The cloud has complicated data security for many organizations. While the cloud is not inherently less safe than on-premises data centers, it does present new challenges from a security perspective.
The primary concerns around cloud security are those of observability and visibility. In the data center, an enterprise has a more refined level of control over its documents; a connection to the outside world can be severed by literally “pulling the plug” on the server, and if a hard drive fails, it can be physically replaced. In the cloud, data typically exists in a nebulous ether. Are backups being performed properly? Is security as good as the provider claims? In many cases, the organization simply has to trust that best practices are being followed.
Some security risks are essentially the same in both the cloud and on-premises environments. For example, insiders represent a similar threat whether they are accessing data on-site or online. The enterprise must also work to ensure credentials are managed properly both in the cloud and on premises, and that only authorized users are given access to cloud-based data stores.
Conversely, the cloud has reopened the doors to so-called shadow IT. The ease and low cost of signing up for all manner of cloud services can often lead to an enterprise’s data being scattered across hundreds of sites. As of July 2021, Netskope reported that the typical enterprise (with 500 to 2000 employees) was actively using 805 different cloud services each month, 97% of which were shadow IT apps.
Despite these valid concerns, the cloud can be a perfectly safe place for data to reside, and many services provide training tools to get organizations up to speed quickly. Thus, most practitioners now say they feel the cloud is safer than on-premise alternatives.