According to a Skyhigh Networks report only 9% of cloud services European organisations use provide enterprise-grade security capability, meaning the remaining 91% pose "medium to high" security risks.
The study covers 1 million users across 40 European companies from the financial, healthcare, high technology, manufacturing, media and professional industries.
It reveals 1% of cloud services in use offer both enterprise-grade security and store data within European boundaries, while the remaining 99% either store data in countries lacking in stringent data privacy laws, enterprise-grade security, or both.
In fact, 25 out of 30 top collaboration, content sharing and file sharing cloud services are based in the US, Russia and China-- countries with less stringent privacy laws. The report also notes 49 services track user browser behaviour, leading to watering hole attacks.
As for security certification, only 5% of cloud services in Europe are ISO 27001 certified.
Reportedly organisations use an average of 588 cloud services, with adoption taking place under the radar of CIO or CISO-- leading to widespread "shadow IT" with little consideration to security or wider policies.
“Europe is facing something of a crossroads with regard to cloud adoption and security,” Skyhigh EMEA director Charlie Howe says. “The discrepancy between the perceived and actual number and risks of services in use at each organisation is worrying to say the least. CIOs need to get a better grip on this if they are to avoid the huge reputational and financial repercussions of poor data security... CIOs now have the tools and services that will enable them to empower employees to use the cloud services that grow the business while ensuring compliance with internal and external data privacy, security, and governance policies.”
One can check the full report, complete with the top 10 ratings for most popular cloud applications per service, in the link below.
