Research shows one-third of enterprises experienced unauthorized cloud access, and another 19% are unsure if unauthorized cloud access occurred.
Palo Alto, Calif. — March 2, 2021 – CloudSphere today announced the findings of its new report “In the Dark: Why Enterprise Blind Spots are Leaving Sensitive Enterprise Data Vulnerable to Breaches,” conducted by Dimensional Research. Report findings revealed that 32% of enterprises experienced unauthorized access to cloud resources, and another 19% were unaware if unauthorized access occurred. This was found to be largely driven by poor enforcement of identity and access management (IAM) policies in the cloud.
CloudSphere, which provides cloud governance solutions, commissioned the report surveying 303 IT professionals from around the world. The research aimed to understand current cloud infrastructure access, governance, and management practices and why and how often unauthorized access occurs.
“As cloud adoption accelerates, securing and governing multicloud environments is a top IT challenge facing enterprises,” said Keith Neilson, technical evangelist for CloudSphere. “This research highlights the immense cloud governance gaps enterprises experience that ultimately leave sensitive data vulnerable to breaches. It is critical enterprises adopt a unified approach to properly govern cloud access and protect enterprise data to avoid costly breaches and preserve trust.”
Perception vs. reality: Lack of IAM policy enforcement leads to unauthorized access
Due to the complex nature of cloud environments, having visibility into which users have access to data and resources is increasingly difficult. Particularly troubling is the disparity between the enterprise’s perception of secure access control and the reality of policy enforcement failures. Research found that while 78% claimed to be able to enforce IAM policies, 69% reported policy enforcement issues created unauthorized access.
Highlighting just how crucial it is for enterprises to improve IAM policy enforcement, 30% of respondents reported millions of records flow through their cloud solutions each month, and with the cost of each lost or stolen data record averaging $146, businesses are risking hundreds of millions of dollars in losses due to unauthorized access. Unauthorized access included ex-employees, hackers, external consultants and partners, which highlights the lack of context and controls for authorized and defined users and groups within cloud environments. Results point to a clear lack of visibility and monitoring for unauthorized or misplaced access, which ultimately threatens an organization’s security.
Enterprises are taking on this challenge alone and failing with 80% of companies developing their own cloud governance policies internally. Despite having policies in place, the lack of enforcement ultimately leads to unauthorized access and the risk of costly breaches of sensitive data, damaging company trust and valuation.
Cloud access across teams puts data at risk
In addition, 53% of companies reported 100 or more individuals have cloud access across numerous internal and external teams, the majority of which have no security specific expertise. For example, 72% say developers have cloud access, and 69% say DevOps teams have cloud access. This large number of users with minimal security expertise increases the potential for error, and mistakes become inevitable when trying to control access to cloud resources. Also, 41% say consultants have cloud access, and 25% say partners have cloud access. Access by these parties from outside of the organization puts data at even greater risk.
Why IAM solutions fail
Gartner found that 81% of organizations use a multicloud approach and as public cloud providers’ IAM tools typically can’t expand beyond their own platform, it is increasingly difficult to implement a standardized IAM solution across all cloud platforms. The CloudSphere research report found that 85% of companies utilize different cloud provider access tools for each environment, and more than half (57%) of companies use numerous cloud IAM tools to govern their multicloud environments. Manual errors are also a leading reason why IAM solutions fail, as 63% noted IAM solutions were not properly configured, and 56% said roles and access rights were improperly entered.
Cloud misconfigurations are common, and unauthorized access isn’t always noticed
Unauthorized access often goes unnoticed, and misconfigurations are common. CloudSphere’s survey findings echoed this claim:
- 60% report that the interval before correcting misconfiguration errors was monthly or longer
- Only 50% indicate they review access policies and privileges on a monthly basis.
The need for cloud policy upkeep
The report’s findings on misconfigurations and unauthorized access allude to a disparity between the enterprise’s perception of granted access being appropriately configured and applied and the reality that events, hacks, and unauthorized access occur at a high rate. These findings highlight the need for enterprises to be diligent and persistent in the upkeep of cloud policies and access rights.
The research also shows that there is a lack of functional automation and functional alerting to ensure a proactive approach that prevents unauthorized access from occurring. To download a free copy of the report or learn more about best practices for managing governance in the cloud, click here.
Methodology
IT professionals at enterprise companies representing all seniority levels were invited to participate in a survey on their company’s access management and governance for their IaaS and PaaS environments and related IAM tool use. The survey was administered electronically, and participants were offered a token compensation for their participation.
About CloudSphere
CloudSphere’s flagship Cloud Management Platform enables enterprises and cloud service providers to simplify and optimize cloud management and governance. Our multicloud solutions use a unique application centric approach to allow users to see beyond individual cloud resources and manage entire applications in the cloud. Headquartered in Palo Alto, California, CloudSphere supports a diverse global customer base across industry segments including telecommunications, software, finance, insurance, healthcare, construction, and education. For more information, visit www.cloudsphere.com
About Dimensional Research
Dimensional Research® provides practical market research for technology companies. We partner with our clients to deliver actionable information that reduces risks, increases customer satisfaction, and grows the business. Our researchers are experts in the applications, devices, and infrastructure used by modern businesses and their customers. For more information, visit www.dimensionalresearch.com.