Survey Report: Behind the Growing Confidence in Cloud Security Google Cloud... · 4 Survey Report: Behind the Growing Confidence in Cloud Security cstom research report • Specifically

custom research

report

Survey Report: Behind the Growing Confidence in Cloud Security

ON BEHALF OF:

September 2017

1 Survey Report: Behind the Growing Confidence in Cloud Security

custom research

report

ContentsSponsor’s viewpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Executive summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Figure 1: Agility, security and speed top cloud benefits

Strategic adoption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Figure 2: Data storage the top cloud workload; ML/AI projects the most growthFigure 3: IoT will be the most deployed data type to the cloud in two years

Assessing cloud security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Figure 4: Protecting data is the top cloud security requirement

Pockets of skepticism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Figure 5: Among skeptics, security concerns still a barrier to cloud deploymentFigure 6: Senior executives in large companies are most skeptical of cloud

Future cloud usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Figure 7: ML/AI is ideally suited for the cloud

Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Copyright and Disclaimer Notices

Google Inc. does not make any guarantees or warranties as to the accuracy or completeness of this report. Google Inc. shall not be liable to the user or

anyone else for any inaccuracy, error or omission, regardless of cause, or for any damages resulting therefrom. In no event will Google Inc., nor other

companies or third-party licensors be liable for any indirect, special or consequential damages, including but not limited to lost time, lost money, lost

profits or lost good will, whether in contract, tort, strict liability or otherwise, and whether or not such damages are foreseen or unforeseen with respect

to any use of this document. This document, or any portion thereof, may not be reproduced, transmitted, introduced into a retrieval system or distrib-

uted without the written consent of Google Inc.

© Copyright 2017 Google Inc. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

custom research

report

THE MORE YOU KNOW, the more you trust the cloud with your

most important data.

So said a recent global survey of more than 500 IT decision-makers conducted on behalf of

Google Cloud in association with MIT SMR Custom Studio. Those respondents who had the

most direct experience with cloud technology were more confident in its security.

It’s no surprise that more companies are looking to cloud computing as a critical component of

their IT strategies. But in addition to traditional drivers of cloud adoption, such as speed and

agility, security is playing an increasing role in the decision to move to the cloud. And IT leaders

with direct cloud experience are leading the charge.

Pockets of doubt remain, of course. And the security of your IT stack will always depend on the

partners and implementation models you choose. Here at Google Cloud, we’ve invested

deeply in security, all the way from purpose-built hardware to almost every facet of our day-to-

day operations. It’s gratifying to see IT leaders recognizing that, in many cases, moving to the

cloud can actually enhance security.

Read on to learn more about the top workloads companies are migrating to the cloud,

as well as the measures they’re taking to manage security across cloud platforms. And when

you’re ready to talk to a cloud partner, contact us at https://cloud.google.com/contact. n

More and more businesses trust the cloud. Here’s why.

Rob SadowskiTrust & Security, Google Cloud

S P O N S O R ’ S V I E W P O I N T

2

https://cloud.google.com/contact


custom research

report

• “Increased confidence in cloud security,”

along with “increased need for agility and

speed,” are the prime drivers for the projected

growth in cloud adoption, as are the need for

increased business and technical flexibility, as

well as improved integration with new tools

and platforms.

• Data analytics, data storage and collaboration

are the top workloads currently implemented

in the cloud or expected to be deployed with-

in the next two years.

• Machine learning and artificial intelligence are

the fastest growing workloads, with cloud de-

ployment expected to nearly double by 2019.

• The use of cloud has increased from 24

percent of workloads to 44 percent over the

past two years, and it’s expected to rise to 65

percent of workloads in the next two years.

Executive summary

Steady growth in use of cloud Respondents were asked: Please estimate what portion of your

applications, data and/or infrastructure…

…were cloud-based two years ago …are cloud-based today

…will be cloud-based two years from now

24% + 20% + 21%44%

65%

N=509Base: Survey of 509 IT and business executives at midsize and large enterprise organizations worldwideSource: MIT SMR Custom Studio/Google, June 2017 Cloud Security Survey

Three of four respondents have become more

confident in cloud securityRespondents were asked: Over the last two years, how has your overall confidence in the security of

cloud applications and infrastructure changed?

