There's a security gap in the cloud
era -- or at least a perceived security gap. So says a new survey from AccelOps that asked 176 IT security professionals about their security practices during the RSA Conference 2013.
While 65 percent of organizations are using cloud services, only 46 percent have moved mission-critical applications and data outside the enterprise, due to cloud security concerns. Thirty-nine percent believe their existing Security Information and Event Monitoring tools are not acceptable to support their cloud security and regulatory compliance requirements.
"It's a sad indictment of the security industry that, in such a well-established market as SIEM and performance monitoring, 39 percent of those surveyed indicated they could not rely on their existing SIEM and monitoring solutions to ensure cloud security and compliance," said Flint Brenton, president and CEO of AccelOps, which offers SIEM products. "There is much work to be done to ensure that security threats and the risk of data loss associated with cloud environments are minimized."
The "bring your own device" trend, data control and potential data loss top the cloud security concerns, closely followed by enforcing security policies and ensuring visibility across both traditional and cloud infrastructures.
The survey also shows that the responsibility for cloud security remains overwhelmingly with the internal IT staff at 78 percent, and only 13 percent of those surveyed hold their Managed Service Providers (MSPs) responsible for cloud security.
"The promise of cloud computing is to improve agility and deliver greater efficiencies and cost savings," Brenton said. "However, unless risk can be managed and data secured effectively, organizations will not fully benefit from the advantages of the cloud."
Cloud security firm SilverSky recently conducted a cloud adoption study. The survey found that 97 percent of security execs indicate their confidence level in the cloud has either increased or stayed the same in the past 12 months.
On average, U.S. companies have moved one-quarter of all their business functions and services to the cloud, the most popular being e-commerce (41 percent), closely followed by e-mail (39 percent) and storage (30 percent). Many respondents have plans to migrate additional applications soon.
Andrew Jaquith, CTO at SilverSky, said the idea that the cloud is not as secure as on-premise systems remains the biggest obstacle to widespread cloud adoption.
"In reality, the cloud has proven equally to more secure. For example, downtime of on-premise solutions continues to outpace the cloud. Cloud vendors commit to and generally meet a 99.9 percent uptime threshold as part of its SLA [service-level agreement]; a level of service that cannot be easily replicated by on-premise solutions," Jaquith told us.
"When CIOs and security decision-makers move their critical workloads to the cloud, they seek providers that cut their costs, simplify their architectures and protect their data. But equally important, they are making a leap of faith by entrusting services they can't do without to someone they don't know -- that's why transparency, clarity and assurance are so essential in building trust between the customer and cloud service provider."