90% of DLP violations occur in cloud storage apps

90 percent of data loss prevention (DLP) violations occur in cloud storage apps, and a large percentage of these are for enterprise confidential intellectual property or customer or regulated data that the customer did not know or want to store there.

According to a Netskope report, 17.9 percent of all files in enterprise-sanctioned cloud apps violate at least one DLP policy. Of those DLP-violating files, one in five are exposed publicly.

Among the different types of mishandled sensitive content, the highest incidence of DLP policy violations occurred with personally identifiable information (PII) at 26.8 percent, while payment card information (PCI) represented the second highest at 24.3 percent.

The average number of apps used by enterprises has declined for the first time, from 730 in the last quarterly report to 715 in the Summer 2015 report. The underlying suggests that enterprises are beginning to consolidate apps, especially those in the marketing, collaboration and productivity categories.

There was no corresponding increase in apps being enterprise ready; a whopping 92 percent of the apps are not rated enterprise ready, meaning they lack the security, audit and certification, service-level agreement (SLA), legal, and vulnerability capabilities required for safe cloud enablement.

Roman Foeckl, CoSoSys CEO, thinks that cloud storage apps represent a concern for most organizations, mainly because of the ease of use for data sharing and collaboration.

“Netskope’s report provides valuable data on the number of apps used by employees and the type of data being shared on the cloud. Personal Identifiable Information (PII), Credit Card Numbers (CCNs), company projects data are the most shared on apps like Drobpox, Google Drive, Box, etc. We see this as a threat to companies that do not have clear regulations or policies on what should be shared on these apps or not and that do not use proper tools like DLP to filter what’s being uploaded or copied,” said Foeckl.

“Most of cloud storage apps represent what’s called shadow IT and this is part of the problem. Employees use a significant amount of apps that are not officially supported by IT and have no sort of rules. It is also something that should be addressed by cloud storage apps providers, which could support more enterprise features, like Drobpox for Business is providing an API for third party security vendors,” Foeckl added.