cloud adoption & risk in north america & europe

CLOUD
ADOPTION & RISK
CLOUD ADOPTION
& RISK
REPORT
IN
NORTH
AMERICA
FOR
NORTH AMERICA & EUROPE
&
EUROPE
2014 Trends
333 W. San Carlos Street
San Jose, CA 95110
EXECUTIVE SUMMARY
Few advances come close to the power of cloud computing to re-chart the
path of enterprise IT. With faster time to market, massive economy of scale,
and unparalleled agility, the cloud is being adopted by enterprises at an
unprecedented rate.
At the same time, however, few organizations have a strategic and coherent approach to
managing cloud security and risk. Limited visibility, uncertain responsibility boundaries,
and the lack of effective governance frameworks have all contributed to the current
state of the art. As one Fortune 500 company CISO puts it: “Go to the cloud and hope
for the best.”
This report, with insights drawn from
CipherCloud’s customers and our extensive
cloud risk knowledge base, helps to shed
light on enterprise cloud usage, risks
observed, and geo-specific trends. This
report includes anonymized data of cloud
user activity collected for the full 2014
calendar year, spanning thousands of cloud
applications and millions of enterprise
cloud users.
Organizations vastly
underestimate the level
of Shadow IT.
Our findings suggest that organizations vastly underestimate the level of Shadow IT
when it comes to cloud adoption. As a result, hundreds of high-risk cloud applications
are in common use across North America and European enterprises.
To achieve governance, it is imperative that organizations build the necessary legal and
technological infrastructure to address cloud risks. This report discusses key points of
focus for enterprise IT in order to address the competing tensions between business
efficiency and security control and visibility.
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
CipherCloud | © 2015
02
Key Findings
• The average global enterprise utilizes over 1,100
cloud applications
Our study found widespread cloud adoption across North America and
Europe. In our 2014 data, a typical North America enterprise used over 1,245
cloud applications while those in Europe used 981 applications on average.
• 86% of cloud applications used by enterprises are unsanctioned
“Shadow IT”
Our study found that enterprises vastly underestimate the extent of Shadow IT
cloud applications used by their organizations. Various media sources claim
10% to 50% of cloud applications are not visible to IT. Our statistics show
that on average 86% of cloud applications are unsanctioned. For example,
a major US enterprise estimated 10–15 file sharing applications were in use,
but discovered almost 70.
• Publishing, Social, and Career clouds are 2014’s most
risky cloud categories
Our research rated 52% of applications in Publishing as high risk. Similarly,
42% in Social and 40% in Career clouds are rated as high risk. These three
represent the highest risk across all cloud applications.
• Europe is narrowing the gap of cloud adoption to North America
Contrary to widespread beliefs that Europe lags North America significantly
in cloud adoption, our research found that European enterprises leverage
the cloud just as extensively as North America—an average European
organization used 80% as many cloud applications in 2014, distributed across
similar application categories.
• 70% of US cloud applications used by European organizations are
not “Safe Harbor” approved
In our data set, we found that only 9% of the clouds used by European
enterprises were either Europe-based or in European-approved data
transfer regions; 21% were US clouds and Safe Harbor approved. The rest, a
whopping 70%, were US clouds without Safe Harbor certification.
03
CipherCloud | © 2015
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
03
The CipherCloud Risk Model
CipherCloud is committed to providing enterprises with accurate risk ratings
based on open standards, a transparent process, and the most current risk factors.
The CipherCloud Risk Intelligence Lab™ uses the principles of transparency,
community, and alignment with standards to provide extensive research,
automated testing, and expert analysis of cloud application risks.
SECURITY
• Multi-factor
•
•
•
•
•
•
Authentication
Single Sign-On
Encryption of
data-at-rest
SSL/TLS
Landing domain
Login domain
HTTP headers
PRIVACY
• Privacy policy
• Cookie policy
• Data retention
•
•
•
•
Data ownership
Third-party
access
Business
Transactions
Privacy
Compliance
Data Residency
ENVIRONMENT
• Location
• Service Level
Agreement
• Disaster
recovery
• Multi-tenancy
• Type of usage
• Control of
environment
• Data breaches
COMPLIANCE
•
•
•
•
•
•
•
•
•
•
Safe Harbor
Comodo
ISO 27001
PCI AoC
HIPAA
FedRAMP
CSA CCM
SAS 70
SSAE16
SOC 1, 2, 3
Figure 1: CipherCloud risk model components.
