Compromised cloud (opens in new tab) accounts cost organizations millions each year, a new report from cybersecurity firm Proofpoint and IT security research organization Ponemon Institute claims.
Part of the problem surrounds the fact that many don’t know who is responsible for safeguarding that data. At the same time, criminals are increasingly eyeing up cloud as a treasure trove of sensitive data.
Average cost
The average cost of cloud account compromises has gone up to $6.2 million in the last 12 months, the report says, adding that for the 600 IT and IT security pros that were polled, account takeover presents a “significant security risk”. The frequency and severity of these incidents increased over the course of the last year, as well.
In the past 12 months, companies suffered 64 cloud account compromises on average, with 30 percent having sensitive data exposed. Criminals are mostly interested in Microsoft 365 and Google Workspace accounts, and deploy various phishing techniques to obtain the credentials.
Less than half of the poll’s respondents have clearly defined who is accountable for keeping cloud-based (opens in new tab) sensitive data secure and, to make matters worse, just about a third “vigilantly” conduct cloud app assessments before deploying anything.
According to the report, strong authentication and adaptive access controls should be essential in securing admission to cloud resources. Today, many organizations support multiple identity federation standards and agree that adaptive access controls are essential in order to protect those most at risk.
“The move to the cloud and increased collaboration requires a people-centric security strategy backed by a cloud access security broker (CASB) solution that is integrated with a larger cloud, email, and endpoint security portfolio,” said Tim Choi, VP Product Marketing at Proofpoint.
“Such an approach effectively addresses concerns like cloud account compromise, unauthorized access to cloud data, and cloud application governance. Organizations need clearly defined roles, established accountability, and a CASB solution that can be operationalized in hours—not weeks.”
