Palo Alto Networks (NYSE: PANW), has released a report that uncovers the truth about the state of cloud security among large enterprises across Asia-Pacific including Australia, with many cases where perception doesn’t match the reality when it comes to securing the cloud.
Conducted by Ovum Research, the report shows that large enterprises, defined as those with more than 200 employees, are not prepared for cloud-related cybersecurity threats, and more importantly, make the assumption that public cloud is secure by default. In fact, 56 per cent of security decision-makers in large Australian enterprises believe that security provided by their cloud service providers is sufficient to protect them from cloud-based cyber threats.
“Organisations need to recognise that cloud security is a shared responsibility,” said Sean Duca, vice president and regional chief security officer, Asia-Pacific and Japan at Palo Alto Networks. “While cloud providers are responsible for the security of their infrastructure, the onus is on companies themselves to secure their data and applications stored in that infrastructure.”
Large organisations have many security tools, but lack a unified view of security
Among the Australian companies surveyed, 52 per cent operate with more than 10 security tools to secure their cloud. However, having numerous security tools creates a fragmented security posture, adding further complexity to managing security, especially if the companies are operating in a multi-cloud environment. The multi-cloud approach creates a dangerous lack of visibility that is prevalent in 69 per cent of large organisations in Australia, according to Ovum.
The report highlights the ubiquity of multi-cloud deployments in large organisations that calls for a unified view of all cloud-native services, and recommends it is ideal for organisations to have a central console that uses technologies such as artificial intelligence to help prevent known and unknown malware threats, and quickly remediate accidental data exposure when it arises.
Large organisations lack cloud security audits and training
The need for automation is further underscored by the study, which revealed that large enterprises do not have enough time and resources to dedicate to cloud security audits and training.
87 per cent of organisations have either never conducted a security audit or do not do it on a yearly basis. Furthermore, more than quarter of audits do not include cloud assets and 79 per cent of organisations conduct internal audits only. Besides audits, there is also inadequate cloud security training for both IT and non-IT staff. More than two thirds (68 per cent) of Australian organisations do not provide cybersecurity training to IT security employees on a yearly basis. It is, therefore, not surprising that staff outside of IT departments receive even less training – 86 per cent of non-IT professionals do not receive cybersecurity training on a yearly basis.
Despite organisations’ inability to provide more frequent audits and security training for IT teams and employees, it is encouraging to see 37 per cent of Australian organisations surveyed use threat intelligence and analytics to identify new threats and take necessary action. A further 16 per cent of Australian organisations have also equipped themselves with real-time threat monitoring capabilities.
In order to be truly secure in cloud environments, it is pertinent for organisations in Asia-Pacific to be cognisant of cloud security best practices, which include:
- Building security into the cloud environment from the get-go; security should be an enabler to accelerate cloud adoption.
- Developing consistent security policies across all types of cloud deployments, which can be implemented properly through the help of tools that provide a unified view of all cloud assets and the threats they face.
- Allowing for frictionless deployment and easy scalability in multi-cloud environments, bridging the gap between highly controlled security teams and highly agile development teams.
- Increasing audits and training for employees, both IT and non-IT.
- Automating threat intelligence with natively integrated, data-driven, analytics-based approaches (leveraging machine learning/artificial intelligence) to avoid human error.
Asia-Pacific Cloud Security Study can be downloaded here: https://www.mysecuritymarketplace.com/product/asia-pacific-cloud-security-study/
