As many as 15 per cent, one in eight, of business users have had their cloud app credentials compromised, putting corporate data at risk, it is claimed. A report, which monitors enterprise cloud app usage and trends, also shows a continued increase in cloud app usage across enterprises, as well as the high volume at which files are being shared outside of a given organisation. The most used cloud apps are Google Drive, Facebook, Twitter, Youtube and Google Gmail, according to the Netskope Cloud Report. Download the report here: www.netskope.com/netskope-cloud-report.
A growing number of users log into business apps using compromised credentials that have been stolen as part of a data hack or exposure, due to a significant increase in data breaches and leaks from a host of major corporations, websites, and cloud apps. As many as 15pc of users have had their credentials compromised in a prior data exposure, and many of those users re-use passwords even to log into apps that contain business-sensitive information. This means that the likelihood of users logging into business-critical apps with these credentials is high, putting business-sensitive data at risk.
Enterprises are continuing to adopt cloud apps at a fast pace, with an average of 613 cloud apps per organisation in the last quarter of 2014, up from 579 the previous quarter. Based on aggregated, anonymised data from the Netskope Active Platform, which provides discovery, deep visibility, and granular control over any cloud app, the report’s findings are based on tens of billions of cloud app events seen across millions of users between October and December 2014. 88% of apps in use are not enterprise ready, scoring a “medium” or below in the Netskope Cloud Confidence Index (CCI). The report found more than 20pc of organisations in the Netskope cloud actively use more than 1,000 cloud apps, and 8pc of files in corporate-sanctioned cloud storage apps are in violation of data leak prevention (DLP) policies, including PHI, PCI, PII, source code, and other policies covering confidential or sensitive data.
Sanjay Beri, CEO and founder, Netskope, said: “2014 left an indelible mark on security — between ongoing high-profile breaches and the onslaught of vulnerabilities like Shellshock and Heartbleed, CSOs and CISOs had more on their plate than ever. These events underscore the sobering reality that many in the workforce have been impacted by data breaches and will subsequently use compromised accounts in their work lives, putting sensitive information at risk. Employees today have shifted from thinking of apps as a nice-to-have to a must-have, and CISOs must continue to adapt to that trend to secure their sensitive corporate and customer data across all cloud apps, including those unsanctioned by IT.”
Consumer, prosumer apps and line-of-business apps are all used heavily in enterprises, and the vast majority of apps in each of these categories are not enterprise-ready, according to the cloud product company. Marketing, Finance/Accounting and Human Resources were the categories with the highest number of non-enterprise ready cloud apps – those rating at a ‘medium’ or below in the CCI. The five cloud app categories with the highest volume of policy violations include Cloud Storage, Webmail, CRM and SFA, Social and Collaboration. DLP policy violations involving the upload of data outnumber violations involving the download of data by nearly three to one, while 8pc of content files contain DLP violations, irrespective of when content was uploaded. A quarter of all files are shared with one or more people outside of the organisation; 40pc are shared within the organisation and 35pc are private. Of external users who have links to content, nearly 12pc have access to 100 files or more.
