The cloud computing market around the world has grown to close to $200 billion. This is a huge jump from the $91 billion spent on cloud computing in 2015.
It is understandable that cloud computing has become popular. It offers several benefits, including low cost, increased employee productivity, and a faster time to market.
However, there are some security concerns when discussing cloud computing and cloud storage that IT departments should be aware of. Even organizations that are not using cloud storage or cloud computing are still at risk because many of them allow employees to bring their own devices to work, which are usually connected to the cloud. For this reason, it is imperative that businesses identify poor cybersecurity practices that could pose a risk to cloud databases.
1. Theft of Intellectual Property
Many organizations are increasing the amount of sensitive data they store in the cloud. It is estimated that more than 20 percent of the files uploaded to the cloud contain sensitive data, including intellectual property.
When cyber criminals breach a cloud service, they get access to this data. In fact, it’s this type of data they are looking for. Even if there is not a breach, certain services pose a risk because of loopholes in their terms and conditions. It is important that organizations scrutinize these terms and conditions to make sure that by uploading their data to the cloud, they are not giving the cloud provider the ability to claim ownership of the data uploaded.
2. Losing Control Over the Actions of End Users
One benefit of using cloud services is that they allow employees to access information from just about anywhere. Cloud services also allow employers to monitor what is going on with their business regardless of where they are. However, a problem arises when employers are not in the loop as to what their workers are using cloud services for.
When companies lose control, their employees could do just about anything. The company would not know about it until it is too late. For example, a disgruntled salesperson who is about to be fired or is about to resign from a company could theoretically download all the customer contacts their employer has, store those on their personal cloud storage, and then use those later once he or she finds a job with a competitor.
Therefore, it is imperative for companies to monitor who has access to their cloud storage and to immediately deprovision employees when they have been terminated or when they quit.
3. Failure to Comply with Regulatory Requirements
HIPAA, FERPA, and GDPR are just a few of the regulatory controls designed to protect customers from having their private information given to others. These laws require that companies know where their data is being stored, who can access it, and how this information is being protected. That applies to cloud services as well. No matter what kind of cloud service you’re using – from accounting tools, to online learning programs – your personal data must be protected properly.
When employees bring their own devices to work or when they store sensitive information on non-work cloud services, they are violating the terms of these regulatory controls. The organization they work for will be in a state of noncompliance. Simply being in a state of noncompliance can have serious consequences. These consequences are only exacerbated if there is a breach of information that is traced back to noncompliance.
Cloud services can be used for data exfiltration. Cyber criminals are creative when they go about doing this. For example, attackers gain access to cloud services. From there, they get access to the company’s sensitive data.
Cyber criminals can split the data into compressed files that have the same size. They encrypt the data and then wrap the compressed file with a video file. The original data cannot be read. Since it is hidden in a video format, a format that’s expected to have large file sizes, they can transmit this data with no one being the wiser. The interesting part is that the video files that have the stolen data can play normally.
Later, the attacker can download the video and perform the operation in reverse, unpacking the data and reassembling. They can access the original data set containing the sensitive data they sought to steal. There is also malware that exfiltrates sensitive data via Twitter accounts 140 characters at a time.
4. Lack of Backup Services
When people complain about the cloud-based storage systems they have, one of the complaints they make is that they don’t automatically get backup functions. Instead, some cloud providers require the user to make backups of the data they are going to store in the cloud. To be fair, this is not a problem with every storage provider. Many do offer the ability to automatically backup your data. However, if the cloud storage provider you are using does not give you this safety net, you could face a catastrophic situation in the event of sudden data loss.
5. Loss of Data Privacy
When your data is stored locally, it’s your data. No one can access the data stored locally unless you allow them to. You are able to maintain complete control over the data stored on site. Unfortunately, this complete control does not exist in the cloud.
Much of your relationship with your cloud provider is based on trust. This is because your data is stored somewhere else. You have to trust that your cloud provider is going to live up to their end of the deal and make sure that no one else can access your data. Therefore, it’s important to take the time to read the terms and conditions and the privacy policies of any cloud provider before you upload sensitive data to the cloud.
There are several benefits to using cloud services. Especially for small to medium-size businesses, cloud services offer an affordable way for them to improve flexibility, communication, and cooperation between different members of their team. However, there are some legitimate risks brought to the fore by cloud computing. It’s good for your business to weigh the pros and cons. Determine what information you will store in the cloud and make sure you have the security procedures in place to keep your sensitive information safe.
