IT security’s blind spot

Good network and data security is made up of several parts. Technology and culture are certainly important elements, but so is perception. If you don’t know what’s going on in your IT infrastructure, then how can you be so sure that you are protected as well as you think? Hubris has been a big reason for many of the most serious breaches over the past few years.

That seems to be true also for emerging infrastructures that include cloud services. Many organizations and government agencies have not made the move to cloud yet, or have done so only hesitantly. And perhaps they are fooling themselves in thinking they have this transition under control, and that they’ll be able to manage the security implications

Skyhigh Networks took a look at this, using anonymized, actual usage data collected from public sector organizations in both the United States and Canada. In its Cloud Adoption and Risk in Government report for the first quarter of this year, Skyhigh discovered, among other things, that government on average was underestimating the use of cloud services by its employees more than ten-fold.

“That’s startling because we tend to think the government sector is very locked down,” said Kamal Shah, vice president of product and marketing at Skyhigh. “In reality, employees are finding and using cloud services to help them get their jobs done, regardless of what the official policies are.”

When they asked government IT officials what services they thought employees were using, they’d come up with anything in between 60 and 80, he said. The Skyhigh study found the average public sector organization uses 742 separate and unique cloud services.

If that sounds like a lot, compare that to the fact that SkyHigh already tracks some 12,000 unique services in its database and is adding around 500 new services each month. There’s a lot of room for that average to climb still higher in the future.

This is all part of the unregulated, shadow IT mess that government already faces. That threatens to become much worse over the next few years with the rise of the Internet of Things -- dubbed the Internet of Threats by some -- and that’s spooking many organizations around the world into trying to figure out answers. If agencies thought they had a problem with BYOD, they haven’t seen anything yet.

The kind overconfidence surfaced by Skyhigh is showing up in other reports also. Cybersecurity certification company RedSeal recently produced its own survey of 350 C-level company executives, of whom a solid 60 percent said they could “truthfully assure the board beyond a reasonable doubt” that their organization was secure. As RedSeal pointed out, those assertions were made at the same time that many reports showed a high incidence of network breaches in up to 97 percent of all companies.

What seems clear from the RedSeal survey is that most executives have no clue about what’s really happening in their networks. In what’s a clear repudiation of that two-thirds “beyond a reasonable doubt” number, 86 percent of respondents  acknowledged they had gaps in their network visibility, and almost as many admitted that makes it impossible to effectively secure their networks.

Even outside of the security implications, this lack of knowledge by executives about how IT is being used in their organizations causes problems. As a part of its study of usage data, for example, Skyhigh found that 120 of those 742 total services used on average by agencies were for collaboration purposes. That puts a lot of overhead on IT to deliver all of those unique services, and actually injects confusion into what should be a very organized affair. Fewer services actually aid in collaboration since it means more people would likely be on the same page.

As far as security is concerned, all this shadow IT greatly increases the chance that networks will be breached and, particularly, that users will have their network identification and authentication information stolen. The average public sector employee’s movements online are being monitored by an average of 2.7 advertising and web analytics tracking services, Skyhigh pointed out, and those are increasingly being used by cyber criminals as a base for so-called watering hole attacks.

This is important, Shah said, because the cloud is increasingly being used by attackers to move data out of organizations. In one agency, the company noted over 86,000 tweets coming from just one ID address in a day. When the machine and that address were isolated, the agency found a bot that was exfiltrating data at 140 characters at a time.

That’s an example, Shah said, of the fact that if you can’t analyze data that can show anomalous behavior, you won’t find it. “That’s a blind spot for most organizations,” he said.

All of this is fueling the emergence of new security services, focused on visibility into cloud data traffic, called cloud access security brokers (CASBs). They emerged in 2012, Gartner said, and are set to become an essential component of software-as-a-service deployments by 2017.

Hype aside -- and not forgetting Skyhigh, RedSeal and others have a vested interest in selling these services -- these reports and surveys at a minimum indicate that overconfidence by those charged with providing security for IT is at least as big a problem as the technological challenges they face. It might also be the toughest to fix.