Tackling Cloud Privacy: Why Services Need to Change Their Security & What You Can Do

Most cloud companies on the internet today look at security from a perimeter stand point, primarily focusing on getting users onto their service, then securing their files inside. This technique still allows for an insecure transfer of data (Information isn’t secured until it’s in the cloud). In order to increase data protection, security needs to be looked at from a data centric stand point. By encrypting files locally, before information is shared or sent into the cloud, an additional layer of security is created that prevents unauthorized users from gaining access to sensitive information.

Perimeter security is online protection that builds secure walls around information, or uses a secure tunnel. So if the perimeter security is compromised, then so is all the sensitive information of inside that perimeter. Many services offer “two-levels” of authentication, but that security only pertains to the walls around information.  For example, your cloud provider has two levels of authentication needed in order to access files, a password and a personal question. If an unauthorized user has both your password and the answer to that question, they can gain access to your account, and thus all your unprotected files.

With “data centric” security, the data itself is secure, not just the perimeter. This type of security uses double level encryption (local encryption and secure tunnel) to provide additional security, so that if one area is hacked, the other remains intact, thus keeping user information secure.  So, if someone accessed your cloud account using your information, they still can’t access your files as they are secure themselves.

Unfortunately, it will take a while for online services to fully realize the problems of perimeter security and to make the transition to data centric, so here are five tips to help you tackle cloud privacy in the meantime:

1.    Know where your information is saved. Being aware of where your files are located helps to ensure document protection. Also, you may not be meeting compliance needs if you are not aware of which country/jurisdiction your files are stored in.

2.    Always back up your data. Ensuring that your data is backed up in more than one place enhances the control of information and prevents accidental damage or loss of files.

3.    Make sure your vendor takes data security seriously. Trusting someone with your data stored in cloud server is a big decision. Read the fine print. Although it is tedious, it may contain the answers you are looking for, like what security precautions they offer, who can see stored content, or if the service provider collects any of your information.

4.    Get references from other users. A user reference will give you a clear picture about your future cloud hosting experience with a cloud provider. Although references do not guarantee anything, if other users with similar security goals are happy with a provider, you may be pleased with them as well.

5.    Encrypt & Use Two Factor Authentication. By encrypting all information and combining it with two-factor authentication, typically a physical token and a security code, you create a tougher layer of security that ensures data retention and file control.