Welcome!

Cloud Security Authors: Elizabeth White, Pat Romanski, Maria C. Horton, Liz McMillan, Ravi Rajamiyer

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Opinion

Online Storage Security Flaws Highlight Need for Cloud-Based Compliance

Applying best practices for document compliance is a balancing act.

Blogs are currently seeing intense discussion among users concerning security issues in online document storage services. These are easy services to use for sharing .mp3 files or accessing fat files that they host, from several computers. Yet the fact that authentication data can easily be copied from a user's computer to give other people access to confidential documents emphasizes the need for secure access procedures and reliable solutions to protect confidential documents.

Companies are increasingly running business processes on web-based systems. Storing documents that contain proprietary information shouldn't be freely available to everyone. A cloud-based service can guarantee a secure environment for collaboration and a way to manage sensitive content that complies with data protection and other regulations.

Most cloud-based collaboration offerings are purpose-built with a simple, primary objective of sharing information; security is an afterthought for most products. This becomes a serious risk when you consider that these products typically leave the control of the policy and access to the data in the hands of the collaboration solution provider.

Some of these solutions have attempted to wrap security around the content in such a way that end users can apply document protections, requiring them to define the classification and sharing policies themselves. Of course, by putting the decision into the hands of end users with no experience in defining policy, and without the perspective of the company's central policy standard, poor decisions could be made and sensitive data still exposed to unauthorized access and misuse.

Organizations with hundreds of users have no way to ensure consistent application of security measures. In addition to putting their own documents at risk, using unsecure collaboration applications may result in companies violating their contractual obligations to protect their partners' confidential information.

To address some of these risks, organizations continue to make significant investments in the various perimeter security technologies designed to prevent information from leaving the organization. Some of the technologies used include firewalls, network intrusion prevention systems (IPS), data loss/leak prevention (DLP) and others.

The main problem with this ‘protect the perimeter' approach is that these products focus on protecting at the infrastructure layer, not on the information itself, which must travel outside the network so the company can work within its ecosystem of partners, customers, regulators, vendors, etc. Blocking information from leaving the perimeter usually leads to the dangerous choice of expedience over security: business users take matters into their own hands and circumvent the perimeter infrastructure using unsecure collaboration applications or worse, email attachments.

One possible solution is encryption and operator shielding controls used to protect all documents from unauthorized internal and external attacks. Add dual-factor authentication, digital watermarking, an audit trail to track accesses and changes to documents, put it up as a SaaS application, and you have something interesting. This model is no secret to multinationals such as BMW, Deutsche Telekom and Nycomed. These German companies are using German-engineered document security tools courtesy of Brainloop for such things as contract negotiations, project collaboration, quarterly reporting, technology licensing and other business processes.

Research firm Gartner Inc. is also backing document security via the cloud. In typical analyst fashion, the firm is defining the category as "virtual data rooms," recently publishing reports that point to cloud solutions for securing confidential documents. Penned by analysts Jay Heiser and Jim Murphy, the report (ID# G00211311) defines virtual data rooms as "a class of SaaS primarily used for financial investing communications, and also for life sciences, litigation and other sensitive external collaboration scenarios. Individuals looking for temporary or permanent mechanisms to support a highly controlled sharing of proprietary and regulated data outside of the enterprise should consider one of these services."

Among the vendors listed by Gartner, Brainloop's approach to mitigating document leaks uses a two-part log-in process. Confidential files can only be accessed using a password plus a PIN that is texted to the user's cellphone and is only valid for a short time. Users are assured that the documents they are working on are secure, even if their computer falls into the wrong hands. All activities undertaken in the application are logged in a tamper-proof audit trail. Stored documents are encrypted and can be scheduled for deletion at the end of their lifecycle.

The WikiLeaks fiasco has shed a lot of light on document security and its inherent irony: that the more confidential a document is, the more it's likely to be shared. However the more a document has to be accessed outside the corporate network, the greater the risk of leakage, so a company's most sensitive documents are at much greater risk than other documents.

For companies to protect themselves they should have a framework whereby business users can perform their jobs without worrisome distraction. IT departments can do this by developing a document compliance management strategy that addresses security policies to systematically protect information shared with external parties. Applying best practices for document compliance is a balancing act. Following these tactics can lessen the challenge:

  • Risk-rank all business processes involving flow of information outside the organization to identify threats
  • Define security policies for all types of documents, along with the roles and privileges of each group of users in relation to all types of documents
  • Ensure that SLAs support contractual agreements and certification requirements
  • Support the organization's audit, security and compliance standards
  • Provide two-factor authentication to guard against password fraud
  • Separate content ownership and platform administration
  • Produce audit trails of all document accesses

Following these best practices makes good business sense because if sensitive documents become public, the business loses the trust of all constituents and damages its reputation. This could easily lead to loss of revenue, depressed stock price, decreased market share, and legal issues.

More Stories By Victor Cruz

Victor Cruz is a writer whose articles have appeared in American Venture, Cloud Computing Journal, CommPro.biz, CSO Magazine, Communications News, Computer Technology Review, eSecurity Planet, Harvard Review, Medical Design Technology, and WebSecurity Journal. He has advised some 50 IT companies in the past 20 years on their marketing strategies. You can reach him at vcruz[at]mediapr.net

IoT & Smart Cities Stories
The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
There are many examples of disruption in consumer space – Uber disrupting the cab industry, Airbnb disrupting the hospitality industry and so on; but have you wondered who is disrupting support and operations? AISERA helps make businesses and customers successful by offering consumer-like user experience for support and operations. We have built the world’s first AI-driven IT / HR / Cloud / Customer Support and Operations solution.
Codete accelerates their clients growth through technological expertise and experience. Codite team works with organizations to meet the challenges that digitalization presents. Their clients include digital start-ups as well as established enterprises in the IT industry. To stay competitive in a highly innovative IT industry, strong R&D departments and bold spin-off initiatives is a must. Codete Data Science and Software Architects teams help corporate clients to stay up to date with the mod...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
Druva is the global leader in Cloud Data Protection and Management, delivering the industry's first data management-as-a-service solution that aggregates data from endpoints, servers and cloud applications and leverages the public cloud to offer a single pane of glass to enable data protection, governance and intelligence-dramatically increasing the availability and visibility of business critical information, while reducing the risk, cost and complexity of managing and protecting it. Druva's...
BMC has unmatched experience in IT management, supporting 92 of the Forbes Global 100, and earning recognition as an ITSM Gartner Magic Quadrant Leader for five years running. Our solutions offer speed, agility, and efficiency to tackle business challenges in the areas of service management, automation, operations, and the mainframe.
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, compared the Jevons Paradox to modern-day enterprise IT, examin...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO and DXWorldEXPO are two of the most important technology events of the year. Since its launch over eight years ago, @CloudEXPO and DXWorldEXPO have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, we provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading...
DSR is a supplier of project management, consultancy services and IT solutions that increase effectiveness of a company's operations in the production sector. The company combines in-depth knowledge of international companies with expert knowledge utilising IT tools that support manufacturing and distribution processes. DSR ensures optimization and integration of internal processes which is necessary for companies to grow rapidly. The rapid growth is possible thanks, to specialized services an...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...