chris-walker

The Security Gap: What Is Your Core Strength?

The Security Gap

You’re out of your mind if you think blocking access to file sharing services is filling a security gap. You’re out of your mind if you think making people jump through hoops like Citrix and VPNs to get at content is secure. You’re out of your mind if you think putting your content in the cloud is dangerous. The truth is that top tier cloud storage is more secure than most organizations’ on-premises data centers. Consider that most of the high profile data breaches have been on on-premises data centers.

During an Enterprise Content Management (ECM) assessment project, I mentioned to a client (in Canada) that I was willing to bet that some of their users were using consumer file sharing services. There were noddings of heads, murmurs of assent, and an “OMG how does he know?

cloud-client-shocked

(Image Source: Shutterstock)

In a meeting less than five hours after I mentioned it, an executive from one of the stakeholder groups got a call from security stating that her team was violating policy by using a well known consumer grade file sync and share (FSS). This client had deployed an ECM platform; one of the key drivers for the platform was sharing of content among collaborators. Consumer grade FSS services were not supposed to be necessary. One of the key inhibitors is Citrix.

What Options?

cloud-cloudtweaks-comicSo, what do the users do? They email documents to each other. They store stuff on local drives. They get laptops with intellectual property and personal information stolen, and can’t wipe the laptops or recover the content. They use cloud services to store sensitive information. And security struts around proudly thinking they’ve done something. They have; they’ve created a security hole bigger than the one they tried to plug with Citrix.

I mentioned to the client that they may want to use an Enterprise File Syncing and Sharing (EFSS) service. Their Director of IT Infrastructure told me that the executives were scared of any cloud service that stores data in the U.S. because of the PATRIOT act. Really? Do they not know that Canada has an equally odious piece of legislation? Do they not realize that if the U.S. government wants to get at stuff in Canadian data centres they will? And dig this … some of the better known cloud providers have been working on tools that would let the customer (that’s you, btw) maintain control of, and access to, encryption keys. No more sneak attacks by the government. Hey, they can still come to you and ask, but at least you’ll know, no? Can you imagine!?!

Blocking access to file sharing services doesn’t work. People will find other ways to connect (e.g.: phones make great wi-fi access points) or email documents around.

Instead of blocking access to consumer services, IT and security ought to:

  1. find out why staff is using the services in the first place;
  2. identify and provision SECURE enterprise grade services;
  3. develop appropriate policies for using EFSS services, including remedial action for violating the policies.

If staff are using consumer services to share business content, it’s a pretty safe bet something is wrong with the corporately provided tools. Fix them.

Part of the fix may actually be to provision EFSS to staff. Think about this for a moment; EFSS providers make money by providing a secure way for people to share content and collaborate.

How do you make money? What’s your core strength?

By Chris Walker

Chris Walker

Chris is an independent consultant that is involved in the Information and Content Management space. Chris is also a prominent keynote speaker and writer who has published articles on sites such as CMS Wire and Tech Target.

View Website

CONTRIBUTORS

How B2B Ecosystems & (Big) Data Can Transform Sales and Marketing Practices

How B2B Ecosystems & (Big) Data Can Transform Sales and Marketing Practices

B2B Ecosystems & (Big) Data Managing your relationships with customers, suppliers, and partners and constantly improving their experience is a ...
The Myths Vs Facts of Governance, Risk and Compliance

The Myths Vs Facts of Governance, Risk and Compliance

Governance, Risk, Compliance As disruptive technology changes the way businesses operate and communicate internally and externally, companies are facing increasing ...
How Artificial Intelligence Is Revolutionising Enterprise Software In 2017

How Artificial Intelligence Is Revolutionising Enterprise Software In 2017

Artificial Intelligence Is Revolutionising Enterprise 81% of IT leaders are currently investing in or planning to invest in Artificial Intelligence ...
Why An Inside-Out Approach to Cloud Security Is Your Safest Bet

Why An Inside-Out Approach to Cloud Security Is Your Safest Bet

Cloud Security In September, McKinsey released what might be looked back upon as a seminal survey. It opened the report ...
Four Recurring Revenue Imperatives

Four Recurring Revenue Imperatives

Revenue Imperatives “Follow the money” is always a good piece of advice, but in today’s recurring revenue-driven market, “follow the ...
The Cloudification of Healthcare: Benefits and Risks

The Cloudification of Healthcare: Benefits and Risks

Cloud Healthcare: Benefits and Risks Many organizations are moving most of their business-critical applications and workloads to the cloud. The ...
SCRaaS Screen as a Service

(SCRaaS) Screen as a Service and the Potential Possibilities

SCRaaS Screen as a Service Excuse me; I need to duck into this telephone booth and turn into Spreadsheet (non-gender ...
What Is Artificial Intelligence? I Can't Define It, But I Know It When I See It

What Is Artificial Intelligence? I Can’t Define It, But I Know It When I See It

What Is Artificial Intelligence? When considering how to draw the line between whether an application is AI or not, I’m ...

NEWS

Cloud Security Alliance Issues New Code of Conduct for GDPR Compliance

Cloud Security Alliance Issues New Code of Conduct for GDPR Compliance

EDINBURGH, Scotland, Nov. 21, 2017 /PRNewswire-USNewswire/ -- The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices ...
HPE CEO Whitman's surprise exit stumps Wall Street

HPE CEO Whitman’s surprise exit stumps Wall Street

(Reuters) - Shares of Hewlett Packard Enterprise Co (HPE.N) fell 6 percent on Wednesday after Chief Executive Officer Meg Whitman’s ...
OVH Announces New Hosted Private Cloud Offerings for US Market

OVH Announces New Hosted Private Cloud Offerings for US Market

OVH delivers next-generation services for hosted private cloud, disaster recovery, and hybridity leveraging industry-leading solutions RESTON, VA--(Marketwired - Nov 20, ...

SPONSORS

Viewing Digital Payments as a Boulevard of Commerce

Viewing Digital Payments as a Boulevard of Commerce

Digital Payments A boulevard is a wide street that runs in two directions and usually has a median in the ...
The Skill & Training Mandates of Big Data

The Skill & Training Mandates of Big Data

Big Data Mandates For some years a dearth of data scientists and analysts has caused concern, with McKinsey expecting a ...
Security: The Goodwill Virus That Keeps On Giving

Security: The Goodwill Virus That Keeps On Giving

The Goodwill Virus When Caitlyn Jenner officially introduced herself to the world by way of a Vanity Fair cover story ...