Almost all cloud applications are ‘insecure’ shows research

Nearly all business cloud applications lack enterprise grade security and compliance features, according to research.

An analysis of more than 15,000 enterprise cloud apps in use and 108 million enterprise documents stored and shared within them, has shown up the security failings of cloud working across enterprises and governments.

The research from web security firm Blue Coat, which is currently being acquired by Symantec, analysed the 15,000 apps and found that “99 percent do not provide sufficient security, compliance controls and features to effectively protect enterprise data in the cloud”.

Additionally, the report revealed that “shadow data” – un-managed content employees store and share across cloud apps – continues to remain a “major threat”, with 23 percent of it being broadly shared among employees and external parties.

The report also found that organisations are running 20 times more cloud apps than they estimate, with most using an average of 841 across their extended networks.

“The vast majority of business cloud apps we analysed do not meet enterprise standards for security and can put companies at risk even though virtually every enterprise uses them,” said Aditya Sood, director of security and Elastica Cloud Threat Labs at Blue Coat.

“This is troubling when you think about the financial risks faced by enterprises due to insecure or non-compliant apps. Understanding which cloud applications your employees are adopting and using is an important step to identifying which apps are business ready, and which apps need to be replaced with more secure alternatives.”

With the adoption of the General Data Protection Regulation (GDPR), the European Commission has provided a standard for cloud application security and compliance, said Blue Coat. But Blue Coat found that 98 percent of the cloud apps it analysed are “not GDPR ready”.

Other findings of the research:

● 12 percent of broadly shared documents and files contain regulated information and confidential data such as source code and legal information
● 95 percent of enterprise-class cloud apps are not SOC 2 compliant
● 37 percent of suspicious cloud activity indicates attempts to hack into user cloud accounts
● 71 percent of business cloud apps do not provide multi-factor authentication
● 11 percent of enterprise cloud apps are still vulnerable to one or more major exploits such as FREAK, Logjam, Heartbleed, Poodle SSLv3, Poodle TLS and CRIME

@AntonySavvas