CloudSwitch Enterprise Gateway to the Cloud

CloudSwitch on Ulitzer

Subscribe to CloudSwitch on Ulitzer: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get CloudSwitch on Ulitzer: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


CloudSwitch Authors: RealWire News Distribution, Elizabeth White, Jeremy Geelan, Liz McMillan, Kevin Jackson

Related Topics: Cloud Computing, Secure Cloud Computing, Cloud Data Analytics

Opinion

Online Storage Security Flaws Highlight Need for Cloud-Based Compliance

Applying best practices for document compliance is a balancing act.

Blogs are currently seeing intense discussion among users concerning security issues in online document storage services. These are easy services to use for sharing .mp3 files or accessing fat files that they host, from several computers. Yet the fact that authentication data can easily be copied from a user's computer to give other people access to confidential documents emphasizes the need for secure access procedures and reliable solutions to protect confidential documents.

Companies are increasingly running business processes on web-based systems. Storing documents that contain proprietary information shouldn't be freely available to everyone. A cloud-based service can guarantee a secure environment for collaboration and a way to manage sensitive content that complies with data protection and other regulations.

Most cloud-based collaboration offerings are purpose-built with a simple, primary objective of sharing information; security is an afterthought for most products. This becomes a serious risk when you consider that these products typically leave the control of the policy and access to the data in the hands of the collaboration solution provider.

Some of these solutions have attempted to wrap security around the content in such a way that end users can apply document protections, requiring them to define the classification and sharing policies themselves. Of course, by putting the decision into the hands of end users with no experience in defining policy, and without the perspective of the company's central policy standard, poor decisions could be made and sensitive data still exposed to unauthorized access and misuse.

Organizations with hundreds of users have no way to ensure consistent application of security measures. In addition to putting their own documents at risk, using unsecure collaboration applications may result in companies violating their contractual obligations to protect their partners' confidential information.

To address some of these risks, organizations continue to make significant investments in the various perimeter security technologies designed to prevent information from leaving the organization. Some of the technologies used include firewalls, network intrusion prevention systems (IPS), data loss/leak prevention (DLP) and others.

The main problem with this ‘protect the perimeter' approach is that these products focus on protecting at the infrastructure layer, not on the information itself, which must travel outside the network so the company can work within its ecosystem of partners, customers, regulators, vendors, etc. Blocking information from leaving the perimeter usually leads to the dangerous choice of expedience over security: business users take matters into their own hands and circumvent the perimeter infrastructure using unsecure collaboration applications or worse, email attachments.

One possible solution is encryption and operator shielding controls used to protect all documents from unauthorized internal and external attacks. Add dual-factor authentication, digital watermarking, an audit trail to track accesses and changes to documents, put it up as a SaaS application, and you have something interesting. This model is no secret to multinationals such as BMW, Deutsche Telekom and Nycomed. These German companies are using German-engineered document security tools courtesy of Brainloop for such things as contract negotiations, project collaboration, quarterly reporting, technology licensing and other business processes.

Research firm Gartner Inc. is also backing document security via the cloud. In typical analyst fashion, the firm is defining the category as "virtual data rooms," recently publishing reports that point to cloud solutions for securing confidential documents. Penned by analysts Jay Heiser and Jim Murphy, the report (ID# G00211311) defines virtual data rooms as "a class of SaaS primarily used for financial investing communications, and also for life sciences, litigation and other sensitive external collaboration scenarios. Individuals looking for temporary or permanent mechanisms to support a highly controlled sharing of proprietary and regulated data outside of the enterprise should consider one of these services."

Among the vendors listed by Gartner, Brainloop's approach to mitigating document leaks uses a two-part log-in process. Confidential files can only be accessed using a password plus a PIN that is texted to the user's cellphone and is only valid for a short time. Users are assured that the documents they are working on are secure, even if their computer falls into the wrong hands. All activities undertaken in the application are logged in a tamper-proof audit trail. Stored documents are encrypted and can be scheduled for deletion at the end of their lifecycle.

The WikiLeaks fiasco has shed a lot of light on document security and its inherent irony: that the more confidential a document is, the more it's likely to be shared. However the more a document has to be accessed outside the corporate network, the greater the risk of leakage, so a company's most sensitive documents are at much greater risk than other documents.

For companies to protect themselves they should have a framework whereby business users can perform their jobs without worrisome distraction. IT departments can do this by developing a document compliance management strategy that addresses security policies to systematically protect information shared with external parties. Applying best practices for document compliance is a balancing act. Following these tactics can lessen the challenge:

  • Risk-rank all business processes involving flow of information outside the organization to identify threats
  • Define security policies for all types of documents, along with the roles and privileges of each group of users in relation to all types of documents
  • Ensure that SLAs support contractual agreements and certification requirements
  • Support the organization's audit, security and compliance standards
  • Provide two-factor authentication to guard against password fraud
  • Separate content ownership and platform administration
  • Produce audit trails of all document accesses

Following these best practices makes good business sense because if sensitive documents become public, the business loses the trust of all constituents and damages its reputation. This could easily lead to loss of revenue, depressed stock price, decreased market share, and legal issues.

More Stories By Victor Cruz

Victor Cruz is a writer whose articles have appeared in American Venture, Cloud Computing Journal, CommPro.biz, CSO Magazine, Communications News, Computer Technology Review, eSecurity Planet, Harvard Review, Medical Design Technology, and WebSecurity Journal. He has advised some 50 IT companies in the past 20 years on their marketing strategies. You can reach him at vcruz[at]mediapr.net