EXECUTIVE SUMMARY

Protecting Corporate Information in the Cloud

©2015 WSJ. Custom Studios, a unit of The Wall Street Journal Advertising Department. The Wall Street Journal news organization was not involved in the creation of this content.

IN COLLABORATION WITH

©2015 WSJ. Custom Studios. 2

ABOUT THE STUDY Keeping Your Data Safe: Protecting Corporate Information in the Cloud is an insights-driven thought leadership study conducted by WSJ. Custom Studios in collaboration with Symantec Corporation. The goal of this research is to better understand worldwide cloud adoption across leading organizations and the challenges associated with its use. This survey also explores attitudes toward security as well as the behaviors that can lead to potential data loss and security breaches.

An online survey was conducted from February to March 2015 among 360 global business and IT executives with 180 respondents from the United States, 60 from the United Kingdom, 60 from Germany and 60 from Japan. Of these, 15% are CEOs, presidents or owners; 14% are CIOs/CTOs/CSOs; 5% are other C-level executives; 13% are heads of business units or EVPs/VPs/directors; 23% are IT/security professionals; and 30% are managers or other business professionals (e.g., engineering, research and development, sales, legal and compliance, etc.).

KEY FINDINGSCloud applications and technologies are becoming increasingly mainstream across organizations worldwide: Two-thirds of global executives now have a cloud strategy in place within their organization. While the majority of executives realize the benefits, data security and privacy concerns remain the biggest challenges of using the cloud. In fact, confidence in the security of cloud applications is subpar at most, and organizations with cloud applications were more likely to have suffered a data breach than organizations without them. This study reveals that employees often engage in high-risk behaviors, either knowingly or unknowingly, that can lead to data loss and breaches. Part of the challenge for organizations will be to create a culture that welcomes new technologies, such as the cloud, to drive business growth and productivity, yet fosters a safe haven for valuable information.

©2015 WSJ. Custom Studios. 3

INTRODUCTIONSeeing Above the HorizonCloud applications and technologies are revolutionizing the way businesses communicate, collaborate and access information. From increased productivity to lower operational costs, organizations around the world are realizing the true value of the cloud, its vast impact on the future of work and its potential to drive business growth and innovation. With revenues expected to surpass $500 billion by 2020, cloud solutions are poised to become the dominant IT model

across organizations.1 In fact, two-thirds of corporate executives worldwide have now adopted cloud solutions, according to the WSJ. Custom Studios/Symantec Corporation survey.

Cloud adoption is highest in Europe, followed by the United States, and lowest in Japan.

Mid-sized to large corporations (i.e., those with more than 500 employees) are more likely to use cloud services than small-sized firms (54% vs. 22%).

Company Cloud Use by

Country

Cloud Use by Company

Size

87%GERMANY

72%UNITED STATES 25%

JAPAN75%UNITED

KINGDOM

54%

Companies with 500+

employees22%

Companies with 99 or

fewer employees

©2015 WSJ. Custom Studios. 4

As cloud technologies become more common, it’s not surprising that nearly three-quarters of C-level executives, including IT leaders, now believe that the benefits of the cloud outweigh any potential risk to corporate data security. This is in stark contrast to opinions held in 2010, where only 17% of executives held the same belief.2

The Cloud’s Biggest Challenge Remains However, this isn’t to say concerns over data security and privacy are abating. In fact, the opposite is true: Among non-users of the cloud, about seven in 10 (68%) cite concerns over data security as the number one roadblock to cloud implementation of any kind within their organization. These concerns are more likely to be echoed by C-level executives than IT management (74% vs. 61%).

Among companies with a cloud strategy, confidence in the cloud’s ability to safely store corporate assets is subpar: Only four in 10 executives worldwide are “very confident” that their company’s confidential and sensitive information is secure when using cloud-based services. Additionally, companies who have adopted cloud services were more likely to have had a security breach in the past year than companies with no cloud—18% vs. 3%. Clearly these results are discouraging, but they demonstrate the complexities and challenges surrounding company-wide cloud adoption.

With security hacks becoming a daily fact of digital life, nearly all executives say safeguarding corporate data (which includes intellectual property, customer data, financial information and records) is a critical business priority.

Employees Don’t Always KnowYet, there’s a dichotomy between what executives say and what they do when it comes to keeping company-sensitive data secure.

Despite the recent high-profile data breaches and increased privacy regulations, employees (including those in IT and top management as well as others) appear to be largely unaware of the behaviors that put corporate and personal data at risk.

79% of corporate executives

surveyed admit to—intentionally or

unintentionally—engaging in behaviors

that wind up placing corporate data at

significant risk of security breach.