Increased confidence

74%

Stayed about the same

25%

Decreasedconfidence

1%



custom research

report

• Specifically focusing on how companies are

adopting and managing cloud security, the

25-question (excluding demographics) online

survey was distributed via email invitation and

conducted between June 8 and June 22, 2017.

• We received 509 completed survey responses.

Thirty-eight percent were from North America (U.S.

and Canada); 18 percent from Latin America (Mexico,

Brazil); 24 percent from Europe — U.K., France,

Germany — the Middle East and Africa (EMEA); and 20

percent from Japan and Asia-Pacific (Australia/New

Zealand, India, Japan — JAPAC).

• The survey targeted CIOs and senior business

executives (including directors, vice presidents,

general managers and C-level executives)

who influence or are involved in their

company’s IT decisions and initiatives. For

enterprise organizations in North America,

Latin America, EMEA and JAPAC, 72 percent of

survey respondents were in IT and 28 percent

represented their firm’s lines of business.

• Only survey respondents with significant

awareness of cloud technologies were qualified to

complete the survey.

• The survey targeted companies with 1,000+

employees in the U.S. and 500+ employees in other

regions. Among survey respondents, 40 percent

represented companies with 5,000+ employees, 45

percent represented companies with 1,000–4,999

employees and 15 percent represented companies

with fewer than 1,000 employees.

Respondent profileNumber of employees

Job title Functional area


500–999 employees

15%

Director42%

Line of business

28%

IT72%

C-level29%

VP/GM29%

1,000–4,999 employees

45%

5,000+ employees

40%

Methodology

Survey Report: Behind the Growing Confidence in Cloud Security5

custom research

report

The age of unthinking

fears about cloud

security is over.

Not only is cloud

adoption rising steadily across

geographies, industries and job

functions, but confidence in cloud

security is rising as well — to the

point where increased security is

a major reason enterprises opt for

cloud solutions.

According to a recent survey of more than 500 global

respondents conducted on behalf of Google Cloud in

association with MIT SMR Custom Studio, use of the

cloud has increased from 24 percent of workloads to

44 percent over the past two years, and is expected to

rise to 65 percent of workloads by 2019.

Gone are the days when organizations accessed ap-

plications and infrastructure over the internet only

because it was the least expensive way to scale com-

pute, storage and networking resources as business

needs changed. The cloud today is a strategic ne-

cessity, with increased agility, integration and speed

(as well as security) being the prime drivers of its in-

creased adoption (see Figure 1, “Agility, security and

speed top cloud benefits,” on page 6).

This more strategic approach extends to how or-

ganizations manage the cloud. The survey results

show that these companies are taking a thorough,

Security is a top driver of enterprise cloud adoption

Introduction


custom research

report

systematic approach to assess-

ing the security of applications,

infrastructure and platforms ac-

cessed over the internet. Also

shown by the results is that first-

hand experience often separates

cloud believers from skeptics.

As another indicator of the grow-

ing maturity in cloud manage-

ment, there is substantial agree-

ment across industries, regions

and roles about the capabilities

necessary to achieve the re-

quired levels of cloud security.

But whether out of uncertainty about how their ap-

plications will fare in the cloud or how regulators will

treat cloud-based data, not everyone is convinced:

Among those still hesitant to adopt the cloud, securi-

ty remains the primary concern.

This report examines the growing confidence com-

panies have in cloud security, how they are basing

their hosting decisions on the flexibility and inte-

gration offered by the cloud, and their plans to use

the cloud for future workloads such as artificial

intelligence (AI) and machine learning (ML). It also

drills deeper into these organizations’ perceptions of

the security capabilities they need from vendors, as

well as why the skeptics remain unconvinced.

