While businesses are increasingly turning to the cloud to store data, a new global study from Thales, along with research from the Ponemon Institute, found that only a third (32%) of businesses use security first. to store data in the cloud.
To compile its 2019 Thales Global Cloud Security Study, the company surveyed more than 3,000 IT and IT security professionals from Australia, Brazil, France, Germany, India, Japan, the United Kingdom and the United States. Of the companies surveyed, only one in three (31%) believe that data protection in the cloud is their responsibility.
The Thales study found that almost half (48%) of companies applied a multi-cloud strategy, with AWS, Microsoft Azure and IBM as the top three cloud providers. On average, companies use three different cloud service providers, with 28% using four or more.
Despite storing sensitive data in the cloud, nearly half (46%) of respondents indicated that storing consumer data in the cloud makes it a greater security risk, with 56% saying this also represents a risk in accordance. Additionally, companies estimate that cloud service providers bear the greatest responsibility for sensitive data in the cloud (35%), shared responsibility (33%), and themselves (31%).
Although companies stress cloud providers' responsibility for securing cloud data, only 23% of respondents said security was an important factor in choosing a cloud service.
lack of encryption
Thales found that just over half (51%) of businesses and other organizations were still not using encryption to protect their sensitive data in the cloud. However, the study found regional disparities in data security, with German companies being the most advanced in their use of encryption (66%).
The study also revealed that companies have started handing over the keys to their encrypted data to cloud providers. Nearly half of cloud companies (44%) provide encryption keys when data is stored in the cloud, versus internal teams (36%) and third parties (19%). Furthermore, 53% of cloud service providers control these encryption keys themselves, while 78% of them feel it is important for their business to retain control of these keys.
54% of respondents believe that cloud storage makes it more difficult to protect sensitive data, up 49% from last year.
Tina Stewart, Vice President of Market Strategy for Cloud Protection and Licensing Activities at Thales, provided additional information on the study results, stating:
"This study shows that today's businesses are taking advantage of new cloud options, but are not adequately addressing data security." Having shifted the responsibility onto cloud providers, it is surprising to see that security is not a major factor in the selection process. No matter which model or provider you choose, the security of your company's data in the cloud should be your responsibility. The reputation of your business is at stake when a data breach occurs. Therefore, it is essential to ensure that internal teams closely monitor their security posture and always remain in control of encryption keys. "