The CipherCloud Risk Intelligence Lab™ analyzes tens of thousands of cloud
applications globally in the compiling its CloudSource™ knowledge base.
CipherCloud utilizes a standards-based model for cloud risk scoring, with over
100 attributes across four risk categories: Security, Privacy, Environment and
Compliance. The cloud risk model includes security controls defined by the Cloud
Security Alliance Cloud Control Matrix, Privacy best practices detailed by TRUSTe,
and industry and regulatory standards such as HIPAA and PCI DSS. Figure 1
provides a more detailed view of the attributes used in our cloud risk model.
CipherCloud examines factors such as whether the cloud application uses multifactor authentication, whether data stored in the cloud is encrypted, the location of
cloud data centers, third-party data access, and compliance certifications. All risk
attributes are independently verified by our staff of expert researchers. Risk scores
range from 1 (lowest risk) to 10 (highest risk).
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
CipherCloud | © 2015
04
Cloud Computing Is Transforming the Global
Enterprise Right Under Our Eyes
CipherCloud research found that enterprises in both North America and Europe
are leveraging cloud applications extensively. An average global enterprise uses
over 1,000 distinct cloud applications (see Figure 2). The number of applications
used in North America (1,245) is slightly higher than that in Europe (981).
Global Average Category Cloud Count
Email
27
Finance
27
Publishing
35
Education
37
Communication
38
HR
52
Business
Management
61
CRM
89
E-Commerce
114
Analytics
126
Software
Development
129
Cloud Storage
136
Media
140
IT Infrastructure
163
Marketing
196
Collaboration
211
Social
254
0
75
150
225
300
Figure 2: Average number of cloud applications accessed globally by enterprises by category.
Figure 2 shows the global average ranking of cloud applications by popularity.
Social, Collaboration, Marketing, and IT infrastructure are the most popular cloud
categories—an average enterprise uses approximately 100 different applications in
each of these categories.
05
CipherCloud | © 2015
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
05
Enterprises Underestimate the Extent of Shadow IT
We all know that the use of Shadow IT within businesses is exploding, but few
enterprises have been able to accurately assess the extent of the problem. Selfreported surveys of the percent of enterprises using cloud services range from as
low as 19%1 to 50%—clearly ignoring Shadow IT. Other surveys have shown as many
as 80%1 of end-users admitting to using unsanctioned applications, but without any
measurements of actual usage.
CipherCloud worked closely in 2014 with large enterprises globally to discover
all cloud applications in use, and compare them with internal metrics of what is
approved. The chart below compares IT approved applications with Shadow IT
across North American and European enterprises.
69%
43%
ia
c
Co
tu
re
lla
bo
r
a
So
ftw tion
ar
e
De
v
fra
st
ru
ed
M
c ia
19% 18%
IT
In
ke
tin
ar
M
Co
m
m
ag
Figure 3: IT-approved applications vs. Shadow IT globally in 2014.
d
St
or
Total
E-
14%
ou
18%
Europe
Cl
12%
North America
l
34% 34% 27% 22%
g
86%
82%
80%
70%
60%
50%
40%
30%
20%
10%
0%
e
er
ce
88%
Shadow IT
So
IT-Approved
100%
90%
80%
70%
60%
50%
40%
30%
20%
10%
0%
Figure 4: Cloud applications discovered by a major
enterprise by category.
Specific anecdotes also help to illustrate the problem. A major US enterprise used
CipherCloud to discover all their cloud applications in use. They expected to find
8–10 applications being used for file sharing, and were very surprised to find 69
separate applications in use for file sharing, with a large number of high-risk clouds.