Strategic Adoption

In this digital age, businesses must quickly deploy

new applications and services, share data with new

devices and business partners, and adopt new tech-

nology. When asked why they currently deploy, or

plan to deploy, specific workloads to the cloud, sur-

vey respondents consistently cited “increased flexi-

bility in business processes and vendor choices” and

the “ability to integrate with new tools and platforms”

as the top two reasons for deploying most workloads.

“The cloud has the state-of-the-art development

tools and enables things like DevOps and container

technology” that developers want to use to design

and deploy applications more rapidly, says Jim Reavis,

co-founder and chief executive officer of the Cloud

Security Alliance, a non-profit organization that pro-

motes best practices in cloud security. The cloud also

enables organizations to ramp their resources with-

out having to order and install servers and to “quickly

test an application or pilot a new business process

and then iterate it,” he says. Indeed, 31 percent of

cloud survey respondents cited the “ability to inte-

grate with new tools/platforms” as a main reason for

choosing to deploy workloads to the cloud.

Agility, security and speed top cloud benefits


Respondents were asked: Which of the following best describes why your overall use of the cloud has increased in the past two years (choose up to two responses)?

Figure 1

45%

44%

34%

30%

25%

6%

1%

Increased need for agility/speed to market

Increased confidence in cloud security

Cost savings

Positive experience working withcloud provider

Launching new/experimental apps that were well suited to the cloud

Following lead of other companies

Other


custom research

report

Late adopters just moving to the cloud first deploy

methodologies such as agile development, contin-

uous integration and continuous delivery of appli-

cations in-house “as part of their plan to get ready

for the cloud,” says Doug Cahill, a senior analyst at

consultancy Enterprise Strategy Group. He says the

approach these laggards often take is to begin con-

tinuous integration and delivery on-premises so that

they understand how to expand their use as they

move to the cloud.

When asked why their use of the cloud has increased

over the past two years, respondents cited the top

three drivers as “increased need for agility/speed to

market” (45 percent), “increased confidence in cloud

security” (44 percent) and “cost savings” (34 percent).

It doesn’t provide much to boost an organization’s

flexibility and business processes “if you’re using the

cloud just to displace

hardware down in your

basement,” says Stuart

Madnick, professor of in-

formation technology at

the MIT Sloan School of

Management. He asserts

that more significant ben-

efits come from combin-

ing a move to the cloud

with a more modular, web

services architecture that

makes it easier to share

important data both with-

in the organization and

with business partners.

Among respondents, data storage was the workload

most commonly implemented or planned to be

implemented in the cloud, followed by collaboration/

productivity, application development and the Inter-

net of Things (IoT). Respondents also indicated that

almost 90 percent of each of those workloads would

be deployed in the cloud by 2019. The IoT was a popu-

lar use case for cloud (56 percent currently deployed

to the cloud and 90 percent deployed by 2019) — a

somewhat surprising finding, given that much of the

growth in such internet-connected devices is still ex-

pected to come (see Figure 2, “Data storage the top

cloud workload; ML/AI projects the most growth,” above).

According to Roy Illsley, a principal analyst with ana-

lyst firm Ovum, much of the IoT data currently hosted

in the cloud comes from long-established platforms

such as industrial control systems. But as companies

deploy more data from newer IoT devices to the cloud,

N=506; totals may exceed 100% due to roundingBase: Survey of 509 IT and business executives at midsize and large enterprise organizations worldwideSource: MIT SMR Custom Studio/Google, June 2017 Cloud Security Survey

Data storage the top cloud workload; ML/AI projects the most growth

Respondents were asked: Of those workloads currently implemented by your organization, which have been deployed to the cloud? Of the workloads you will implement in the next two years,

which will be deployed to the cloud?

