Welcome!

@CloudExpo Authors: Yeshim Deniz, Carmen Gonzalez, Zakia Bouachraoui, Pat Romanski, Liz McMillan

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Opinion

Online Storage Security Flaws Highlight Need for Cloud-Based Compliance

Applying best practices for document compliance is a balancing act.

Blogs are currently seeing intense discussion among users concerning security issues in online document storage services. These are easy services to use for sharing .mp3 files or accessing fat files that they host, from several computers. Yet the fact that authentication data can easily be copied from a user's computer to give other people access to confidential documents emphasizes the need for secure access procedures and reliable solutions to protect confidential documents.

Companies are increasingly running business processes on web-based systems. Storing documents that contain proprietary information shouldn't be freely available to everyone. A cloud-based service can guarantee a secure environment for collaboration and a way to manage sensitive content that complies with data protection and other regulations.

Most cloud-based collaboration offerings are purpose-built with a simple, primary objective of sharing information; security is an afterthought for most products. This becomes a serious risk when you consider that these products typically leave the control of the policy and access to the data in the hands of the collaboration solution provider.

Some of these solutions have attempted to wrap security around the content in such a way that end users can apply document protections, requiring them to define the classification and sharing policies themselves. Of course, by putting the decision into the hands of end users with no experience in defining policy, and without the perspective of the company's central policy standard, poor decisions could be made and sensitive data still exposed to unauthorized access and misuse.

Organizations with hundreds of users have no way to ensure consistent application of security measures. In addition to putting their own documents at risk, using unsecure collaboration applications may result in companies violating their contractual obligations to protect their partners' confidential information.

To address some of these risks, organizations continue to make significant investments in the various perimeter security technologies designed to prevent information from leaving the organization. Some of the technologies used include firewalls, network intrusion prevention systems (IPS), data loss/leak prevention (DLP) and others.

The main problem with this ‘protect the perimeter' approach is that these products focus on protecting at the infrastructure layer, not on the information itself, which must travel outside the network so the company can work within its ecosystem of partners, customers, regulators, vendors, etc. Blocking information from leaving the perimeter usually leads to the dangerous choice of expedience over security: business users take matters into their own hands and circumvent the perimeter infrastructure using unsecure collaboration applications or worse, email attachments.

One possible solution is encryption and operator shielding controls used to protect all documents from unauthorized internal and external attacks. Add dual-factor authentication, digital watermarking, an audit trail to track accesses and changes to documents, put it up as a SaaS application, and you have something interesting. This model is no secret to multinationals such as BMW, Deutsche Telekom and Nycomed. These German companies are using German-engineered document security tools courtesy of Brainloop for such things as contract negotiations, project collaboration, quarterly reporting, technology licensing and other business processes.

Research firm Gartner Inc. is also backing document security via the cloud. In typical analyst fashion, the firm is defining the category as "virtual data rooms," recently publishing reports that point to cloud solutions for securing confidential documents. Penned by analysts Jay Heiser and Jim Murphy, the report (ID# G00211311) defines virtual data rooms as "a class of SaaS primarily used for financial investing communications, and also for life sciences, litigation and other sensitive external collaboration scenarios. Individuals looking for temporary or permanent mechanisms to support a highly controlled sharing of proprietary and regulated data outside of the enterprise should consider one of these services."

Among the vendors listed by Gartner, Brainloop's approach to mitigating document leaks uses a two-part log-in process. Confidential files can only be accessed using a password plus a PIN that is texted to the user's cellphone and is only valid for a short time. Users are assured that the documents they are working on are secure, even if their computer falls into the wrong hands. All activities undertaken in the application are logged in a tamper-proof audit trail. Stored documents are encrypted and can be scheduled for deletion at the end of their lifecycle.

The WikiLeaks fiasco has shed a lot of light on document security and its inherent irony: that the more confidential a document is, the more it's likely to be shared. However the more a document has to be accessed outside the corporate network, the greater the risk of leakage, so a company's most sensitive documents are at much greater risk than other documents.