Eurostat survey of enterprise cloud adoption for 2014 (http://ec.europa.eu/eurostat/statistics-explained/index.php/Cloud_computing_-_statistics_
on_the_use_by_enterprises)
2
Frost & Sullivan—The Hidden Truth Behind Shadow IT: http://www.mcafee.com/us/resources/reports/rp-six-trends-security.pdf
1
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
CipherCloud | © 2015
06
Publishing, Social and Career Clouds
Are 2014’s Top Three Most Risky Cloud Categories
Information workers frequently use publishing, social, and career cloud applications
to do their jobs, often with great effect. However, our research showed that in 2014
these three categories comprise the top three most risky clouds: Our intelligence lab
rated 52% of Publishing cloud applications as high risk. Similarly, 42% in Social and
40% in Career clouds are deemed high risk.
Software Development, Cloud Storage, IT Infrastructure, CRM, HR and Business
Management categories also had significant percentages of applications with an
overall risk score of 8 or higher (22%–36%).
Security
11%
Email
13%
Productivity
17%
Analytics
18%
Collaboration
19%
Communication
20%
Finance
20%
Software
Development
22%
IT Infrastructure
24%
Cloud Storage
24%
Events
29%
CRM
29%
HR
31%
Marketing
36%
Business
Management
36%
E-Commerce
37%
Media
39%
Careers
40%
Social
47%
Publishing
52%
0%
Examples of the types of
applications in the top categories:
15%
30%
45%
60%
• Publishing: Wordpress,
Adobe Creative Cloud
• Social: LinkedIn, Twitter
• Careers: Indeed, Resumonk
Figure 5: Top 20 cloud application categories by percentage of high risk cloud providers.
07
CipherCloud | © 2015
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
07
Europe Narrows the Gap in Cloud Adoption
Contrary to conventional wisdom that Europe lags North America in cloud
adoption, CipherCloud research found that European enterprises have largely
caught up to US in cloud usage. More specifically, we found that top cloud
applications used by European enterprises are in largely the same categories
as those used in North America, albeit European companies use 80% as many
applications on average (see Figure 6). For example, North America organizations
used an average of 94 IT Infrastructure applications, compared with 69 in Europe.
Similarly, North America companies used on average 68 analytics clouds and
Europe used 58.
This may have to do with the fact that Europe’s cloud application market is
projected to grow faster than North America through 2018. One analyst firm
estimates that Europe will grow at a 19.1% CAGR while North America will grow
at a 15.9% CAGR3.
Finance
29
41
Business
Management
18
43
CRM
34
E-Commerce
51
Software
Development
64
Analytics
58
68
Cloud Storage
59
77
Media
63
IT Infrastructure
69
Marketing
82
Collaboration
85
Social
113
0
EU AVG. Category Cloud Count
NA AVG. Category Cloud Count
55
63
65
77
94
114
126
141
75
150
225
300
Figure 6: Average number of cloud applications accessed by North American
and European enterprises by category.
3
Apps Run the Cloud: https://www.appsrunthecloud.com/opinions/index/150
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
CipherCloud | © 2015
08
European Enterprises Are as Cloud-Risky as
Those in North America
CipherCloud found that an average North American enterprise uses 1,245 cloud
applications while 981 applications were found in use by an average European
firm. With that many cloud applications, an average of 56 high-risk clouds per
organization were found in North America and 42 high-risk ones per organization
were found in Europe. Perhaps more alarmingly, in both North America and
Europe, over 300 users per organization were found using high-risk clouds in 2014
(see Figure 7).
Figure 7 also depicts a break down between high-, medium-, and low-risk clouds
in use by both geos. A similar pattern was observed throughout, with the
exception that a higher percentage of medium-risk clouds were used in Europe
vs. North America.
North American Cloud
Application Usage Trends
1,245
56
391
European Cloud
Application Usage Trends
981
42
307
Average # of cloud apps
per organization
Average # of high risk
clouds per organization
Average # of high risk
cloud users per organization
NA Cloud Application
Risk Distribution
All Clouds
EU Cloud Application
Risk Distribution
All Clouds
4.5%
4.3%
15%
24.6%
high
medium
80.5%
71.2%
low
Figure 7: Comparisons of average cloud applications
accessed by North American and European enterprises,
along with breakdowns of risk levels.
