The number of cloud applications used by the typical company continued to rise in the fourth quarter of 2016, while malware spreading through shared data on cloud platforms grew as a threat, cloud-services management firm Netskope stated in its April 2017 Cloud Report.
The report, which covers that fourth quarter of 2016, found that the average number of cloud services used by enterprises grew 4 percent quarter-to-quarter to 1,071. Less than 7 percent of the services are explicitly created for business use and are considered enterprise-ready, Netskope said.
“From our experience, around 90 to 95 percent of cloud services that we find are unsanctioned services,” Jervis Hui, senior security strategist for the company, told eWEEK. “These are lines of businesses adopting niche apps for specific purposes, but without the knowledge of management.”
Employees are often driving company adoption of cloud applications and services and IT departments and information-security teams struggle to catch up. The problem of unsanctioned cloud usage—frequently referred to as ‘shadow IT’ leaves the company unaware that some cloud activities are leaving the business open to cyber-attacks.
Malware, for example, has started spreading through documents and files shared through cloud storage, collaboration environments and old-fashioned email. About three-quarters of the malware found on cloud services are considered high severity.
“Malware is becoming more prevalent in the cloud,” Hui said. “This might not be the major vector of attacks, but it is becoming more prevalent, because it is so easy to spread.”
More than 37 percent of malware detected in the cloud were some form of backdoor. While another 14 percent was adware. Ransomware, which has become a major threat to many businesses, only accounted for 4.2 percent of the malware detected on cloud services, Netskope said.
The mishandling of data is another threat to cloud users. For the first time, webmail has become the most significant vector through which data can leak, accounting for 40 percent of data-loss prevention (DLP) policy violations. Cloud storage—the long-time leader—accounted for 39 percent.
Finally, companies need to recognize that often cloud services are a platform of related services, not a single monolithic service. Microsoft’s Office 365, for example, goes beyond just the company’s productivity apps and OneDrive includes a variety of channels for sharing data, such as Yammer, SharePoint, Power BI and its CRM tool, Dynamics. More than half—57 percent—of all Microsoft usage fell outside of OneDrive for Business, Netskope found.
“Office 365 is not just OneDrive but all these connected apps,” he said. “We see this as an emerging kind of trend that needs to be addressed.” IT Managers definitely need to keep track of this trend, said Hui.