Transcription
REPORTCloud Adoption and Risk ReportBusiness Growth Edition
REPORTCloud Adoption and Risk ReportBusiness Growth EditionExecutive SummaryFrom the introduction of Salesforce.com and countless cloud services since, we’ve beenseeking ways to leverage the cloud to grow our businesses. It’s absolutely working. In thisedition of the Cloud Adoption and Risk Report, we’ll look at how companies like yours areusing the cloud to deliver key measures of business growth, the hurdles they’ve had toovercome to get there, and what leaders of cloud adoption are doing to accelerate growthahead of the rest. For our research we surveyed 1,000 enterprise organizations aroundthe world and combined that data with insight from billions of anonymized cloud eventsaggregated across thousands of customers in our live environment to capture both theperception and reality of these challenges and opportunities. Four key trends jumped outat us: The vast majority of companies using the cloudexperience business acceleration. Security is stronger in the cloud. Most cloud customers aren’t fulfilling their sharedresponsibility for security.There is a dramatic leap in business acceleration forcompanies getting ahead of risk and protecting theirdata in the cloud.The security budgets at Microsoft, Amazon WebServices (AWS), Box and most other enterprise cloudservice providers can be orders of magnitude higher2Cloud Adoption and Risk Reportthan the customers they serve, and that’s paying off. Inour survey, 52% of companies stated they experiencebetter security in the cloud. That’s great news for theIT industry as a whole. Not only is security better, but87% said they experience benefits from the cloud thatdrive business acceleration. Forty-one percent attributebusiness growth to use of the cloud, and around 30%are able to launch new products, speed up time tomarket, and expand to new markets. So not only doenterprises say the cloud is more secure, they also stateit is actually improving business commercially. So whyisn’t everyone experiencing this?Connect With Us
REPORTThe gap between secure enablement and experimentaladoption is drawn by the approach to protecting data,which nearly all cloud providers state is the customer’sresponsibility. Only 36% told us they can currentlyenforce data loss prevention (DLP) in the cloud. Only33% said they could control how users collaborate andshare data in the cloud. In the case of IaaS, only 26% saidthey could audit configuration settings, like open accessto storage buckets, again widening the gap.The silver lining here is that companies fulfilling theirshared responsibility by protecting their data in thecloud are opening up substantially more benefits thanthose who aren’t taking data protection into their ownhands. Companies are 32% more likely to experiencebusiness growth from the cloud when using a CloudAccess Security Broker (CASB) to protect their data,compared those who don’t. The likelihood of companiesbeing able to launch new products, speed time tomarket, and expand to new markets with the cloud isall over 35% higher when a CASB is part of their cloudsecurity strategy. Yet only one in three companies wesurveyed are currently using one.3Cloud Adoption and Risk ReportKey Findings Eighty-seven percent of companies experiencebusiness acceleration from their use of cloud services. The majority (52%) of companies experience bettersecurity in the cloud. Only 26% of companies say they can audit IaaSconfigurations. Only 33% of companies say they can controlapplication collaboration settings. Only 36% of companies say they can enforce data lossprevention in the cloud. Companies are over 35% more likely to be able tolaunch new products, speed time to market, expand tonew markets, and improve employee satisfaction withthe cloud when using a Cloud Access Security Broker(CASB). Only one in three companies currently use a CASB.