©2015 WSJ. Custom Studios. 5

Behaviors That Can Make Corporate Data Vulnerable Of those surveyed, 79% engaged in at least one of these activities:

These risky or rogue behaviors are most prevalent in Europe—highest in Germany (97%) and the United Kingdom (87%)—followed by the United States (79%). In Japan, these behaviors are least prevalent (53%).

Additionally, nearly a quarter of employees used cloud-based services (such as file storage) without IT approval. Using unauthorized cloud or mobile applications can compromise confidential corporate assets and lead to data leaks largely because these applications are unmonitored—that is, the company and IT department lose visibility and control of the information.

With increased work demands and blurred lines between work and personal life, these statistics are not entirely shocking. However, it is surprising that nearly 50% of executives say they don’t think about security risks when transferring files or sharing documents over cloud-based services. These types of relaxed attitudes can lead to significant data loss or breach, not to mention substantial revenue loss and irrevocable reputational damage. Think about the massive losses by multinational corporations that have made the news recently, for instance.

Part of the issue is that many employees believe that data security falls outside their realm. A full half of corporate leaders worldwide say safeguarding corporate information is IT’s problem—not theirs.

uploaded to and stored company documents on a USB stick

emailed company documents from a personal email address

uploaded company documents to file-sharing sites so they could work from other devices or share with others

shared company information and documents via social-networking sites

installed unauthorized software or accessed unauthorized cloud services on a corporate desktop/laptop

installed unauthorized software on corporate devices

53%

51%

44%

38%

24%

22%

©2015 WSJ. Custom Studios. 6

So even though employees say security is a top business priority, at the end of the day, many believe corporate security rests on the shoulders of IT.

Keeping Data Secure When Using the CloudSo what are companies doing to better manage the risk of potential data loss or breach? Worldwide, 71% of corporate executives have increased their technology and security budgets. This percentage jumps to 98% across companies that have suffered from a data breach in the past year. It’s a tall order, but spending additional funds is necessary to keep businesses flowing efficiently and safely.

Additionally, close to eight in 10 have implemented company-wide training initiatives, including new-hire security orientation, to raise security awareness and curb risky behavior. Staggeringly, only 28% have a formalized plan that outlines policies and procedures for reporting and responding to security threats. Clearly, a lot remains to be done.

CONCLUSION Cloud technologies are here to stay: Two-thirds of leading organizations have now embraced the cloud and many believe its benefits outweigh any potential security risk. However, managing security risk and preventing data loss continues to be a business-wide challenge. Employees care about the security of their company’s assets but often overlook potential security risks. Many executives and employees alike are simply unaware of how their behaviors can place their company at risk of data loss or breach. This study reveals a gap between what executives say and do as it relates to data security and illustrates how leading organizations are taking numerous steps to ensure that progress is being made toward better safety controls.

1 Bessemer Venture Partners: State of the Cloud Report, 2015:

www.bvp.com/cloud/cloudreport#sthash.o4mBXBrv.dpuf

2 ISACA IT Risk/Reward Barometer Survey, March 2010:

www.isaca.org/About-ISACA/Press-room/News-Releases/2010/Pages/

ISACA-US-IT-Risk-Reward-Barometer-Survey.aspx

NEW YORK

1211 Avenue of the Americas

9th Floor

New York, NY 10036

LONDON

The News Building

1 London Bridge Street

London SE1 9GF

HONG KONG

25/F, Central Plaza

18 Harbour Road

Wanchai

Hong Kong

Sarah Dale

Vice President, Media Sales

212.597.5729

sarah.dale@dowjones.com

WSJ. Custom Studios

WSJ. Custom Studios, the content marketing division within The Wall Street Journal’s advertising department, crafts stories that

engage consumers and elevate the conversation for brands. Its global team of award-winning editors, designers and interactive

developers are all held to the high standards for which The Wall Street Journal is known, resulting in highly original and credible content that resonates with the client’s target audience.

This work was commissioned by Symantec Corporation.

Symantec Corporation (NASDAQ: SYMC) is an information protection expert that helps people, businesses and governments seeking the freedom to unlock the opportunities technology brings—anytime, anywhere. Founded in April 1982, Symantec, a Fortune 500 company, operating one of the largest global data-intelligence networks, has provided leading security, backup and availability solutions for where vital information is stored, accessed and shared. The company’s more than 19,000 employees reside in more than 50 countries. Ninety-nine percent of Fortune 500 companies are Symantec customers. In fiscal 2015, it recorded revenues of $6.5 billion. To learn more go to www.symantec.com or connect with Symantec at: go.symantec.com/socialmedia.

IN COLLABORATION WITH

©2015 WSJ. Custom Studios, a unit of The Wall Street Journal Advertising Department. The Wall Street Journal news organization was not involved in the creation of this content.