specify which cloud-based services and applications are appropriate and which are not.
• Evaluate the security posture of third parties before sharing confidential or sensitive information. As part of the process, corporate IT and/or information security experts should conduct a thorough review and audit of the vendor's security qualifications.
• Prior to deploying cloud technology, companies should formally train employees how to mitigate the security risks specific to the new technology to make sure sensitive and confidential information is protected.