Most companies are concerned about security in the public cloud. In particular, a percentage of 70% admit to having been the victim of a hacking attack in the last year, with the highest rate of breaches worldwide occurring in India. More specifically, companies that used more than one public cloud platform reported more security incidents compared to others that used only one platform. In addition, incorrect system configurations “paved the way” for 66% of cyberattacks. This happened either because attackers were able to exploit an incorrectly or poorly configured system , or because they were able to find flaws in firewall applications to steal account credentials from cloud providers.
Data loss and leakage is the biggest security concern for companies, with 44% citing it as their top area of focus, according to a Sophos State of Cloud Security 2020 survey
The survey, conducted by Vanson Bourne, included approximately 3,500 IT managers across 26 markets, including 413 in the US, 227 in India, 191 in the UK, 162 in China, 158 in Singapore, 148 in Australia and 126 in Japan. Respondents used services from at least one of the following public cloud providers: Amazon Web Services (AWS) and VMWare Cloud on AWS, Microsoft Azure, Alibaba Cloud and Oracle Cloud. They may also have used Google Cloud and IBM Cloud.
The survey revealed that all Singapore respondents expressed concerns about security in their public cloud, with about half citing the need to identify and respond to security incidents as a top security concern, while another 50% cited data breaches. In addition, about 71% had experienced a cloud security breach, of which 66% experienced ransomware and other malware, and 30% reported a data breach. About 20% reported having their accounts compromised, while 13% reported encryption.
Across the world, 96% of companies expressed concerns about public cloud security, the report found. Of the 70% that experienced a security breach, half experienced malware. Notably, India, where 93% of companies reported a breach related to public cloud, also had the highest rate of stolen cloud account credentials (48%), as well as the highest rate of reported cryptocurrency attacks (36%).
Sophos said the figures reflect a lack of “comprehensive cyber hygiene,” which has resulted in weaknesses in cloud security configurations, leaving companies more vulnerable and exposed to attacks. Sophos added that the Asia-Pacific region saw the highest rate of attacks, with 37% experiencing ransomware attacks and 35% reporting a data breach. Europe, on the other hand, saw the lowest rate of security breaches, which Sophos attributes to the implementation of the GDPR (General Data Protection Regulation). Europe reported the lowest malware infection rates at an average of 29%, while 24% of companies experienced data breaches and 22% experienced ransomware attacks.
Among the top concerns for cloud security, globally, 41% of companies cited the ability to identify and respond to security incidents, while 28% noted having to manage multiple cloud service providers.
Additionally, 73% of companies operated public multi-vendor environments, and the survey found that they experienced up to twice as many security incidents as their peers with single-cloud platforms. For example, 39% of those running multi-cloud environments experienced malware, compared to 21% using a single cloud environment. 34% of those with multi-cloud platforms reported data breaches, compared to 14% running single-cloud environments.
While half of those using one cloud platform did not experience a security breach, just 22% of those running multiple clouds said the same. Finally, Sophos principal researcher Chester Wisniewski said that remote work brought about by the COVID-19provides additional incentives to turn off cloud infrastructure, so it is concerning that many companies still do not understand their responsibility to secure cloud data and workloads. Cloud security is a shared responsibility, and companies must carefully manage and monitor cloud environments to stay one step ahead of hackers.
