Faith in cloud security strengthens, but concerns persist

Dive Brief:

More than 60% of tech leaders say security risks are the same or lower in the cloud compared to on-premise solutions, according to cybersecurity solutions provider Nominet's survey of almost 300 CIOs, CISOs and CTOs.
For a time, CISOs held off cloud adoption because of a lingering belief the cloud was less secure, according to the report. While confidence is growing, 37% of respondents say the risk of a breach is higher in the cloud. However, cloud-based security with "better features" and lower cost encourage adoption.
Firewalls, email security and antivirus protection are the top three forms of cloud security among respondents. The majority of respondents (92%) reported they have begun or plan to begin using cloud-based security solutions.

Dive Insight:

Before the cloud became the foundation for enterprise IT, there was resistance in its adoption.

Security professionals were rooted in the belief cloud security ranked after on-premise security. Those beliefs are slowly disappearing, according to Nominet.

Still, losing a level of control over services and data to a cloud provider is a pressure point for security professionals, Stuart Reed, VP of Nominet, told CIO Dive.

By adopting the cloud, companies expand digital attack surfaces. Companies have to come to terms with risks, like vulnerable internet of things connectivity and exploitable APIs.

There's also a lack of understanding of how much security cloud vendors provide, according to Reed. Because most cloud-based services stop after the firewall, companies have to replicate the security controls they have on-premise for their digital solutions.

Capital One's data breach drew criticism to its provider, Amazon Web Services. But the exploited security controls were the bank's responsibility.

Cloud companies operate a Shared Responsibility Model for customers. While duties might vary depending on the size of the company and its contract, the bottom line is "migrating to cloud infrastructures doesn’t necessarily equal outsourcing responsibility for security," said Reed.