Last Day to get a GIAC Cert Attempt Included or $350 Off with OnDemand and vLive Training!


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

Enterprise Users Say That While Use of Cloud Services Is Increasing, They Lack Visibility to Secure Data

More Sensitive Data Than Ever Stored in the Cloud, But Access and Breaches Remain Biggest Concerns

  • Bethesda, MD
  • October 26, 2017

A new SANS survey finds that organizations are putting more sensitive customer-related data, particularly personally identifiable information (PII) and healthcare records in the cloud than ever. This and other data from the 2017 Cloud Security Survey will be released by SANS Institute in a two-part webcast on Tuesday, November 1 and Wednesday, November 2.

The survey of security practitioners finds that they continue to have major concerns about sensitive data. More than 60% worry about unauthorized access by outsiders, followed by insecure, unmanaged devices accessing sensitive info from the cloud, followed by breach of sensitive data by cloud personnel. This concern aligns with their implementation of top controls, in which more than 80% of respondents are utilizing VPN (to secure access), log management, and vulnerability management as their top three controls that work for cloud environments. Just under 80% are utilizing encryption, as well.

Respondents still believe they lack visibility, auditability and effective controls to actually monitor everything that goes on in their public clouds, with 55% indicating that they are hindered from performing adequate forensic and incident response activities by a lack of access to logs and underlying system and application details in cloud environments.

"The survey did find increased use of security controls within cloud provider environments and wider use of security-as-a-service (SecaaS) solutions to achieve in-house and external security and compliance requirements," says Dave Shackleford, SANS Analyst and author of the report. "But the acceptance of in-cloud controls and services continues to lag behind the pace of organizations moving assets into the cloud."

Full results will be shared during a two-part webcast on Tuesday, November 1 and Wednesday, November 2 at 1 PM Eastern time, sponsored by BMC, Forcepoint, McAfee, and Qualys, and hosted by SANS. Register to attend the webcasts at and

Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst and cloud security expert, Dave Shackleford.

Tweet This:

Cloud security in depth: 2017 SANS Survey Results | Nov. 1 | Nov. 2 -

60% worry about data security in the cloud. Learn more | Nov. 1 |

VPN, log management, vulnerability management ranked top 3 cloud security controls - Learn more | Nov. 2 |

Securing cloud implementations in today's threat landscape. Register today | and

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 60 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates a practitioner's qualifications via over 30 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (