Ermetic Reports Nearly 80% of Companies Experienced a Cloud Data Breach in Past 18 Months

Ermetic, the cloud access risk security company, today announced the results of a research study conducted by global intelligence firm IDC which found that nearly 80% of the companies surveyed had experienced at least one cloud data breach in the past 18 months, and nearly half (43%) reported 10 or more breaches.

According to the 300 CISOs that participated in the survey, security misconfiguration (67%), lack of adequate visibility into access settings and activities (64%) and identity and access management (IAM) permission errors (61%) were their top concerns associated with cloud production environments. Meanwhile, 80% reported they are unable to identify excessive access to sensitive data in IaaS/PaaS environments. In the recent 2020 Verizon Data Breach Investigations Report, only hacking ranked higher than misconfiguration errors as a source of data breaches.

"Even though most of the companies surveyed are already using IAM, data loss prevention, data classification and privileged account management products, more than half claimed these were not adequate for protecting cloud environments," said Shai Morag, CEO of Ermetic. "In fact, two thirds cited cloud native capabilities for authorization and permission management, and security configuration as either a high or an essential priority."

Driven by the dynamic and on-demand nature of public cloud infrastructure deployments, users and applications often accumulate access permissions beyond what is necessary for their legitimate needs. Excessive permissions may go unnoticed as they are often granted by default when a new resource or service is added to the cloud environment. These are a primary target for attackers as they can be used for malicious activities such as stealing sensitive data, delivering malware or causing damage such as disrupting critical processes and business operations.

Highlights of the Cloud Access Survey

As part of the study commissioned by Ermetic, IDC surveyed 300 senior IT decision makers in the US across the Banking (12%), Insurance (10%), Healthcare (11%), Government (8%), Utilities (9%), Manufacturing (10%), Retail (9%), Media (11%), Software (10%) and Pharmaceutical (10%) sectors. Organizations ranged in size from 1,500 to more than 20,000 employees. Some of the report's key findings include:

• 79% of companies experienced at least one cloud data breach in the past 18 months, and 43% said they had 10 or more
• Top three cloud security threats are security misconfiguration of production environments (67%), lack of visibility into access in production environments (64%) and improper IAM and permission configurations (61%)
• Top three cloud security priorities are compliance monitoring (78%), authorization and permission management (75%), and security configuration management (73%)
• Top cloud access security priorities are maintaining confidentiality of sensitive data (67%), regulatory compliance (61%) and providing the right level of access (53%)
• Top cloud access security challenges are insufficient personal/expertise (66%), integrating disparate security solutions (52%) and lack of solutions that can meet their needs (39%)

A full copy of the report is available here: https://bit.ly/2MmZkDt.

Ermetic will also discuss the survey findings and present best practices for addressing cloud identity and access security risks in a free webinar on June 17 at 12pm EDT/9am PDT. To register please visit: https://bit.ly/2MsTssd.

About Ermetic

Ermetic enables enterprises to protect cloud infrastructures (IaaS/PaaS) from access-related risks and misconfigurations by maintaining continuous visibility into identities, their entitlements and data usage. By combining analytics with granular, full stack insight, Ermetic makes it possible to enforce least privilege access at scale even in the most complex cloud environments. The company is led by proven technology entrepreneurs whose previous companies have been acquired by Microsoft, Palo Alto Networks and others. Ermetic has received funding from Glilot Capital Partners, Norwest Venture Partners and Target Global. Visit us at https://ermetic.com/ and follow us on LinkedIn, Twitter and Facebook.