Figure 2

75%

63%

61%

57%

57% 33%

10%34%56%

50%

31% 56% 13%

38% 13%

29% 14%

24% 16%

30% 8%

17% 9%

10%

Data storage

Collaboration/productivity

Application development

Customer- or partner-facing websites

Data analytics

Internet of Things (IoT)

Business connectivity/disaster recovery

Machine learning/artificial intelligence

Currently deployed Will be deployed Will not be in cloud


custom research

report

he predicts providers

will create new services

that store such data on

the physical “edge” of

the network so it can be

analyzed quickly enough

for devices to respond

to changing conditions

in real time. This “edge”

data could sit anywhere

from small storage de-

vices on telephone poles

to shared data centers

in industrial areas serv-

ing multiple customers,

he says. This will enable,

for example, data about

the performance of a manufacturing robot, pressures

in an oil well or traffic on local roads to be analyzed

quickly to anticipate and prevent problems.

Customer and employee records (at 59 percent),

along with data from the IoT (also 59 percent),

were the three data types most likely to be hosted

in the cloud today, followed closely by corporate

financial data, product development material and

corporate human resources (HR) records.

In another sign of growing confidence in cloud se-

curity, even organizations with highly regulated data

cited “increased security” as an incentive to move to

the cloud. Top candidates for increased cloud deploy-

ment in the next two years were data governed by

medical and financial privacy regulations and corpo-

rate financial data (see Figure 3, “IoT will be the most

deployed data type to the cloud in two years,” above).

According to Rik Turner, principal analyst, infrastruc-

ture solutions at Ovum, even the security-conscious

financial services industry “seems to have been won

over, by and large.” Ovum recently surveyed 75 top-tier

banks around the world, Turner notes. “We...were

surprised by the number that said they were mi-

grating workloads to the public cloud on an almost

wholesale basis.”

Assessing Cloud Security

What’s behind the rising confidence in cloud securi-

ty? Firsthand experience, and careful, systematic as-

sessments that tap multiple sources such as detailed

audits and comparisons. The most frequent driver of

increased confidence was “direct experience of the

quality of security in the cloud versus on-premises,”

cited by 67 percent of our respondents, followed

by the 51 percent who relied on a “detailed audit/

examination of on-premises vs. cloud security.”


IoT will be the most deployed data type to the cloud in two years

Respondents were asked: Of those data types currently implemented by your organization, which have been deployed to the cloud? Of those data types your organization plans to implement in

the next two years, which do you plan to deploy to the cloud?

Figure 3

Currently deployed

Employee-generated records

Data from connected (IoT) devices

Customer records

Product development materials

Source code

Regulated data (covered by PCI, HIPAA, etc.)

Corporate HR records

Corporate financial data

59%

59%

56% 31% 13%

21%24%55%

20%29%51%

15%34%51%

16%34%50%

21%31%48%

32% 9%

28% 13%

Will be deployed Will not be in cloud


custom research

report

As the most influential factors in their assessment of

cloud security, respondents cited, in order:

• Assessments by their own security team.

• Support for security and compliance standards.

• Security tools provided by the cloud vendor.

• Recommendations from analysts and consultants.

Unsurprisingly, the most frequently mentioned secu-

rity requirement was data protection (at 71 percent),

followed by protecting apps and websites from com-

promise or downtime, reports on security incidents

and how the cloud provider responded to them,

and auditability and safeguards against cloud staff

accessing customer data (see Figure 4, “Protecting

data is the top cloud security requirements,” above).

According to Cloud Security Alliance’s Reavis, cloud

providers can still do more to meet users’ needs in

terms of reporting, particularly with what they in-

clude in log files. Standards for what information

can be shared in in-

cident reports may

require changes to

service provider con-

tracts that currently

prohibit a provider

from telling one cus-

tomer another cus-

tomer’s information

was compromised.

However, although

“auditability and re-

porting are very im-

portant, those are al-

most table stakes,” says

Michael Fuller, associate principal at consultancy The

Hackett Group. “What we hear most often, aside from

flexibility and cost, is availability,” such as application

uptime or meeting specific objectives for recovery af-

ter an outage. This is especially true, Fuller says, for

small to midsize businesses with sales of $500 million

to $3–$4 billion. Indeed, 59 percent of survey respon-

dents cited “protect applications or websites from

compromise/downtime” as one of their top cloud se-

curity requirements.

