Are businesses asking the right questions when it comes to cloud security?