Cybersecurity-2019年云安全报告（英文）-2020.4-20页_1mb

2019 Cloud Security Report Summary

Core Content

The 2019 Cloud Security Report by Cybersecurity Insiders highlights the ongoing challenges and concerns faced by organizations in securing their cloud environments. Despite the rapid adoption of cloud computing for its efficiency, scalability, and agility, security teams are still struggling with several critical issues, including data loss, unauthorized access, and compliance. The report also explores the factors driving the adoption of cloud-based security solutions and the barriers preventing it.

Main Points and Key Information

Cloud Security Concerns

• Data loss and leakage is the top concern for cybersecurity professionals, with 64% identifying it as a major issue.
• Unauthorized access (42%) and insecure interfaces/APIs (42%) are the biggest perceived vulnerabilities to cloud security.
• Misconfiguration of the cloud platform (40%) and account hijacking (39%) follow closely.
• Data privacy/confidentiality (62%) is also a significant concern.
• Compliance (39%) and accidental exposure of credentials (39%) are the top operational security headaches for SOC teams.

Confidence in Cloud Security Posture

• 84% of organizations express at least moderate confidence in their cloud security posture.
• However, this confidence is not always supported by the actual security incidents and challenges they face.

Traditional Security Tools in the Cloud

• 66% of respondents report that traditional security tools either don’t work in cloud environments or have limited functionality.
• 34% of organizations say all capabilities work in the cloud.

Drivers of Cloud-Based Security Solutions

• Cost savings (42%) is the top driver for adopting cloud-based security solutions.
• Faster time to deployment (39%) and better performance (34%) are also key factors.
• Other drivers include reduced effort for patches and upgrades (31%), secure app access from any location (30%), and meeting cloud compliance expectations (29%).

Barriers to Cloud Adoption

• Data security, loss & leakage risks (29%) and general security risks (28%) are the top barriers to cloud adoption.
• Lack of budget (26%), compliance challenges (26%), and lack of qualified staff (26%) also rank high.
• Additional barriers include loss of control, complexity managing cloud deployment, fear of vendor lock-in, and lack of transparency and visibility.

Paths to Stronger Cloud Security

• Training and certifying IT staff (51%) is the primary tactic used by organizations to address evolving security needs.
• Using native cloud provider security tools (45%) is also widely adopted.
• Partnering with managed security services providers (MSSP) (30%) is a common approach.
• Hiring dedicated cloud security staff (29%) and deploying security software from independent vendors (27%) are also used strategies.

Security Training and Certification

• 61% of organizations believe their employees would benefit from security training and/or certification.
• Cloud-enabled cybersecurity (49%) is the most valued training topic, followed by application security (41%) and incident response (34%).
• The top 10 most valued security certifications include CISSP, CCSP, CISM, CCSK, Security+, CISA, CEH, Network+, CCISO, and Cloud+.

Most Critical Cloud Security Skills

• Knowledge of cloud-specific security tools (47%) is the most critical skill.
• Incident response skills (43%) and knowledge of normal network/system operations (43%) are also highly valued.
• Other critical skills include knowledge of critical internal processes, malware analysis, intelligence analysis, and identifying social engineering/phishing.

Methodology and Demographics

• The report is based on a comprehensive online survey of 400,000+ cybersecurity professionals conducted in March 2019.
• Respondents include technical executives, IT security practitioners, and IT operations professionals from organizations of varying sizes across multiple industries.

(ISC)²

• (ISC)² is an international nonprofit organization celebrating its 30th anniversary.
• It is best known for the CISSP® certification and has partnered with the Cloud Security Alliance (CSA) to launch the CCSP® certification.
• The CCSP® is the #1 cloud security certification, with 51% of organizations wanting to train and certify their current IT staff.
• 27% of organizations plan to hire dedicated cloud security staff.

Conclusion

The report underscores the need for organizations to reassess their security strategies, invest in training and certification, and adopt modern cloud security solutions to address the evolving threat landscape. While cloud computing offers numerous benefits, the challenges of securing data, managing compliance, and ensuring visibility remain significant.