When asked what capabilities they need from a

cloud provider to be confident in the provider’s

infrastructure security, respondents cited the full

range of offerings — essentially, they want it all.

“We are hearing that cybersecurity professionals pri-

oritize encryption of both data at rest and data in mo-

tion as the most effective technologies for protecting

data in the cloud,” says Holger Schulze, founder of the


Protecting data is the top cloud security requirementRespondents were asked how important the following factors are to

their cloud security. (Multiple answers permitted.)

Figure 4

Protect data from compromise/unauthorized access

Auditability for compliance/regulatory/auditing purposes

Protect applications or websites from compromise/downtime

Incident reports detailing security vulnerabilities or breaches, and how the

cloud provider responded

Safeguards limiting access by cloud provider sta� to my systems or data

Ability to manage strength of encryption or the encryption process myself

Somewhat important

Very important17%71%

34%

26%

31%

31%52%

41% 38%

54%

59%

52%


custom research

report

350,000-member Information Security Community

on LinkedIn. In our survey, nearly 80 of respondents

said it was somewhat or very important for their orga-

nizations to manage the strength of their encryption

or to manage the encryption process itself. However,

whether the company or its cloud provider controls

the encryption keys is often “a really big bone of con-

tention,” Fuller says.

The ability for a customer to utilize a cloud provider’s

encryption but manage their own keys “is kind of the

holy grail” of encryption, Reavis says. “But it’s not always

realistic, in every instance, depending on how appli-

cations are architected.” He also said it’s more difficult

with applications that require managing access (and

encryption keys) for many users.

Pockets of Skepticism

For all the widespread adoption of, and confidence in,

cloud computing, a minority of respondents still con-

sidered security concerns a barrier

to adoption (see Figure 5, “Among

skeptics, security concerns still a

barrier to cloud deployment,” right).

Security was the top reason respon-

dents cited for not moving data stor-

age, customer- or partner-facing

websites and IoT data to the cloud.

And only 59 percent of business

decision-makers said their confi-

dence in the cloud had increased in

the last two years, compared to 81

percent of IT respondents.

Overall, IT respondents had more

confidence in cloud security than

their business counterparts, with

those at the director level in their businesses being the

most skeptical. Larger companies also tended to have

greater cloud security concerns than smaller firms

(see Figure 6, “Senior executives in large companies

most skeptical of the cloud,” on page 11).

One factor that can increase security con-

cerns, says Enterprise Strategy Group’s

Cahill, is the “lack of visibility” into cloud secu-

rity controls for companies accustomed to run-

ning their own infrastructure in-house. The in-

ability to simply “plug in the security controls

they’re used to, like a next-generation firewall

at the perimeter,” can be disconcerting, he says.

One major reason for corporate security fears, says

The Hackett Group’s Fuller, is “a lack of confidence in

their own architectural capabilities.” Without a deep

understanding of their architectures, many compa-

nies are now unsure how to secure them in the cloud.

N=295, N=230Base: Survey of 509 IT and business executives at midsize and large enterprise organizations worldwideSource: MIT SMR Custom Studio/Google, June 2017 Cloud Security Survey

Among skeptics, security concerns still a barrier to cloud deployment

Respondents were asked: What are the main reasons you chose NOT to deploy workloads or data to the cloud? (Multiple answers permitted.)

Figure 5

Data

Workloads

41%

29%

19%

22%

24%

22%

12%

20%

19%

63%

Security concerns

Lack of internal expertise

Lack of internal buy-in

Budgetary concerns

Little to no interest in workload or not appropriate

for our organization


custom research

report

Future Cloud Usage

As the universe of data expands and organizations seek

to mine it for insights, the scalability and flexibility of

the cloud will become increasingly important.

The survey results suggest that machine learn-

ing and artificial intelligence will be the fastest

growing workloads for cloud adoption. Thirty-five

percent of respondents said they either cur-

rently implement or plan to implement ML/AI in

the cloud in the next two years. By 2019, 87 per-

cent of that implementation will be deployed to

the cloud. Business continuity/disaster recov-

ery and IoT workloads will also see strong growth

in cloud deployment over the same time period.