REPORTCloud as a Business AccelerantThere hasn’t been a more disruptive technology toenter enterprise IT since the internet itself. Mostcompanies are structuring themselves around therapid transformation, growth, and agility the clouddelivers. Cloud is making IT more strategic than ever.Instead of building from the ground up we’re leveragingthe development teams at AWS, Box, Microsoft andcountless others to give us the tools we need to runour businesses, from anywhere. Cloud infrastructureis leagues ahead of our on-premises performance.Workers are able to collaborate faster. Softwaredevelopers are building and deploying applicationsrapidly in cloud infrastructure. The cloud is moving ourbusinesses forward faster, and for this study we want toshow specifically how, so you as a reader can get a senseof what companies leading the charge are experiencing.In the chart below we asked our 1,000-respondentpool of enterprise IT decision makers how they werebenefitting from their use of cloud. First, let’s look at oneaggregate finding from that question:87% of enterprises experience businessacceleration from their use of cloud services.4Cloud Adoption and Risk ReportWhat do we mean by business acceleration? We definedit by those who experienced at least one of the followingmeasures:1.More efficient collaboration2. Improved employee productivity3. Business growth4. Faster time to market5. Higher employee satisfaction6. Ability to launch new products7.Expansion to new markets
REPORTBusiness growth is a leading indicator here. 41% ofcompanies were able to directly attribute businessgrowth to their use of cloud services. Think about thatfor a moment. Did the last implementation of your onpremises file repository feel like it grew the businesscommercially? Probably not. But enabling thousandsof workers to share files, access from anywhere, andcollaborate with external parties using Box just might.Enabling your software development team to build,iterate, and continuously deploy new customer-facingapplications in AWS is even more likely to lead to growth.How Companies Benefit from the Cloud80%70%60%59%Higher-performanceIT Infrastructure50%40%57%IT %ImprovedEmployeeProductivity30%20%10%0%Figure 1. What benefits does your organization experience from its overall use of cloud services?5Cloud Adoption and Risk Report41%BusinessGrowth37%Faster Timeto Market33%HigherEmployeeSatisfaction30%Ability toLaunch NewProducts29%Expansion toNew Markets
REPORTIn addition to this question, we asked our respondentsto tell us what type of cloud services they use, whethersoftware-as-a-service (SaaS), platform-as-a-service(PaaS), infrastructure-as-a-service (IaaS), private cloud,or any combination. Those using IaaS clearly had anedge on business acceleration. Forty-three percent ofcompanies using IaaS experienced faster time to market.Thirty-seven percent were able to launch new products.Thirty-six percent were able to expand to new markets.Each of these measures of acceleration—time to market,launching new products, and expanding to new marketswere around 20-25% above average for companiesusing IaaS. While we know the collaborative nature ofSaaS is a boost to our businesses, the use of IaaS as anew IT environment for customer-facing and internalapplications is driving companies forward faster than therest, and likely adding a competitive edge to those at theforefront of adoption.How Companies Benefit from the Cloudwith Infrastructure-as-a-Service (IaaS)80%70%60%64%Higher-performanceIT Infrastructure50%40%61%IT aster Timeto re 2. What benefits does your organization experience from its overall use of cloud services? Companies who use Infrastructure-as-a-Service (IaaS)6Cloud Adoption and Risk Report37%Ability toLaunch NewProducts36%Expansion toNew Markets
REPORTThe State of Security in the CloudYou may have noticed one compelling finding from thecharts above that we left out of the prior discussion:52% of companies experience better securityin the cloud.It’s a stark contrast from the first wave of fear,uncertainty, and doubt we had for the cloud at the earlystages of adoption. Fundamentally we all wondered,how can I trust my organization’s data to a thirdparty provider, in an environment where I don’t havevisibility and control? The concerns were real. Breacheshappened. Some companies are still facing the darkerside of that reality. Others have come out of the tunnelto see that their trusted cloud providers now dedicatea tremendous amount of resources to security, all toprotect their customers and the sustainability of theirbusiness model.So what’s left? The one element of security cloudproviders can’t cover for their customers is how theirservices are actually used, specifically the data that isstored in them, shared externally, and accessed from amyriad of devices and locations. There are almost infinitevariations on what we each consider “sensitive” data,or are required to protect in regulated industries. Therequirements for large retail providers to keep their dataPCI compliant don’t necessarily apply to a governmentresearch agency that needs to secure intellectualproperty.7Cloud Adoption and Risk ReportThe responsibility comes back to customers. Ascloud users, we need to know what data needs tobe protected, where it goes, and who is allowed toaccess it based on our internal policies and compliancerequirements. To give everyone a shortcut, we assessedbillions of aggregated, anonymized cloud events we seein the McAfee universe of enterprises to show wheresensitive data resides in the cloud, on average:Where Enterprise Sensitive Data Lives in the CloudMed/Low-RiskHigh-Risk ShadowShadowServiceNow5%5%Custom Apps11%AWS, Azure, GCP8%13%Salesforce2%2%16%SlackGoogle Docs7%Box, Dropbox31%Figure 3. Distribution of sensitive data across cloud service typesFurther aggregating this chart into categories, you cansee that 65% of sensitive data lives in collaborationand business apps like Office 365, Box, and Salesforce.25% lives in IaaS like AWS, Microsoft Azure, and Google
