You are here

IT Services, Survey

2017 Consumer Cloud Security Survey

February 23, 2017

How much do you know about the cloud?

You may know it as an abstract technology – something that allows you to access files from multiple devices, but the exact details remain foggy.

Some are not even aware when applications they use are running through the cloud. In fact, 32% of respondents to our recent survey didn’t know that they were using the cloud – a surprisingly high amount.

Our results show a significant lack of knowledge and confidence among consumer cloud users, at a time when the cloud is becoming only further ingrained in our daily lives. As the cloud increasingly becomes ubiquitous, it’s important for consumers to be aware of where they are storing their data – and the consequences that may occur if they are careless with security.

Our Findings

  • Over 30% of respondents believe they do not use the cloud, when they'd previously noted they use at least one popular cloud-based application.
  • 55% of respondents are very or somewhat confident in their knowledge of the cloud.
  • Over half of respondents who know they are using the cloud take additional steps towards securing their data in the cloud.
  • The largest percentage of respondents (42%) believe that responsibility for cloud security falls on the user and cloud provider equally.

 

Article Topics

  • The Hidden Cloud
  • Confidence (and Lack Thereof) in Cloud Knowledge
  • Steps to Secure the Cloud
  • The Burden of Responsibility
  • Recommendations

 

Respondent Characteristics

Clutch surveyed 1,001 respondents from across America in January 2017 using a third-party panel provider. All respondents use at least one of the following apps on their phone or desktop: iCloud, Google Drive, Dropbox, Box, Microsoft OneDrive, iDrive, or Amazon Cloud Drive. The screening question did not specify that these apps are cloud-based.​

The Hidden Cloud

What makes up the cloud? Where is the data stored? How does it all even work?

For even the technologically adept, crafting answers to these questions can take a moment, given the complexity and breadth of cloud computing. For everyday consumers, these questions may never once cross their mind.

For our survey, we screened respondents who use at least one of several popular cloud-based apps, including iCloud, Google Drive, and Dropbox. By design, we did not specify they are cloud-based in the screening question (though for some, like iCloud and Amazon Cloud Drive, it can easily be inferred from their titles).

In the very beginning of the survey, we posed a trick question: “Do you use or access information in the cloud?” All the respondents do use or access information in the cloud, since they previously noted that they use at least one cloud-based app. However, a full 32% answered "No" to this question. Another 13% were unsure.

Graph of "'Do you use or access information in the cloud?"

Our results show that less than 60% of respondents know they are using the cloud. This is intriguing and possibly alarming, given the dangers of storing sensitive data in the cloud. Though security failures are infrequent, they are possible.

In reaction to this data point, cloud experts spoke of the often-confusing nature of the cloud.

“From private cloud, managed private cloud, to in-house and public cloud, there are many different technologies which can be referred to as cloud, but are very general,” said Alexander Martin-Bale, Director of Cloud and Data Platforms at adaware, formerly Lavasoft. “Anything being hosted somewhere other than on the device itself is cloud-based. The reality is that knowing exactly when you're using it, even for a technical professional, is not always simple.”

“People really just don’t understand the sheer breadth of the cloud today,” said Chris Steffen, Technical Director at Cryptzone and former Chief Evangelist for Cloud Security at Hewlett Packard Enterprise.

However, cloud experts also emphasized the importance of being aware. “We’re talking about data security… there are quite a bunch of things that as a user, you would want to be concerned about or you should at least know about,” said Martin-Bale.​

Confidence (And Lack Thereof) in Cloud Knowledge

Fifty-five percent (55%) of respondents are very or somewhat confident in their knowledge of the cloud.

Graph of Confidence in Knowledge of Cloud's Function

When cross-referencing the data with responses from the question, “Do you use or access information in the cloud?” we see a pretty clear trend between confidence and knowledge.

Surprisingly, however, 22% of people who say they are very confident in their cloud knowledge do not know or are unsure that they are using the cloud. How is this possible?Graph - Lower confidence in cloud knowledge correlates with lack of awareness about cloud usage

“There’s such a glut of information out there about buzzwords in the tech industry, but [cloud] is one that’s obviously out in front of everybody and yet, at the same time, there is so much going on behind the scenes,” said Steffen.

