Almost one in five organisations polled by cybersecurity solutions provider Check Point Software say they have been victim to a cloud security incident over the past year, while more than a quarter still believe security is the responsibility of the cloud provider.

These and other worrying findings have appeared in Check Point’s latest study. The 2019 Security Report, of which this is the third instalment and combined data with survey responses from IT professionals and C-level executives, also found more than half (59%) of IT respondents polled did not use mobile threat defences.

The report pulls no punches in regard to its analysis. The first section, titled ‘cloud is your weakest link’, explores how cloud services are vulnerable across three main attack vectors; account hijacking, malware delivery, and data leaks. Citing Dome9 – acquired by Check Point last year – in a study last year which found 91% of organisations were concerned about cloud security, the report notes how exposure and default security settings remain an issue.

“65% of IT professionals still underestimate the damage they can cause,” the report explained. “The obvious concern is that organisations are not taking cloud security seriously enough. The breach of sensitive data held in the cloud is a huge risk for an organisation, and threat actors know it. The rate of cyber attacks against cloud-based targets is growing, and with little sign it will slow down.”

The statistic which causes major concern is the three in 10 respondents who affirmed security was the responsibility primarily of the cloud service provider. This, as the report noted, ‘negates recommendations’ over shared, or mutual responsibility.

This is a viewpoint which persists even though cloud providers have tried to remove some of the burden themselves. In November, Amazon Web Services (AWS) launched Amazon S3 Block Public Access, which aimed to secure at the account level, on individual buckets, as well as future buckets created.

The move was to ensure users handled public buckets and objects ‘as needed while giving tools to make sure [users] don’t make them publicly accessible due to a simple mistake or misunderstanding’, in the words of AWS chief evangelist Jeff Barr at the time. Previously, AWS had revamped its design to include bright orange warning indicators to signify which buckets were public.

“As nearly 20% of organisations have experienced a cloud incident in the past year, it’s clear that criminals are looking to exploit these security gaps,” said Zohar Alon, head of the cloud product line at Check Point. “By reviewing and highlighting these developments in the report, organisations can get a better understanding of the threats they face, and how they prevent them impacting on their business.”

You can read the full report here (email required).

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.