Figure 7 shows a deeper look at each cloud application category used in North
America and Europe, as well as the associated risk scores. Overall, the categories in
use and the risk scores are fairly comparable between the two regions, with a few
exceptions. For example, the average risk score for software development clouds
used by North America (5.15) is noticeably higher than those used in Europe (4.81),
even though both regions used a similar number of cloud applications for software
development. In contrast, communication clouds used by European companies
carry a higher average risk score (5.25) than those used by North America (4.86).
09
CipherCloud | © 2015
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
09
6.00
4.33
4.66
4.54
4.81
4.81
5.00
5.03
5.00
4.50
5.18
5.08
5.07
5.25
5.30
5.32 5.35
5.73
5.83
120
90
EU Avg. Category Risk Score
EU Avg. Category Count
4.51
4.53
4.88
4.79
5.02
5.06
5.12
5.15
5.25
82
Co m
5.28
5.39
5.30
5.72
18
0
Bu
Mana siness
geme
nt
CRM
5.45
5.52
6.00
4.87
34
M a rk
eting
113
l
23
munic
16
Socia
e
51
merc
rastru
63
IT Inf
Publi
Cloud
tics
69
E- Co
m
59
Stora
ge
15
shing
58
Analy
64
So
Deve f tware
lopm
ent
Educ
a
ce
Colla
16
tion
85
b o ra t
ion
29
Finan
12
Email
0.00
HR
30
ation
1.50
Media
60
c ture
3.00
5.87
4.50
160
120
NA Avg. Category Risk Score
NA Avg. Category Count
43
114
Bu
Mana siness
geme
nt
M a rk
eting
141
l
20
Socia
55
shing
21
Publi
29
Educ
a
77
HR
65
So
Deve f tware
lopm
ent
Cloud
Stora
ge
rastru
c ture
94
IT I n f
77
merc
63
E- Co
m
tics
68
Analy
munic
ation
22
Co m
borat
ion
126
Colla
Finan
15
Email
41
ce
0.00
CRM
40
tion
1.50
Media
80
e
3.00
0
Figure 8: Comparison of commonly used cloud application categories in Europe (top) and North
America (bottom), as sorted by the average risk score per category.
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
CipherCloud | © 2015
10
European Companies Are Not Enforcing
“Safe Harbor” Principles with Cloud Applications
European Union data privacy laws require that transfers of personal information
be restricted to European Union member states, or countries approved by the
European Union for international data transfer. The US does not have country-wide
approval, but US businesses can become Safe Harbor compliant by following seven
fundamental data protection principles, and hence become eligible to handle
transfers of personal data from European territories.
By Law, European organizations can only transfer personal data to US businesses
that are “Safe Harbor” certified. In practice, however, this seems to have little impact
on actual cloud usage by enterprise users. CipherCloud research found that 70%
of cloud applications used by European organizations are based in the US and not
Safe Harbor approved. Only 9% of applications accessed were based in Europe and
approved data transfer regions while 21% were US “Safe Harbor” compliant clouds.
This trend likely corresponds with Shadow IT. Enterprise-sanctioned cloud
applications used in Europe are more likely to be Safe Harbor certified, while those
accessed directly by end-users appear to be largely non-compliant.
A 2013 study by the European Union Commission found that the US-EU Safe Harbor
principles are not well enforced; over 30% of Safe Harbor certified providers violate
at least one of the Safe Harbor principle requirements.
21%
100,000
User Count
75,000
50,000
69%
25,000
9%
0
0%
12.5%
25%
37.5%
50%
Traffic Volume
EU Safe Harbor Compliance (45 days of user activity)
EU Safe
Harbor Certified
Cloud App
Count (%)
Total Traffic
Volume (%)
EU-based
9%
8%
10204
YES*
21%
42.4%
98716
NO*
69%
49.6%
46307
Total Users*
Figure 9: Distribution of EU-based, Safe Harbor-certified,
and non-Safe Harbor cloud applications.
*US-EU Safe Harbor is a streamlined process for US companies to comply with the European Union
Directive 95/46/EC on the protection of personal data. The Safe Harbor Privacy Principles allow US
companies to register their certification if they meet the European Union requirements via the US
Department of Commerce.
