Survey: Companies Lack Adequate Policies To Protect Information In The Cloud

  • Apr 06, 2010

Symantec Corp. and the Ponemon Institute, a privacy and information management research firm, recently announced the findings of a joint survey of IT professionals. The survey revealed that most organizations lack the procedures, policies and tools to ensure that sensitive information they put in the cloud remains secure.

Despite security concerns and the expected growth in cloud computing, only 27 percent of respondents said their organizations have procedures for approving cloud applications that use sensitive or confidential information.

In most organizations, large gaps exist between those currently evaluating cloud computing vendors and the IT and security business leaders that should ideally be responsible. Of the organizations surveyed, 68 percent indicated that ownership for evaluating cloud computing vendors resides with end users and business managers. Only 20 percent of the organizations surveyed reported that their information security teams are regularly involved in the decision making process and approximately a quarter said they never participated at all. However, 69 percent of the respondents indicated they would prefer to see the information security or corporate IT teams lead the cloud decision making process.

  • The survey found that employees are making decisions without their IT departments' insights or full knowledge of the security risks involved. Only 30 percent of respondents evaluate cloud computing vendors prior to deploying their products.
  • Organizations evaluate cloud services by word of mouth (65 percent), contractual agreements and assurances from the vendor (55 percent and 53 percent, respectively). Only 23 percent require proof of security compliance such as SAS 70, 18 percent rely on in-house security assessments and just six percent rely on third-party assessments by security experts or auditors.
  • More than 75 percent of respondents noted that the migration to cloud computing was occurring in a less-than-ideal manner, due to a lack of control over end users. Lack of resources to conduct proper evaluations, lack of leadership to oversee the process and the low priority for evaluations were also factors.
  • Only 19 percent of the respondents indicated that their company provides general data security training that discusses cloud applications. In addition, 42 percent of the respondents noted that their company offers general data security training that does not specifically discuss cloud applications.

"Cloud computing holds a great deal of promise as a tool for providing many essential business services, but our study reveals a disturbing lack of concern for the security of sensitive corporate and personal information as companies rush to join in on the trend," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "In order to properly address information security concerns we encourage organizations to immediately incorporate policies and processes for determining vendor qualifications. In addition, cloud computing vendors must also be willing to adopt a more transparent posture."

Recommendations:

  • Ensure that policies and procedures clearly state the importance of protecting sensitive information stored in the cloud. The policy should outline what information is considered sensitive and proprietary.
  • Organizations should adopt an information governance approach that includes tools and procedures for classifying their information and understanding risk so that policies can be put in place that specify which cloud-based services and applications are appropriate and which are not.
  • Evaluate the security posture of third parties before sharing confidential or sensitive information. As part of the process, corporate IT and/or information security experts should conduct a thorough review and audit of the vendor's security qualifications.
  • Prior to deploying cloud technology, companies should formally train employees how to mitigate the security risks specific to the new technology to make sure sensitive and confidential information is protected.

Featured

  • From Surveillance to Intelligence

    Years ago, it would have been significantly more expensive to run an analytic like that — requiring a custom-built solution with burdensome infrastructure demands — but modern edge devices have made it accessible to everyone. It also saves time, which is a critical factor if a missing child is involved. Video compression technology has played a critical role as well. Over the years, significant advancements have been made in video coding standards — including H.263, MPEG formats, and H.264—alongside compression optimization technologies developed by IP video manufacturers to improve efficiency without sacrificing quality. The open-source AV1 codec developed by the Alliance for Open Media—a consortium including Google, Netflix, Microsoft, Amazon and others — is already the preferred decoder for cloud-based applications, and is quickly becoming the standard for video compression of all types. Read Now

  • Cost: Reactive vs. Proactive Security

    Security breaches often happen despite the availability of tools to prevent them. To combat this problem, the industry is shifting from reactive correction to proactive protection. This article will examine why so many security leaders have realized they must “lead before the breach” – not after. Read Now

  • Achieving Clear Audio

    In today’s ever-changing world of security and risk management, effective communication via an intercom and door entry communication system is a critical communication tool to keep a facility’s staff, visitors and vendors safe. Read Now

  • Beyond Apps: Access Control for Today’s Residents

    The modern resident lives in an app-saturated world. From banking to grocery delivery, fitness tracking to ridesharing, nearly every service demands another download. But when it comes to accessing the place you live, most people do not want to clutter their phone with yet another app, especially if its only purpose is to open a door. Read Now

  • Survey: 48 Percent of Worshippers Feel Less Safe Attending In-Person Services

    Almost half (48%) of those who attend religious services say they feel less safe attending in-person due to rising acts of violence at places of worship. In fact, 39% report these safety concerns have led them to change how often they attend in-person services, according to new research from Verkada conducted online by The Harris Poll among 1,123 U.S. adults who attend a religious service or event at least once a month. Read Now

Most   Popular

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.