For companies to protect themselves they should have a framework whereby business users can perform their jobs without worrisome distraction. IT departments can do this by developing a document compliance management strategy that addresses security policies to systematically protect information shared with external parties. Applying best practices for document compliance is a balancing act. Following these tactics can lessen the challenge:

  • Risk-rank all business processes involving flow of information outside the organization to identify threats
  • Define security policies for all types of documents, along with the roles and privileges of each group of users in relation to all types of documents
  • Ensure that SLAs support contractual agreements and certification requirements
  • Support the organization's audit, security and compliance standards
  • Provide two-factor authentication to guard against password fraud
  • Separate content ownership and platform administration
  • Produce audit trails of all document accesses

Following these best practices makes good business sense because if sensitive documents become public, the business loses the trust of all constituents and damages its reputation. This could easily lead to loss of revenue, depressed stock price, decreased market share, and legal issues.

More Stories By Victor Cruz

Victor Cruz is a writer whose articles have appeared in American Venture, Cloud Computing Journal, CommPro.biz, CSO Magazine, Communications News, Computer Technology Review, eSecurity Planet, Harvard Review, Medical Design Technology, and WebSecurity Journal. He has advised some 50 IT companies in the past 20 years on their marketing strategies. You can reach him at vcruz[at]mediapr.net

CloudEXPO Stories
The Crypto community has run out of anarchists, libertarians and almost absorbed all the speculators it can handle, the next 100m users to join Crypto need a world class application to use. What will it be? Alex Mashinsky, a 7X founder & CEO of Celsius Network will discuss his view of the future of Crypto.
In an age of borderless networks, security for the cloud and security for the corporate network can no longer be separated. Security teams are now presented with the challenge of monitoring and controlling access to these cloud environments, as they represent yet another frontier for cyber-attacks. Complete visibility has never been more important-or more difficult. Powered by AI, Darktrace's Enterprise Immune System technology is the only solution to offer real-time visibility and insight into all parts of a network, regardless of its configuration. By learning a ‘pattern of life' for all networks, devices, and users, Darktrace can detect threats as they arise and autonomously respond in real time - all without impacting server performance.
Today, Kubernetes is the defacto standard if you want to run container workloads in a production environment. As we set out to build our next generation of products, and run them smoothly in the cloud, we needed to move to Kubernetes too! In the process of building tools like KubeXray and GoCenter we learned a whole bunch. Join this talk to learn how to get started with Kubernetes and how we got started at JFrog building our new tools. After the session you will know: How we got to Kubernetes (and why we chose it)
In a recent survey, Sumo Logic surveyed 1,500 customers who employ cloud services such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). According to the survey, a quarter of the respondents have already deployed Docker containers and nearly as many (23 percent) are employing the AWS Lambda serverless computing framework. It's clear: serverless is here to stay. The adoption does come with some needed changes, within both application development and operations. That means serverless is also changing the way we leverage public clouds. Truth-be-told, many enterprise IT shops were so happy to get out of the management of physical servers within a data center that many limitations of the existing public IaaS clouds were forgiven. However, now that we've lived a few years with public IaaS clouds, developers and CloudOps pros are giving a huge thumbs down to the...
10ZiG Technology is a leading provider of endpoints for a Virtual Desktop Infrastructure environment. Our fast and reliable hardware is VMware, Citrix and Microsoft ready and designed to handle all ranges of usage - from task-based to sophisticated CAD/CAM users. 10ZiG prides itself in being one of the only companies whose sole focus is in Thin Clients and Zero Clients for VDI. This focus allows us to provide a truly unique level of personal service and customization that is a rare find in the industry. We offer a multitude of custom embedding options and hardware configurations to ensure our devices are tailor-made to fit seamlessly into the environments of our customers.