Cloud Could Triple Odds of $20M Data Breach
can triple a company’s chances of incurring a $20 million data breach. That’s according to research released on Wednesday by Ponemon Institute and cloud security firm Netskope.
The results of the study, “Data Breach: The Cloud Multiplier Effect,” indicate that IT and security professionals expect that moving their apps to the cloud will increase the potential that their companies will be hit by data breaches. And that means they’ll be on the hook for millions to clean up the mess.
Ponemon asked the 613 IT and security pros it surveyed in March to estimate the likelihood of a data breach involving 100,000 or more customer records at their organizations under current circumstances and how using more cloud services would change that probability. According to the report, an increased use of cloud services would triple the odds of a data breach.
Cost of a Data Breach
This report draws from Ponemon Institute’s May 2014 “Cost of a Data Breach” study that established a cost of $201.18 per lost or stolen customer record. So for a data breach involving 100,000 or more customer records the cost would be just over $20 million.
“Imagine then if the probability of that data breach were to triple simply because you increased your use of the cloud. That’s what enterprise IT folks are coming to grips with and they’ve started to recognize the need to align their security programs to account for it,” said Sanjay Beri, CEO and founder of Netskope.
Beri said that while there are many enterprise-ready apps available today, IT and security practictioners are worried about the damage from risky apps. “Rewriting this story requires contextual knowledge about how these apps are being used and an effective way of mitigating risk,” he added.
Vote of No Confidence
Across the board, the survey respondents said they believed that their corporate and customer data are less secure when the use of cloud services increases. Additionally, the IT and security professionals said their networks were running cloud services unknown to them; they were not aware of the security practices of their cloud service providers; and they believed that their organizations were not paying enough attention to deploying and monitoring security programs. What does that all mean? The general perception is that the probability of a data breach is increasing in today’s IT environment, according to the report.
One Will Get You Three
Respondents estimated that every 1 percent increase in the use of cloud services will result in a 3 percent higher probability of a data breach, meaning an organization using 100 cloud services would only need to add 25 more to increase the likelihood of a data breach by 75 percent.
More than two-thirds (69 percent) of respondents believed that their organizations are not proactive in assessing information that is too sensitive to be stored in the cloud. Sixty-two percent of respondents indicated that the cloud services their companies are using are not thoroughly vetted for security before deployment .
Almost three-quarters (72 percent) of respondents believed their cloud services providers would not notify them immediately if they had data breaches involving the loss or theft of their intellectual property or business confidential information. And 71 percent believed they would not receive immediate notifications following breaches involving the loss or theft of customer data.
The IT and security professionals surveyed said they believed 45 percent of all software applications used by their organizations are in the cloud, but IT did not have visiblity into exactly half (22.5 percent) of these applications. In addition, although the respondents estimated that 36 percent of business critical apps are based in the cloud, they said IT lacked visibility into nearly half of them.