Endpoint Protection

 A new report has come out that highlights the impact that SaaS and other cloud models are having on information governance approaches. According to the findings of the “Information Governance in the Cloud: A Study of IT Practitioners” study conducted by the Ponemon Institute and sponsored by Symantec, most organizations lack the procedures, policies and tools to ensure that sensitive information they put in the cloud remains secure.  The survey found that only 27 percent of respondents said their organizations have procedures for approving cloud applications that use sensitive or confidential information.
 
The study shines a spotlight on some of the information protection and management issues that organizations are facing as they adopt the cloud model, and they resonate with what we at Symantec have been hearing from many of the senior security professionals we work with. In most organizations, large gaps exist between those currently evaluating cloud computing vendors and the IT and security business leaders that should ideally be responsible.  In the Ponemon findings, only 20 percent of the organizations surveyed reported that their information security teams are regularly involved in the decision making process and approximately a quarter said they never participated at all. And they’re not happy about it: 69 percent of the respondents indicated they would prefer to see the information security or corporate IT teams lead the cloud decision making process. 

We continue to recommend that organizations assess what specific, proactive steps they should take to protect sensitive information stored in the cloud.  Other recommendations include: 

• Ensure that policies and procedures clearly state the importance of protecting sensitive information stored in the cloud. The policy should outline what information is considered sensitive and proprietary.
• Adopt an information governance approach that includes tools and procedures for classifying information and understanding risk so that policies can be put in place that specify which cloud-based services and applications are appropriate and which are not.  
• Evaluate the security posture of third parties before sharing confidential or sensitive information. As part of the process, corporate IT and/or information security experts should conduct a thorough review and audit of the vendor’s security qualifications.
• Prior to deploying cloud technology, train employees how to mitigate the security risks specific to the new technology to make sure sensitive and confidential information is protected.

To find out more about the “Information Governance in the Cloud: A Study of IT Practitioners” study or to find out more about how Symantec is helping customers capitalize on the promise of cloud computing, visit http://www.symantec.com/cloud.