11
CipherCloud | © 2015
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
11
Call to Action
Cloud computing offers organizations a rare chance to challenge the status quo in
technology delivery methods and has already had a global impact on the traditional
IT stack. To unlock the power of the cloud and at the same time effectively manage
the tension between business efficiency and enterprise controls, CipherCloud
recommends these strategic areas of focus:
1. Designate cloud security as a strategic area of IT security
2. Enhance cloud situational awareness and improve your cloud governance posture
3. Establish a systematic, integrated technological approach to support your
governance needs
To support these goals, firms should undertake the following immediate actions:
• Develop a multi-faceted cloud governance and control framework:
Combine commercial best practices, regulatory obligations, and line-of-business
requirements to form a sustainable cloud governance strategy. As part of
this governance strategy, take a deep dive into your cloud user activities by
department and business function, and understand the business needs for each
cloud application. Balance these needs with your regulatory requirements to
develop a practical and meaningful control framework.
• Establish integrated technologies to discover, protect, and monitor cloud
usage: Discover who is doing what with which cloud applications is only the first
step. You need to make sure that you have ongoing means to manage cloud
access and exert continuous controls. In addition, your controls need to be
granular enough to meaningfully limit your data exposure to the cloud without
hindering cloud functionality. Most importantly, discovering, protecting, and
consistently monitoring should be integrated functions rather than discrete
capabilities that you have to manage separately.
• Be proactive in your cloud management strategies: Do you have a way to enhance
cloud literacy across your organization both in terms of risk education as well as best
practices? Can you utilize your user access pattern to guide and optimize your cloud
adoption? Do you have a way to consolidate redundant applications and can you
effectively migrate users from risky apps to approved ones?
“Never again should it be possible to say
‘We didn’t know’ or ‘we were surprised,.”
“No data movement to and from the
cloud and everywhere in between should
be invisible and uncontrolled.”
These are the statements from practitioners living in the world of cloud
transformation and this is the reality that CipherCloud is here to enable.
Cloud Adoption & Risk Report for North America & Europe: 2014 Trends
CipherCloud | © 2015
12
About CipherCloud for Cloud Discovery
CipherCloud for Cloud Discovery makes it simple and cost effective to continuously
discover and categorize all the cloud applications users are accessing, identify
the risks for each application, and analyze the impact on the company’s network
resources and compliance posture. Intuitive drill-down dashboards provide detailed
information on the top cloud applications being accessed by number of events, data
volume, and risk level.
Our rich knowledge base, CloudSource™, supports a growing list of thousands
of applications. CloudSource tracks more than a 100 granular risk metrics across
security, privacy, compliance, environment and legal categories for each application.
Also, CipherCloud for Cloud Discovery is unique because it does not require you to
share sensitive log data outside the organization. The solution is built on a popular
and highly extensible platform, enabling detailed analysis of logs from proxy servers
and firewalls.
Risk Status Overview
CipherCloud, the leader in cloud visibility and data protection, delivers cloud adoption
while ensuring security, compliance and control. CipherCloud’s open platform provides
comprehensive cloud application discovery and risk assessment, data protection—
searchable strong encryption, tokenization, data loss prevention, key management
and malware detection—and extensive user activity and anomaly monitoring services.
CipherCloud is experiencing exceptional growth and success with over 3 million
business users across 11 different industries.
Headquarters:
CipherCloud
333 West San Carlos Street
San Jose, CA 95110
www.ciphercloud.com
linkedin.com/company/ciphercloud
@ciphercloud
[email protected]
1-855-5CIPHER (1-855-524-7437)
The CipherCloud product portfolio protects popular cloud applications out-of-thebox such as Salesforce, Box, Microsoft Office 365, and ServiceNow.
Named SC Magazine’s 2013 Best Product of the Year, CipherCloud’s technology
is FIPS 140-2 validated and the company is backed by premier venture capital firms
Transamerica Ventures, Andreessen Horowitz, Delta Partners, and T-Venture,
the venture capital arm of Deutsche Telekom. For more information,
visit www.ciphercloud.com and follow us on Twitter @ciphercloud.
WP-CC-RN-20150202
CipherCloud | © 2015
All trademarks
are property
of their
respective
owners.
Guide
to Cloud
Data
Protection

Download Report