REPORTCloud Platform (GCP). And finally, 10% lives in ShadowIT. The shift from early stages of cloud adoption hereis dramatic. Before IT teams officially sanctionedapplications like Office 365, Box, and others, mostenterprise cloud data lived in Shadow IT, becauseemployees simply signed up for apps they wanted touse, ignoring IT. Now that has completely flipped. ITteams are rolling these apps out themselves, effectivelyfulfilling most needs that were previously unmet. Therisk of sensitive data exposure through Shadow IT hasbeen significantly diminished.Timing of Security Implementation in the Cloud5%100%90%Bridging the Gap in Cloud Security SharedResponsibilityThe challenge for us all now becomes how to effectivelyimplement security for our data in the cloud, spanningacross hundreds of services and involving multipleinternal and external stakeholders with their ownrequirements and input. We want to streamline, and wecan. First let’s look at timing of security implementation,which has unique implications for companies with aDevOps approach using IaaS and PaaS.8Cloud Adoption and Risk ReportImplementedAfter Deployment70%60%Implementedat Deployment50%40%30%62%20%10%0%We now have a targeted method to begin protectingsensitive data in the cloud. Start with the applicationsthat hold the majority of your sensitive data, and workyour way down. Whether your company already usesthese apps or is planning to roll them out, you can usethis approach to guide your resource planning andmaximize risk mitigation.33%80%ImplementedDuring DevelopmentFigure 4. When is security implemented in your organization’s cloudapplications? Companies with a DevOps approach.In the chart above, you can see that 62% of companiesusing a DevOps approach implement security duringdevelopment of their cloud applications, 33% at the timetheir cloud applications are deployed, and 5% after theircloud applications have been deployed. Clearly thereis a movement to shift security “left” in the softwaredevelopment lifecycle to get ahead of problems beforethey go live in production cloud environments. We lovethis finding, because it supports what we believe to be abest practice for security in the cloud. In IaaS and PaaS,run code and configuration checks during developmentso you can fix issues rapidly and cause minimaldisruption to the continuous delivery of new software.We hope more companies pick up on this trend.
REPORTNext, let’s look at what our enterprise surveyrespondents said about their security practice in thecloud today:Allow end-users to self-remediate their own policy violations77%23%74%26%Enforce the same DLP policies at your devices, network, and cloud70%30%Control application collaboration settings33%67%Discover and remediate Shadow IT33%67%Enforce DLP policies for cloud data64%36%Control access to cloud data for personal devices40%60%Encrypt data using your encryption keys40%60%Manage public (SaaS, PaaS, IaaS) and private cloud together40%60%Detect malicious user behaviorMonitor database activityDetect and remove malware43%44%46%57%56%54%Figure 5. Can your organization’s current cloud security solution(s) conductany of the following in the cloud?Here we have some significant gaps directly related tothe shared responsibility we’re all supposed to upholdas cloud customers. Fulfilling the responsibility ofprotecting your own data in the cloud can come in manyforms, but it is clear many companies are behind. Only33% said they could control collaboration settings, likewhen someone creates a file sharing link with openaccess to anyone in the world. Only 36% said theycould enforce data loss prevention in the cloud. For thesurvey we only recruited respondents from companies9Cloud Adoption and Risk Report500 employees and above, most of which are likely tohave a DLP practice for devices and other on-premiseslocations. The majority are far behind in the cloud.Lastly, 40% of companies said they could control accessto cloud data from personal devices. The remaining 60%are letting a black hole form that is invisibly siphoningtheir data, with no way to get it back. Sensitive data thatgoes to an unmanaged, personal device is gone forever,and that can be devastating.
REPORTHow Leaders in Cloud Adoption are GrowingBusiness FasterThe gaps in security practice we just highlighted werealluding to a specific category of technology that we’lldiscuss here, that being the role of Cloud AccessSecurity Brokers (CASB) in cloud adoption in businessgrowth. In short, companies that use the cloud with aCASB to protect their data are accelerating faster thaneveryone else, and it’s having a material impact on theirbusiness. Let’s start with a few fundamental findings.First, companies use 49% more cloud services witha CASB. The idea here is that by having a solution forprotecting cloud data, IT teams are able to roll out moreservices, faster, because their security requirements aremet from the start. Keep in mind that the chart belowreflects “self-reported” cloud services, most of whichare sanctioned and excludes hundreds of increasinglyerroneous Shadow IT applications.Estimated Number of Cloud Services in Use5434Don’t use a CASBUse a CASBFigure 6. Please estimate how many public cloud services (SaaS, PaaS,or IaaS) are currently in use by your organization (averages shown).10Cloud Adoption and Risk ReportNext, companies with a CASB run 56% more customapps in IaaS. With the ability to audit IaaS environmentsfor misconfiguration, the risk of data exposure isminimized, and developers are empowered to do morein environments like AWS. Data stored in S3 buckets canbecome part of a DLP practice, giving further confidenceto push forward with innovative development in thecloud that won’t put the company at risk.Estimated Number of Custom Apps in IaaS9455Don’t use a CASBUse a CASBFigure 7.Please estimate how many applications your organization runsin IaaS (averages shown).
