Describe cloud applications
What are cloud applications and how might they affect the security of your organization? Here, you'll learn how to define cloud applications, and get an introduction to the concept of shadow IT and its implications.
How does the cloud impact applications?
First, let's define cloud services—these are computing services that are delivered and accessed over the internet. Cloud services can range from storage and software, to analytics and artificial intelligence. When applications are delivered and accessed like this, they're called cloud applications. There are numerous benefits to delivering and using applications in this way, including:
- Apps can be accessed from anywhere, at any time.
- Apps can be updated rapidly.
- Different versions of the same app can be provided to users based on location, device type, or other criteria.
- The app code is protected and never leaves its origin.
- Apps can be scaled easily and rapidly to meet demand.
We're becoming increasingly more reliant on cloud applications. For example, a banking app might be installed and running on your mobile device, but most its functionality relies on cloud services. In fact, the app might not work at all if you don't have an internet connection. That's a tell-tale sign that it's a cloud application. As we'll see next, the convenience and proliferation of cloud applications doesn't necessarily come without risks.
What is shadow IT?
The introduction of cloud applications has resulted in an increase in the number and types of apps that we can access. Because of the benefits that the cloud provides for developers, more apps have sprung up that appeal to specific organizational use cases. These apps don't need the traditional IT resources, and can be deployed faster. In fact, the average organization might see around 1,000 separate apps used on computers, smartphones, and other devices. Unfortunately, this has also led to a large majority of individuals using nonsanctioned applications that haven't been reviewed and could be noncompliant with an organization's security or compliance policies. These unsanctioned apps are referred to as shadow IT.
The presence of shadow IT means that users could introduce security risks into the organization. For example, a single unauthorized app might enable a cybercriminal to:
- Access critical data.
- Change or remove data.
- Lock data in exchange for ransom.
- Gain control of devices, or even networks.
These are just some of the risks and any of them could lead to serious consequences for an organization and its users. This means that your organization needs to discover and control all shadow IT, by taking a Zero Trust approach to cloud applications.