Welcome!

@CloudExpo Authors: Elizabeth White, Zakia Bouachraoui, Yeshim Deniz, Carmen Gonzalez, Pat Romanski

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Opinion

Online Storage Security Flaws Highlight Need for Cloud-Based Compliance

Applying best practices for document compliance is a balancing act.

Blogs are currently seeing intense discussion among users concerning security issues in online document storage services. These are easy services to use for sharing .mp3 files or accessing fat files that they host, from several computers. Yet the fact that authentication data can easily be copied from a user's computer to give other people access to confidential documents emphasizes the need for secure access procedures and reliable solutions to protect confidential documents.

Companies are increasingly running business processes on web-based systems. Storing documents that contain proprietary information shouldn't be freely available to everyone. A cloud-based service can guarantee a secure environment for collaboration and a way to manage sensitive content that complies with data protection and other regulations.

Most cloud-based collaboration offerings are purpose-built with a simple, primary objective of sharing information; security is an afterthought for most products. This becomes a serious risk when you consider that these products typically leave the control of the policy and access to the data in the hands of the collaboration solution provider.

Some of these solutions have attempted to wrap security around the content in such a way that end users can apply document protections, requiring them to define the classification and sharing policies themselves. Of course, by putting the decision into the hands of end users with no experience in defining policy, and without the perspective of the company's central policy standard, poor decisions could be made and sensitive data still exposed to unauthorized access and misuse.

Organizations with hundreds of users have no way to ensure consistent application of security measures. In addition to putting their own documents at risk, using unsecure collaboration applications may result in companies violating their contractual obligations to protect their partners' confidential information.

To address some of these risks, organizations continue to make significant investments in the various perimeter security technologies designed to prevent information from leaving the organization. Some of the technologies used include firewalls, network intrusion prevention systems (IPS), data loss/leak prevention (DLP) and others.

The main problem with this ‘protect the perimeter' approach is that these products focus on protecting at the infrastructure layer, not on the information itself, which must travel outside the network so the company can work within its ecosystem of partners, customers, regulators, vendors, etc. Blocking information from leaving the perimeter usually leads to the dangerous choice of expedience over security: business users take matters into their own hands and circumvent the perimeter infrastructure using unsecure collaboration applications or worse, email attachments.

One possible solution is encryption and operator shielding controls used to protect all documents from unauthorized internal and external attacks. Add dual-factor authentication, digital watermarking, an audit trail to track accesses and changes to documents, put it up as a SaaS application, and you have something interesting. This model is no secret to multinationals such as BMW, Deutsche Telekom and Nycomed. These German companies are using German-engineered document security tools courtesy of Brainloop for such things as contract negotiations, project collaboration, quarterly reporting, technology licensing and other business processes.

Research firm Gartner Inc. is also backing document security via the cloud. In typical analyst fashion, the firm is defining the category as "virtual data rooms," recently publishing reports that point to cloud solutions for securing confidential documents. Penned by analysts Jay Heiser and Jim Murphy, the report (ID# G00211311) defines virtual data rooms as "a class of SaaS primarily used for financial investing communications, and also for life sciences, litigation and other sensitive external collaboration scenarios. Individuals looking for temporary or permanent mechanisms to support a highly controlled sharing of proprietary and regulated data outside of the enterprise should consider one of these services."

Among the vendors listed by Gartner, Brainloop's approach to mitigating document leaks uses a two-part log-in process. Confidential files can only be accessed using a password plus a PIN that is texted to the user's cellphone and is only valid for a short time. Users are assured that the documents they are working on are secure, even if their computer falls into the wrong hands. All activities undertaken in the application are logged in a tamper-proof audit trail. Stored documents are encrypted and can be scheduled for deletion at the end of their lifecycle.

The WikiLeaks fiasco has shed a lot of light on document security and its inherent irony: that the more confidential a document is, the more it's likely to be shared. However the more a document has to be accessed outside the corporate network, the greater the risk of leakage, so a company's most sensitive documents are at much greater risk than other documents.

For companies to protect themselves they should have a framework whereby business users can perform their jobs without worrisome distraction. IT departments can do this by developing a document compliance management strategy that addresses security policies to systematically protect information shared with external parties. Applying best practices for document compliance is a balancing act. Following these tactics can lessen the challenge:

  • Risk-rank all business processes involving flow of information outside the organization to identify threats
  • Define security policies for all types of documents, along with the roles and privileges of each group of users in relation to all types of documents
  • Ensure that SLAs support contractual agreements and certification requirements
  • Support the organization's audit, security and compliance standards
  • Provide two-factor authentication to guard against password fraud
  • Separate content ownership and platform administration
  • Produce audit trails of all document accesses

Following these best practices makes good business sense because if sensitive documents become public, the business loses the trust of all constituents and damages its reputation. This could easily lead to loss of revenue, depressed stock price, decreased market share, and legal issues.

More Stories By Victor Cruz

Victor Cruz is a writer whose articles have appeared in American Venture, Cloud Computing Journal, CommPro.biz, CSO Magazine, Communications News, Computer Technology Review, eSecurity Planet, Harvard Review, Medical Design Technology, and WebSecurity Journal. He has advised some 50 IT companies in the past 20 years on their marketing strategies. You can reach him at vcruz[at]mediapr.net

CloudEXPO Stories
Most modern computer languages embed a lot of metadata in their application. We show how this goldmine of data from a runtime environment like production or staging can be used to increase profits. Adi conceptualized the Crosscode platform after spending over 25 years working for large enterprise companies like HP, Cisco, IBM, UHG and personally experiencing the challenges that prevent companies from quickly making changes to their technology, due to the complexity of their enterprise. An accomplished expert in Enterprise Architecture, Adi has also served as CxO advisor to numerous Fortune executives.
Every organization is facing their own Digital Transformation as they attempt to stay ahead of the competition, or worse, just keep up. Each new opportunity, whether embracing machine learning, IoT, or a cloud migration, seems to bring new development, deployment, and management models. The results are more diverse and federated computing models than any time in our history.
Andrew Keys is co-founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereum.
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throughout enterprises of all sizes.
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science" is responsible for guiding the technology strategy within Hitachi Vantara for IoT and Analytics. Bill brings a balanced business-technology approach that focuses on business outcomes to drive data, analytics and technology decisions that underpin an organization's digital transformation strategy. Bill has a very impressive background which includes CTO at Dell EMC, Vice President of Advertiser Analytics at Yahoo! and Vice President of Analytic Applications at Business Objects.