Symantec Corp. (Nasdaq: SYMC) and the Ponemon Institute, a leading privacy and information management research firm, today announced the findings of a joint survey of IT professionals. The survey revealed that most organizations lack the procedures, policies and tools to ensure that sensitive information they put in the cloud remains secure. Despite security concerns and the expected growth in cloud computing, only 27 percent of respondents said their organizations have procedures for approving cloud applications that use sensitive or confidential information.
In most organizations, large gaps exist between those currently evaluating cloud computing vendors and the IT and security business leaders that should ideally be responsible. Of the organizations surveyed, 68 percent indicated that ownership for evaluating cloud computing vendors resides with end users and business managers. Only 20 percent of the organizations surveyed reported that their information security teams are regularly involved in the decision making process and approximately a quarter said they never participated at all. However, 69 percent of the respondents indicated they would prefer to see the information security or corporate IT teams lead the cloud decision making process.
The survey found that employees are making decisions without their IT departments' insights or full knowledge of the security risks involved. Only 30 percent of respondents evaluate cloud computing vendors prior to deploying their products.
Additional Survey Findings:
Organizations evaluate cloud services by word of mouth (65 percent), contractual agreements and assurances from the vendor (55 percent and 53 percent, respectively). Only 23 percent require proof of security compliance such as SAS 70, 18 percent rely on inhouse security assessments and just six percent rely on thirdparty assessments by security experts or auditors.
More than 75 percent of respondents noted that the migration to cloud computing was occurring in a lessthan ideal manner, due to a lack of control over end users. Lack of resources to conduct proper evaluations, lack of leadership to oversee the process and the low priority for evaluations were also factors.
Only 19 percent of the respondents indicated that their company provides general data security training that discusses cloud applications. In addition, 42 percent of the respondents noted that their company offers general data security training that does not specifically discuss cloud applications.
Quotations:
"Cloud computing holds a great deal of promise as a tool for providing many essential business services, but our study reveals a disturbing lack of concern for the security of sensitive corporate and personal information as companies rush to join in on the trend," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "In order to properly address information security concerns we encourage organizations to immediately incorporate policies and processes for determining vendor qualifications. In addition, cloud computing vendors must also be willing to adopt a more transparent posture."
"Despite widespread interest in adopting cloud computing technologies, many organizations are 'flying blind' with respect to making them secure, potentially putting their business operations, company data and customer information at risk," said Justin Somaini, chief information security officer, Symantec. "Today, organizations need stronger information governance for managing corporate information and enabling confidence in the cloud. The success of cloud computing hinges on the trust and confidence that can only occur when the information security teams have better visibility into the security posture and operations of cloud initiatives."
Recommendations:
Ensure that policies and procedures clearly state the importance of protecting sensitive information stored in the cloud. The policy should outline what information is considered sensitive and proprietary.
Organizations should adopt an information governance approach that includes tools and procedures for classifying their information and understanding risk so that policies can be put in place that specify which cloudbased services and applications are appropriate and which are note.
Evaluate the security posture of third parties before sharing confidential or sensitive information. As part of the process, corporate IT and/or information security experts should conduct a thorough review and audit of the vendor's security qualifications.
Prior to deploying cloud technology, companies should formally train employees how to mitigate the security risks specific to the new technology to make sure sensitive and confidential information is protected.
Information Governance in the Cloud: A Study of IT Practitioners surveyed 637 senior IT practitioners working for medium to largesized (1,000 - 25,000 employees) U.S. companies that had adopted cloud computing platforms. The study was sponsored by Symantec. A full copy of the report "Flying Blind in the Cloud: The State of Information Governance" is available on the Symantec Website.
About Ponemon Institute
The Ponemon Institute© is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries.
In most organizations, large gaps exist between those currently evaluating cloud computing vendors and the IT and security business leaders that should ideally be responsible. Of the organizations surveyed, 68 percent indicated that ownership for evaluating cloud computing vendors resides with end users and business managers. Only 20 percent of the organizations surveyed reported that their information security teams are regularly involved in the decision making process and approximately a quarter said they never participated at all. However, 69 percent of the respondents indicated they would prefer to see the information security or corporate IT teams lead the cloud decision making process.
The survey found that employees are making decisions without their IT departments' insights or full knowledge of the security risks involved. Only 30 percent of respondents evaluate cloud computing vendors prior to deploying their products.
Additional Survey Findings:
Organizations evaluate cloud services by word of mouth (65 percent), contractual agreements and assurances from the vendor (55 percent and 53 percent, respectively). Only 23 percent require proof of security compliance such as SAS 70, 18 percent rely on inhouse security assessments and just six percent rely on thirdparty assessments by security experts or auditors.
More than 75 percent of respondents noted that the migration to cloud computing was occurring in a lessthan ideal manner, due to a lack of control over end users. Lack of resources to conduct proper evaluations, lack of leadership to oversee the process and the low priority for evaluations were also factors.
Only 19 percent of the respondents indicated that their company provides general data security training that discusses cloud applications. In addition, 42 percent of the respondents noted that their company offers general data security training that does not specifically discuss cloud applications.
Quotations:
"Cloud computing holds a great deal of promise as a tool for providing many essential business services, but our study reveals a disturbing lack of concern for the security of sensitive corporate and personal information as companies rush to join in on the trend," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "In order to properly address information security concerns we encourage organizations to immediately incorporate policies and processes for determining vendor qualifications. In addition, cloud computing vendors must also be willing to adopt a more transparent posture."
"Despite widespread interest in adopting cloud computing technologies, many organizations are 'flying blind' with respect to making them secure, potentially putting their business operations, company data and customer information at risk," said Justin Somaini, chief information security officer, Symantec. "Today, organizations need stronger information governance for managing corporate information and enabling confidence in the cloud. The success of cloud computing hinges on the trust and confidence that can only occur when the information security teams have better visibility into the security posture and operations of cloud initiatives."
Recommendations:
Ensure that policies and procedures clearly state the importance of protecting sensitive information stored in the cloud. The policy should outline what information is considered sensitive and proprietary.
Organizations should adopt an information governance approach that includes tools and procedures for classifying their information and understanding risk so that policies can be put in place that specify which cloudbased services and applications are appropriate and which are note.
Evaluate the security posture of third parties before sharing confidential or sensitive information. As part of the process, corporate IT and/or information security experts should conduct a thorough review and audit of the vendor's security qualifications.
Prior to deploying cloud technology, companies should formally train employees how to mitigate the security risks specific to the new technology to make sure sensitive and confidential information is protected.
Information Governance in the Cloud: A Study of IT Practitioners surveyed 637 senior IT practitioners working for medium to largesized (1,000 - 25,000 employees) U.S. companies that had adopted cloud computing platforms. The study was sponsored by Symantec. A full copy of the report "Flying Blind in the Cloud: The State of Information Governance" is available on the Symantec Website.
About Ponemon Institute
The Ponemon Institute© is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries.
