Chennai: Seventy five per cent organisations in the IT sector rely on a cloud provider’s built-in security, despite more than 50 per cent realising that it is not sufficient, said a survey.
The findings are part of ‘Global Advanced Threat Landscape Report 2019: Focus on Cloud’ released by CyberArk, leader in access security.
According to the report, as global organisations increasingly move critical applications, regulated customer data and development work into public cloud environments, 36 per cent say the number one benefit for moving workloads is to offload security risk.
“This is despite many public cloud providers providing straightforward guidance on their shared responsibility models for security and compliance in cloud environments,” it said.
As organisations utilise cloud to accelerate digital transformation, there must be greater awareness of where potential security risks exist, it said.
Four major issues that contribute to security threats are with businesses migrating critical applications into public cloud (49 per cent), storing customer data subject to regulatory oversight in the public cloud (45 per cent), using public cloud for internal development, including DevOps (39 per cent) and relying on cloud providerâs built-in security (75 per cent), despite recognising cloud providersâ built-in security is not sufficient (50 per cent).
CyberArk also claims that the greatest security concerns in public cloud usage are insiders, partners and contractors with privileged access (46 per cent), unauthorised access to cloud management consoles (46 per cent) and shared credentials across compute, storage or application instances (44 per cent).
“The problem becomes critical when unsecured and unmanaged credentials provide privileged access, which can enable attackers to escalate privileges and gain elevated access within cloud infrastructure,” the report noted.
Worryingly, majority of organisations (62 per cent) are unaware that credentials, secrets and privileged accounts exist in IaaS and PaaS environments, it said, adding that only 49 per cent currently have a privileged access security strategy in place for cloud infrastructure and workloads.
“The risks caused by a lack of clarity about who is responsible for security in the cloud is compounded by an overall failure by organisations to secure privileged access in these environments,” said executive vice president, global business development, CyberArk, Adam Bosnian.
“Despite the often sensitive and highly regulated data being stored in the cloud, it was surprising to see that less than half of organisations donât have a strategy in place for securing privileges in the cloud, a finding that remains unchanged since our last report.”