How to Protect Assets in the Cloud
With all the recent cloud computing security breaches – from Home Depot to iCloud to Target – it’s understandable why many businesses have become hesitant to move assets to the cloud. Security in the cloud is a major concern since so much data is stored there, but what threats concern companies the most?
Top Cloud Security Concerns
A recent survey of the Open Data Center Alliance, a consortium of top IT companies, indicated “that around 66 percent of the consortium's members are concerned regarding data security, which is deferring their efforts for cloud computing. A similar survey done in previous years indicated that around 80 percent of the members were skeptic(al) about entering cloud computing due to security concerns”.
Among those top IT concerns include the following:
- Data breaches: Data breaches occur when information that is supposed to be protected is released to an unprotected source. This can happen if someone hacks into the system or if a company unintentionally releases the information by system or user error.
- Data loss: Cloud computing still involves storing information on servers – in this case, third-party servers. Servers that are improperly maintained or updated can fail. Data loss occurs when a disk drive fails and isn’t backed up. If the cloud computing company isn’t backing up data on multiple servers, then data loss can occur.
- Unsecure environments: Most cloud computing services say that they use encryption and secure application programming interfaces (APIs). Encryption helps protect data as it’s being uploaded or downloaded. APIs try to ensure that the application connecting to a service is really a legitimate application. Yet, public APIs are notoriously unsecure, and unauthorized users may still access accounts.
- Hijacking/Denial of Service: Most people don’t associate traffic or account hijacking or denial of service attacks with cloud computing. Still, hackers can steal username and passwords, and then take over cloud-based user accounts. For example, someone could steal a person’s username and password to Amazon.com, which has actually happened to Amazon in the past. Denial of service attacks on cloud services may make it impossible to access data or processes.
How to Protect the Business Data
Data in the cloud should be protected same as it is on on-premises hardware: Use a strong password, and even consider a two-step verification process. Typically, the longer the password is, the harder it is to crack. Two-step verification process adds an extra layer of protection by requiring a code to be sent to a phone or email if a person logs in from a different device. Don’t reuse this password for other devices or services. Never share a password with other people in the organization who don’t have authorization, and don’t write passwords down on sticky notes on a desk or monitor.
Another precaution is to research the cloud service provider. Verify that the provider is a well-known name in the industry. Even the best services may have had breaches, but these companies will often provide additional protections or even options for assisting customers after a breach.
Read through the terms of service, and make sure that data is encrypted on cloud servers. Have a local backup of data in case a data breach or loss occurs.
While for the most part cloud computing is secure, there are still some risks associated with it. Taking precautions and ensuring that the cloud service is legitimate will help protect the business data and processes.
