When you move to cloud storage, does governance carry over? How do you make sure that your employees won’t use it to compromise critical data? We've witnessed the challenges when it comes to secure cloud storage as Box, Dropbox, and OneDrive have all been either used or misused to accomplish data breaches.
So, how do you move to the future of storage and communication while still keeping security intact?
Cloud Security Breaches
Two years ago, Travis VanderZanden, a former executive at the ride-sharing company Lyft, made preparations to switch to a job at Uber. Once he was ensconced in his new position, he allegedly took several megabytes of files from Lyft, synced those files into his personal Dropbox and then downloaded them. Apparently, these documents included substantial documentation of Lyft's future plans for expansion, detailed information on its financials, and forecasts for the future.
This incident is on the subject of an extremely contentious court case, and as of now it appears that VanderZanden may avoid serious legal consequences. Regardless of whether VanderZanden is found guilty, can you imagine how much grief could have been avoided if Lyft employees were simply prevented from taking files in the first place?
If you're worrying that others like VanderZanden are lurking in your own organization, you're right to do so. According to a study from 2009, almost sixty percent of former employees walk out of their organization with information that was never meant to be shared. Enabled by secure cloud storage technology, these data thieves are finding it easier than ever to exfiltrate secure information.
When you expand the data loss potential from malicious insiders within your organization and start to look at the risk from accidental misuse, cloud security starts to look a little more problematic. We already know that even something as simple as a URL shortener can allow bad actors to find confidential information. Storing unencrypted data in any shared folder on the cloud is definitely a mistake, and mistakes like this are going to define cloud security. According to Gartner, 95 percent of cloud security failures will be attributable to human error by the year 2020.
What are your options to prevent cloud leakage?
In order to secure cloud storage, you must set up policies related to cloud security. Otherwise, your users will begin to make them for you—and you probably won't like what they come up with. Lured by the convenience of cloud storage, you'll find critical data escaping your enterprise from every endpoint. Some ways to stop this include:
- Preventing all cloud access to a full stop. That’s a bit counterproductive. You might find that people ignore your directive or you might find yourself stuck with some other file-sharing protocol that doesn't scale with the needs of the modern enterprise.
- Lock services that you deem to be less secure. If you block one solution, otherwise well-intentioned people will try to use it anyway or they'll end up picking up an even less secure solution.
- Using the security tools that are built into the cloud solutions themselves. That invokes the specter of a third problem, however—the security that comes with cloud storage can be a bit consumer-grade. Can you choose the level of encryption to use? Do they have robust data-loss prevention? For some of these questions, you won't know the answer until a malicious actor tests your security.
So, what do you do instead?
Adding Governance to the Cloud
With proper governance, your users can use the cloud without misusing the cloud. Safe-T can help make sure that people don't leak important documents over the cloud. With document controls, you can ensure that disgruntled employees don't take their data with them when they leave. The Safe-T Box, our flagship safety product, also enforces authentication in order to broker access to the cloud, applies unbreakable AES encryption and provides data loss prevention, all in a single package.
Even better, Safe-T Box allows enterprises to continue their everyday operations, simply with an extra layer of security attached. Unless your users—actively or accidentally—happen to break one of the security policies that you've set, they'll barely even know they're being protected. Thus, you can minimize any disruption to your business processes, and prevent your users from revolting against an inconvenient security regimen.
To learn more about Safe-T and how we can help you enable access to the cloud without incurring its risks, download Safe-T Box White Paper.