90% of Data Loss Prevention Violations Occur in Cloud Storage Apps

Netskope, Inc., in safe cloud enablement, released its Summer 2015 Netskope Cloud Report, which provides a look into enterprise cloud app usage and trends.

The report was highlighted by the finding that 90% of data loss prevention (DLP) violations occur in cloud storage apps, and a large percentageage of these are for enterprise confidential intellectual property or customer or regulated data that the customer did not know or want to store there.

According to the report, 17.9% of all files in enterprise-sanctioned cloud apps violate at least one DLP policy. Of those DLP-violating files, one in five are exposed publicly. Among the different types of mishandled sensitive content, the highest incidence of DLP policy violations occurred with personally identifiable information (PII) at 26.8%, while payment card information (PCI) represented the second highest at 24.3%.

Of note, the report also found the average number of apps used by enterprises has declined for the first time, from 730 in the last quarterly report to 715 in the Summer 2015 report. The underlying suggests that enterprises are beginning to consolidate apps, especially those in the marketing, collaboration and productivity categories. There was no corresponding increase in apps being enterprise ready; a whopping 92% of the apps – all tracked in the Netskope Cloud Confidence Index (CCI) – are not rated enterprise ready, meaning they lack the security, audit and certification, SLA, legal, and vulnerability capabilities required for safe cloud enablement.

“With so many cloud apps in the enterprise lacking the capabilities required for safe enablement, it is imperative that IT possess a holistic view of cloud app usage to inform proactive policies that reduce the risk of losing sensitive data,” said Sanjay Beri, CEO and founder, Netskope. “More than just knowing where violations occur, it’s important to know how they are occurring and what steps can be taken to mitigate such behaviors. While awareness is growing, it’s clear that there’s still a long road ahead to ensuring safer enterprise cloud app usage.”

Breakdown of DLP Policy Violation Occurrences
Enterprises discover and inspect cloud content against a number of predefined and custom profiles in the areas of personally identifiable information (PII), payment card information (PCI), personal health information (PHI), source code, profanity and confidential or top secret information. Using the Netskope Active Platform, Netskope identified violations by discovering content at rest in sanctioned cloud apps via those apps’ published APIs as well as by inspecting content in-line in real-time via the Netskope Active Platform per enterprises’ DLP policies.

Below is a chart illustrating the breakdown of DLP policy violation categories and the percentage by which each occurs:

Category
Percent DLP Policy Violations

1 Personally-Identifiable Information (PII) 27%
2 Payment Card Information (PCI) 24%
3 Confidential or Top Secret Document 17%
4 Source Code 16%
5 Personal Health Information (PHI) 12%
6 Profanity 4%

Top Policy Violations in the Netskope Active Platform
The five cloud app categories with the highest volume of policy violations1 are cloud storage, webmail, finance/accounting, social, and CRM and SFA. The top activities that constituted a policy violation-from highest to lowest in occurrence-are login, download, send, view and upload.

To read Netskope Cloud Report