Respondents indicated that those who seek to deploy

ML/AI in the cloud are especially drawn to the speed,

flexibility and integrative capabilities it offers (see Figure

7, “ML/AI is ideally suited for the cloud,” on page 12).

“The on-demand compute and storage available in

the cloud are very useful for data-intensive com-

pute tasks like machine learning and artificial in-

telligence,” Cahill says. The scalability of cloud data

storage is also an asset, because the more data

available for machine learning, the better the result.

Cloud-based machine learning and analytics can be

used not only for research and business analytics but

also to improve IT security by finding signs of poten-

tial attacks among otherwise normal data, he says. Ad-

ditionally, the Cloud Security Alliance’s Jim Reavis says

such automated security could help cloud users secure

the growing quantities of data needed for ML and AI.

N=285, N=184Base: Survey of 509 IT and business executives at midsize and large enterprise organizations worldwideSource: MIT SMR Custom Studio/Google, June 2017 Cloud Security Survey

Mid-level executives and those in large companies are most skeptical of cloud

Among survey respondents, those at the director level and those in companies with 5,000+ employees were most likely to indicate concerns about cloud security.

Figure 6

Those who view security as a reason TO deploy Those who view security as a reason NOT TO deploy

Job function Job responsibility Number of employees84%

63%

16%

37%34%

46%

33%28%

33%26%

18%13%

50%

39%32%

48%

IT Line ofbusiness

Director VP/GM C-Level 500 -999

1,000 - 4,999

5,000+


custom research

report

Cloud providers may also help companies move to

the cloud with libraries of easy-to-use analytic algo-

rithms, as well as application programming interfaces

(APIs) to ease the exchange of data among cloud pro-

viders, Reavis says. Many of them provide big data plat-

forms and capabilities, which save companies the cost

of both the equipment and the staff to perform such

analysis themselves, says MIT Sloan’s Stuart Madnick.

Conclusion

Based on our survey results, the mega-trends that

make the cloud so essential — the need for agility, flex-

ibility and security for ever-rising amounts of data —

continue to accelerate. Across industries, geographies

and lines of business, the cloud is increasingly the

preferred choice for companies seeking to move fast,

stay flexible and keep their customers’ data secure.

Furthermore, transformational technologies will only

accelerate this growth. Machine learning is a natural

fit for the flexibility, scalability and integration ca-

pabilities provided by the cloud because it requires

so much data and computing power. So is the IoT, if

cloud providers can build the decentralized networks

of data centers required to quickly analyze data and

deliver the results to decentralized devices.

Although there are still some gaps in cloud confi-

dence and usage, these survey results indicate they

are more significantly due to a lack of education and

awareness than to actual gaps in cloud security, es-

pecially among respondents who are business users.

For today’s cloud user, security and even cost are

yesterday’s conversations. The far more compelling

vision is of an enterprise empowered by the cloud to

continuously deliver ever more efficient, agile and in-

novative applications and services. n

N=155, N=1,822Base: Survey of 509 IT and business executives at midsize and large enterprise organizations worldwideSource: MIT SMR Custom Studio/Google, June 2017 Cloud Security Survey

ML/AI is ideally suited for the cloudWhen survey respondents were asked what drives their workload deployment to the cloud,

those deploying or intending to deploy machine learning/artificial intelligence cited flexibility, speed and the ability to integrate more often — and cost and security less often —

than did those deploying other workloads.

Figure 7

Ability to integrate with new tools/platforms

Increased flexibility in business process and vendor choices

Faster application deployment and iteration

Cost savings

Strategic shift away from on-premises systems

Increased security

41%

31%

40%

32%

31%

27%

19%

31%

19%

22%

14%

23%

ML/AI

All workloads

Documents

Survey Report: Behind the Growing Confidence in Cloud Security Google Cloud... · 4 Survey Report: Behind the Growing Confidence in Cloud Security cstom research report • Specifically