REPORTLet’s now return to the start of our discussion onbusiness acceleration. The vast majority of companiesusing the cloud stated they experienced forces ofacceleration from their use of the cloud. We weresurprised however, by how much faster companies weremoving when they used a CASB:How Companies Benefit from the Cloudwith Cloud Access Security Broker yeeProductivity40%30% 15% 11%50%BusinessGrowth45%42%Faster Timeto MarketHigherEmployeeSatisfaction37%Ability to LaunchNew Products36%Expansion toNew Markets 32% 36%20% 45%10%0%Figure 8. What benefits does your organization experience from its overall use of cloud services? With Cloud Access Security Broker (CASB) vs without.11Cloud Adoption and Risk Report 38% 38%
REPORTThere is a significant jump in each force of businessacceleration for companies who use a CASB. Companieswere 45% more likely to increase employee satisfactionwith the cloud when using a CASB. As we just showed,companies using a CASB also used more applications,fulfilling more employee needs. They were 40% morelikely to be able to launch new products, 38% more likelyto expand to new markets, 36% more likely to have afaster time to market, and 32% more likely to experiencebusiness growth, all contributors to commercialsuccess. Whether it is the increase in IaaS applications,improved collaboration, or simply a culture of speed andinnovation, companies are accelerating faster using thecloud with a CASB. Yet only one in three companies wesurveyed use one.RecommendationsIt should be clear from our data at this point that cloudservices are contributing in material ways to the successof most companies. The goal here is to guide towardsmore successful cloud adoption by demonstrating thatmitigating risk can increase the potential for businessacceleration.1. Find out where your sensitive data lives inthe cloud.We gave you a head start above; however it is stillworth assessing your own unique environment soyou can be precise in your security practice.12Cloud Adoption and Risk Report2. Audit your IaaS deployments early.Get ahead of misconfiguration by auditing IaaSrollouts early, at the development phase. That willsave your developer and operations teams timeby preventing retroactive change requests fromthe security team after their apps are already live.That extra time can allow for more innovativedevelopment at your company.3. Roll out cloud apps with a CASB.Get in the habit of deploying your cloud apps withcollaboration, access, and data controls in placefrom the start. That will increase your velocity ofcloud adoption and as we saw, raise the likelihood ofbusiness acceleration.Business acceleration with the cloud is a dominantforce, and companies protecting their data with a CASBare moving faster than the rest. IT is more strategicthan ever as a business enabler. Use the data andrecommendations in this report to help move yourbusiness faster with the cloud.
REPORTMethodologyTo bring you these findings, we surveyed 1,000 ITprofessionals in 11 countries selected to representa diverse set of industries and organization sizes.Fieldwork was conducted from March to May 2019 byVanson Bourne. These results were used in comparisonto aggregated, anonymized cloud usage data for over30 million McAfee MVISION Cloud users worldwide, whocollectively generate billions of unique transactions andpolicy events in the cloud each day. Both of the datasetsrepresent companies across all major industriesincluding financial services, healthcare, public sector,education, retail, high tech, manufacturing, energy,utilities, legal, real estate, transportation, and businessservices.Vanson Bourne is an independent specialist in marketresearch for the technology sector. Their reputation forrobust and credible research-based analysis is foundedupon rigorous research principles and their ability toseek the opinions of senior decision makers acrosstechnical and business functions, in all business sectorsand all major markets. For more information, visit www.vansonbourne.com.13Cloud Adoption and Risk Report
About McAfeeMcAfee is the device-to-cloud cybersecurity company.Inspired by the power of working together, McAfeecreates business and consumer solutions that make ourworld a safer place. By building solutions that work withother companies’ products, McAfee helps businessesorchestrate cyber environments that are truly integrated,where protection, detection, and correction of threatshappen simultaneously and collaboratively. By protectingconsumers across all their devices, McAfee secures theirdigital lifestyle at home and away. By working with othersecurity players, McAfee is leading the effort to uniteagainst cybercriminals for the benefit of all.www.mcafee.com.2821 Mission College Blvd.Santa Clara, CA 95054888.847.8766www.mcafee.com14Cloud Adoption and Risk ReportMcAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countriesOther marks and brands may be claimed as the property of others. Copyright 2019 McAfee, LLC. 4313 0619JUNE 2019
software-as-a-service (SaaS), platform-as-a-service (PaaS), infrastructure-as-a-service (IaaS), private cloud, or any combination. Those using IaaS clearly had an edge on business acceleration. Forty-three percent of companies using IaaS experienced faster time to market. Thirty-seven percent were able to launch new products.