Lucas Roh, CEO of Bigstep, referenced the seeming “magic” of the cloud: “Whether it's Dropbox or iCloud, [consumers] simply know that the information can be accessed from any device, from anywhere. The magic is hidden.”

Roh attributed over-confidence in the cloud to its omnipresence in technology news nowadays. “It boils down to the fact that the word ‘cloud’ has been used everywhere in the press,” he said. “People have heard about it, and think that they conceptually know how it works, even if they don't… They're only thinking in terms of the application being used, not the actual technology behind those applications.”

Be critical of your cloud knowledge. Though the headlines may lead you to believe you’re educated on the topic, there’s always room to learn more.​

Steps to Secure the Cloud

Over half of respondents who answered “Yes” to the question “Do you use or access information in the cloud?” take additional steps, such as two-factor authentication or additional encryption, towards securing their data in the cloud beyond factory settings.

Graph - Additional Steps for Cloud Security

There is not a single security threshold when it comes to the cloud. Experts recommend different levels of security for different types of content. “If you’re just using [the cloud] to store pictures from your phone, your security requirements are going to be different than if you’re using it to store your tax returns… or some intellectual property,” said Martin-Bale. “I think it’s good when people know… what level of security should be required.”

However, Martin-Bale also questioned the accuracy of respondents’ answers for this particular data point. “I think you’ll find that if you ask people to tell you how they’re taking extra steps, you’ll find that a lot don’t,” he said. “I would be very surprised that 60% were using some extra security above what the cloud is offering.”

Steffen spoke humorously on the varying levels of knowledge when it comes to cloud security. “I obviously recommend that you have two-factor authentication, strong passwords, what have you,” he said. “I’m also realistic that I have a little old lady who is my mother and it’s a miracle that she can remember her password at all, much less what her favorite color was the day that she answered some question.”

Consumers should maintain reasonable expectations for cloud security. While implementing additional security is beneficial, it shouldn’t impede usability or exceed comprehensibility.​

The Burden of Responsibility

All this talk of security may feel overwhelming. Shouldn’t it be up to the cloud provider to ensure the safety of your data?

This is a dangerous mindset to fall into. In late 2015, Gartner predicted that, through 2020, 95% of enterprise cloud security failures will be due to customer error. While we cannot extrapolate exact percentages to consumer cloud usage, experts agreed that users must share at least some responsibility for cloud security.

“There isn’t a cloud provider out there that can possibly protect you 100%,” said Steffen.

Luckily, however, the largest percentage of respondents believe that the burden of cloud security at least falls equally on the user and the cloud provider.

Graph of Perceived Responsibility of Cloud's Security

Steffen attributed this data point to increased knowledge. While previously, consumers may have thought that the cloud provider carried the most responsibility, they are increasingly understanding that users’ actions play a heavy role. “I think that the dynamic is changing along with the information security paradigm,” said Steffen. “People are realizing ­– ‘Hey, maybe I do need to change my password every five years,’ or something similar. You can’t expect everything to be secure forever.”

Martin-Bale emphasized the need for user responsibility: “It's paramount for users to understand that they can't offload liability by inherently trusting cloud providers. It's true that most providers employ many resources for making sure that the service is kept kosher, so to speak, but, at the end of the day, it's the user's responsibility to ensure that the data they have on the cloud is safe enough.”​

Our Recommendations

“The cloud is not going anywhere. If anything, it’s going to become more and more an integral part of the stuff that we do every single day, whether we know that we’re using it or not,” said Steffen. With this in mind, we recommend the following:

  • Educate yourself on the basics of cloud computing. Change your passwords regularly. Implement a simple additional security step such as two-factor authentication. These are undemanding measures you can take to protect your information in the cloud.
  • Determine which types of content you are comfortable with storing in the cloud and which types you feel require extra precautions.
  • Don’t entrust the entire burden of security on your provider. Even the best providers’ security measures fail due to user error.

 

Questions? Comments? Contact Riley Panko at [email protected]