McAfee released its Cloud Adoption and Risk Report, which analysed billions of events in anonymised customers production cloud use to assess the current state of cloud deployments and to uncover risks. The report revealed that nearly a quarter of the data in the cloud can be categorised as sensitive, putting an organisation at risk if stolen or leaked. Coupled with the fact that sharing sensitive data in the cloud has increased 53 percent YoY, those who do not adopt a cloud strategy that includes data loss protection, configuration audits and collaboration controls, will endanger the security of their most valuable asset—data—while exposing themselves to increased risk of noncompliance with internal and external regulations.

The study found that while organisations aggressively use the public cloud to create new digital experiences for their customers, the average enterprise experiences more than 2,200 misconfiguration incidents per month in their infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) instances. Cloud service providers only cover the security of the cloud itself, not customer data or customer use of their infrastructure and platforms. Companies are always responsible for securing their data wherever it is, hence highlighting the need to deploy cloud security solutions that span the whole cloud spectrum, from SaaS (software-as-a-service) to IaaS and PaaS.

Cloud collaboration is a blessing and a curse at the same time as organizations often share links externally which expose sensitive data. Besides that, risks of misconfiguration is at stake with IaaS as customers take on a much larger share of security responsibility that includes data, identity, access, applications, network controls and host infrastructure. While this provides customers with an opportunity to have greater control over their cloud infrastructure, it also increases the organisation’s surface area for security risks and their responsibility for the same. Clouds are also exposed to compromised account threats; therefore, organisations should understand how cloud services are used. They should also identify anomalous behaviour, such as when the same user accesses the cloud from disparate locations simultaneously.

“Operating in the cloud has become the new normal for organisations, so much so that our employees do not think twice about storing and sharing sensitive data in the cloud,” said Rajiv Gupta, senior vice president of the Cloud Security Business, McAfee.  “Accidental sharing, collaboration errors in SaaS cloud services, configuration errors in IaaS/PaaS cloud services, and threats are all increasing. In order to continue to accelerate their business, organisations need a cloud-native and frictionless way to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS.”