Ask any organization about which cloud-based applications, platforms, and resources they use, and their responses will vary. Some may immediately know they use Microsoft 365 and perhaps cloud applications such as Dropbox, Salesforce, or Slack. Their developers may be aware they use S3 object cloud storage for application development and testing. Ask the firm’s accountants and they may acknowledge they utilize QuickBooks Online and store corporate data there.
However, the issue organizations face comes not from their use of these cloud applications, platforms, or resources. Rather, using all these services creates a burgeoning data management and protection dilemma.
Storing data in any or all these cloud services does not absolve organizations of their data management and protection responsibilities. Rather, it represents the next frontier in data management and protection organizations must prepare to address and conquer.
Your Data, Your Responsibility
More organizations now recognize they must protect data they store in office suites such as Microsoft 365 or Google Workspace. However, organizational responsibility for managing and protecting data in cloud applications does not begin and end with cloud-based office suites. This responsibility for them to protect data applies to all data they host in all cloud-based applications.
DCIG is unaware of any provider of a cloud-based application that assumes responsibility for their customers’ data. However, some do a better job of disclosing and informing their customers it is their responsibility.
For instance, in its shared responsibility statement, Microsoft openly discloses “the customer” always retain responsibility for their data. Google does the same. Other providers may not be so forthcoming. Regardless of a cloud-based app provider openly disclosing this statement, organizations should assume they have responsibility for their data. This holds true for any cloud-based app used by an organization in which it stores data.
The Growth of Cloud-based Apps
Unfortunately, many organizations fail to grasp just how many cloud-based applications they already use. According to Statista, in 2022 each organization already uses 130 SaaS applications on average. Further, year-over-year, the percentage of SaaS apps used by organizations grew by at least 15% per year.
One data protection provider of cloud-based applications has found that more than 65% of data in these cloud-based applications remains unprotected. The provider also points out it gathers this data from organizations which acknowledge they should protect this data.
Organizations that have not formally begun to protect their data stored in cloud-based applications likely have higher percentages. They may find most or all their data in cloud-based applications remains unprotected.
Data Protection Provided by Cloud-based App Providers
Organizations may wonder, “Is this just a case of data protection providers looking for a problem for their software can solve?” After all, most if not all providers of cloud-based applications already:
- Host their customers’ data in highly available and resilient data centers.
- Limit physical access to these data centers.
- Utilize multiple cyber security offerings such as anti-virus software, firewalls, identity management, and multi-factor authentication, among other security measures.
- Organizations may rightfully argue these cloud-based app providers do protect their data. To understand this issue requires putting the problem associated with protecting data in cloud-based applications in context.
The Need to Protect Data in Cloud-based Applications
Cloud-based application providers do offer data protection primarily in the form of high availability and secure perimeters – both cyber and physical. Their data protection does not, however, extend to protecting their customers’ data from every type of threat. Here are just a few scenarios that illustrate why organizations need data protection above and beyond what their provider offers:
The provider’s data center unexpectedly goes offline. This happened to DCIG with a SaaS-based application it uses. In this case, there was a fire near the data center where DCIG’s provider runs its cloud-based app and hosts its data. This fire prompted the city to shut down utility services to the entire area around where the fire occurred as a precaution. This included the data center where the cloud-based app provider was based.
Thankfully, the cloud-based application provider’s data center was unaffected by the fire. However, it took a few days for the data center to fully come back online. Until it did, DCIG had no access to either the application or its data. Further, had the data center remained offline indefinitely, it remains unclear if DCIG could have recovered or retrieved its data.
A ransomware attack occurs inside the cloud app provider’s data center. Ransomware can attack any organization, including cloud-based application providers. In this real-world scenario, ransomware got inside a data center where a provider hosted its accounting application.
As part of the attack, the ransomware encrypted customer data stored in the cloud-based app. The provider eventually restored its application after the attack. However, its customers had to restore or re-enter their data into the application. The provider could not perform this task since it could not assume the customer data it possessed was ransomware-free.
User error. Users who accidentally delete or overwrite data still represent the most common reason organizations must restore data. Organizations may find they can perform some restores with the basic tools cloud-based application providers offer.
For instance, individuals can potentially go to their deleted items folder in Outlook and recover an inadvertently deleted email. However, organizations should not rely either on this option or the provider if they need to recover large amounts of data. In these circumstances, organizations must perform their own data protection and recovery.
So Many Cloud-based Apps, So Few Data Protection Choices
Organizations might assume they would have multiple data protection providers from which to choose. After all, the average organization already uses more than 130 SaaS applications so surely someone offers software to protect them.
Unfortunately, organizations will find almost no data protection software available to protect data stored in these cloud-based applications. The only notable exceptions where organizations may find multiple available products to protect data in cloud-based applications include these:
- DropBox
- Google Workspaces
- Microsoft 365
- QuickBooks Online
- Salesforce
- Slack
Any organization needing to protect data in any other cloud-based applications will find few, if any, solutions at all. There only exists a handful of providers actively developing data protection for data hosted in multiple cloud-based applications. This lack of availability of data protection choices minimally stems from at least the following three factors:
A lack of understanding organizations needs to protect their data in cloud-based applications. Organizations have only now come to terms they need to protect data in Microsoft 365 or Salesforce. They may have yet to realize they need to assume responsibility and back up the data that resides in all their cloud-based applications. Only once they come to this conclusion will demand for this type of data protection software increase.
With so many cloud-based applications to protect, where does a backup provider begin? Organizations may want to backup data in any number of cloud-based applications. These include database-as-a-service (DBaaS), infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS), among others. Some providers estimate the total number of cloud-based applications could reach into the tens of thousands. They must first prioritize where to begin and then develop integrations for them. Completing this integration for some of them, much less all of them, represents a monumental task.
Cloud-based applications lack many APIs or have no APIs to facilitate backups and restores. Organizations are not the only ones that have yet to fully grasp they need to protect data in cloud-based applications. Their providers may also fail to see the need for organizations to use third-party software to protect data stored in their application. As a result, providers do not offer APIs backup software can use to protect data in their application.
Next Best Steps
Organizations may feel hopeless as they consider the scope of this challenge of protecting data in their cloud-based applications. They have few or no backup options to protect data even though they use more cloud-based applications. Thankfully, organizations can take at least three steps now:
Backup data in the cloud-based applications that have the greatest visibility in their organization. If your organization uses Survey Monkey and loses data stored there, no one may yet know or care. However, if data loss occurs in Microsoft 365, the internal repercussions may be more severe.
Begin by protecting data in these highly visible cloud-based applications and then tackle others. Prioritize data protection software that includes artificial intelligence (AI) which detects unusual activity which helps stop data loss and theft.
Regularly export data out of other cloud-based applications. Almost every cloud-based application provides an option to export data out of them. While manual and tedious, organizations can minimally get copies of their data out of these services. Depending on the amount of data and its criticality, organizations may want to schedule exports weekly, monthly, or quarterly.
Identify and partner with a provider focused on cloud-based application data protection at scale. Organizations concerned about automating and centralizing data protection of their cloud-based applications need to take a more sophisticated approach. They simply cannot go out and buy software that protects them all since it does not exist. In this scenario, they must identify a provider who gives them the tools to automate cloud-based data protection. A few such providers already exist. They ideally will offer AI in their tool so it can automatically write the code to protect the data in these cloud-based applications.
