Cloud security gap: Shadow, orphan and democratized data

Breaches of public clouds are increasing, with 77% of organizations reporting them in the past 12 months, compared to 51% the year before, a new report found.

Two key trends are contributing to the uptick: the speed of cloud transformation and the democratization of data. The combination has created an “innovation attack surface,” or a growing number of entry points for attackers, according to the “State of Public Cloud Data Security Report 2023” by Laminar, an agile data security platform. The result is what the report calls a security execution gap, or the disconnect between agile cloud data activities that boost innovation and manual data security.

“The amount of those breaches in which data was actually exfiltrated also increased from 58% last year to 79% this year,” said Andy Smith, chief marketing officer at Laminar. “This is a problem that is on the incline, not on the decline, for sure.”

Three data types are contributing to the issue: democratized, orphan and shadow. The democratization of data is particularly important to innovation because it lets organizations give access to copies of data to derive insights. “That frequently creates more opportunities for orphan data and shadow data to emerge,” said Justin Lam, data security research analyst at 451 Research.

Orphan data is data that was created for a purpose but has since been forgotten or is no longer used. Shadow data is data that the IT security team doesn’t know about or has no control over.  

“You’re also opening up some privacy and security risks,” Lam said. “The more copies of data that happen, the more copies of data that end up in the shadows or … are simply just orphaned off and they’re forgotten about.”

Although this problem is growing, the Laminar report found that awareness of it is increasing, too. In fact, shadow data went from being respondents’ third biggest concern last year to the top concern today. Also, 97% of respondents said they have a dedicated security team, up from 58% last year, and 86% said they are confident that they can see new data stores pop up. Still, 29% of respondents said they are only somewhat or not very confident that their existing on-premises security solutions can improve cloud data security.

The main production data stores that everyone knows about, are usually well protected, Smith said. The risk is with “the shadow copies of that data that is typically misplaced, under-protected, overly accessible. And those are the data stores that are getting hacked—the ones that IT and security are not really aware of.”

This is especially risky in the public sector, said Ravi Ithal, chief technology officer at Normalyze, a cloud data security solutions provider. When people have no choice but to provide personally identifiable information to obtain driver’s licenses, benefits and life milestone certificates, that increases the potential for PII breaches.

Plus, “in the government, people are averse to deletion of data because you want to keep as much data as possible,” Ithal said. The downside is that “the more data you keep, the more probability of abandoned data.”

Another common mistake is addressing cloud infrastructure issues first and data second: That should be reversed, he said. IT teams tend to tackle “the easy, low-hanging fruit first, then get to the data,” he said. “But data is the more important thing to do.”

There are steps agencies can take to protect themselves, however. Lam said the first is assessing what data they have, which requires the alignment of multiple stakeholders. For instance, security practitioners must know who develops applications that collect and process data.

Second, they need to ensure that whatever data that’s created—or democratized—doesn’t fall into the shadows or risk being orphaned. Data must become part of the system of record, with active continuous monitoring and auditing.

The third step involves creating regulations that ensure that technical controls and regulatory needs align. “It’s one thing to be able to reduce the security risk, but I cannot slow down or risk the process of innovation,” Lam said.

Ithal adds governance to the list of precautions. “I think the drivers need to be within IT—and IT security in particular,” he said. “IT security needs to drive this, educate the users, but everybody has a part to play at the end of the day.”

The trick is balancing innovation and visibility into and security of data.

“Data access and data utility are not a zero-sum game,” Lam said. “If I know what control systems are in place, I can better flexibly adapt and innovate because it’s underneath this umbrella of protection…. We’re not out to punish people for using data, even if it’s orphan or shadow. We want to collaborate so that we don’t get into these problems in the first place.”

Stephanie Kanowitz is a freelance writer based in northern Virginia.