CRP-2017年云计算安全报告（英文）-37页-3mb

CLOUD SECURITY REPORT SUMMARY

Core Content

The 2017 Cloud Security Report explores how organizations are responding to security threats in the cloud and highlights the tools and best practices they are considering for cloud migration. It emphasizes the growing adoption of cloud computing despite persistent security concerns, and outlines the challenges and solutions related to cloud security.

Main Points

• Cloud Adoption Trends:

  • 90% of organizations are in some stage of cloud adoption, with 49% already operating in a live cloud environment.
  • SaaS (67%) is the most popular cloud service model, followed by IaaS (50%) and PaaS (38%).
  • Email, customer data, and employee data are the most commonly stored types of corporate information in the cloud.
  • Microsoft Office 365 and Salesforce are the most widely used cloud applications.

• Cloud Security Concerns:

  • The top three security concerns are:
    • Data loss (57%)
    • Threats to data privacy (49%)
    • Breaches of confidentiality (47%)
  • Compliance concerns are a significant barrier, with 33% of respondents citing it as a major issue.
  • The biggest security management headaches are:
    • Visibility into cloud infrastructure (37%)
    • Compliance (36%)
    • Setting consistent security policies (33%)

• Cloud Security Challenges:

  • Organizations face challenges such as:
    • Lack of integration with on-premises security technologies (27%)
    • Inability to identify misconfigurations quickly (24%)
    • Limited visibility and control (24%)
    • Complex rule matching across environments (21%)
  • 78% of respondents believe traditional security tools are not well-suited for cloud environments.

• Cloud Security Solutions:

  • The most effective security controls are:
    • Data encryption (74%)
    • Network encryption (64%)
    • Access control (52%)
  • Popular application security measures include:
    • Penetration testing (60%)
    • Security monitoring (57%)
    • Web application firewalls (47%)
  • Key confidence builders for cloud adoption include:
    • Data encryption (51%)
    • Setting and enforcing security policies (49%)
    • Creating data boundaries (41%)

• Cloud Security Drivers:

  • The top drivers for cloud-based security solutions are:
    • Faster time to deployment (52%)
    • Reduced effort around patches and upgrades (43%)
    • Secure access from any location (34%)

• Cloud Access Security Broker (CASB):

  • CASB solutions are gaining traction, with 7% already deployed and 24% planning to deploy in 2017 and beyond.
  • CASB provides capabilities like authentication, single sign-on, and malware detection.
  • Deployment requires understanding of use cases and trained personnel.

• Cloud Security Strategies:

  • 53% of organizations plan to train and certify their current IT staff.
  • 30% plan to partner with a managed service provider.
  • 27% plan to leverage software solutions.
  • 26% plan to hire dedicated cloud security staff.

Key Information

• Budget Outlook: 33% of organizations expect to increase cloud security budgets over the next 12 months.
• Security Impact on DevOps: 37% of respondents say security slows down DevOps processes, with 19% noting that security is ignored.
• Security Perception: 58% of respondents believe cloud apps are as secure or more secure than on-premises apps, up from 52% last year.
• Compliance and Legal Issues: Compliance concerns are the top barrier for cloud messaging apps, with 27% citing it as the main issue.
• Identity Management: 73% of organizations use on-premises Active Directory as the authoritative directory for cloud application access.

Methodology and Demographics

• The report is based on a survey of over 1,900 cybersecurity professionals.
• Respondents include technical executives, managers, and IT security practitioners from various industries and company sizes.
• The survey provides a comprehensive view of the current state of cloud security practices and challenges.

Sponsors

• The report is sponsored by:
  • AlienVault
  • Bitglass
  • CloudPassage
  • Cloudvisory
  • Dome 9
  • Eastwind Networks
  • Evident.io
  • (ISC)2
  • Quest
  • Skyhigh
  • Tenable

Contact

• Holger Schulze
  • Founder, Information Security Community on LinkedIn
  • Email: hhschulze@gmail.com

Conclusion

The report underscores the need for new security approaches and tools to address the unique challenges of cloud environments. It highlights that while cloud adoption is increasing, security remains a critical concern. Organizations are prioritizing training, collaboration with managed service providers, and the adoption of cloud-specific security solutions to enhance their cloud security posture.