Who Should Protect Our Data?

Who Should Protect Our Data in The Cloud?

You would think that cloud service providers are safe havens for your personal data – they all have a ‘security’ component embedded into their offerings and claim to be more secure than, well, my old kryptonite bicycle lock. AWS, Google Cloud and Azure are seeing their growth and adaptation spiking, as they displace ‘hosting’ solutions and ‘servers’ while technology races ahead.  Data has migrated to the cloud, the future is here, and you need this! Ah, but not so fast. Is the ubiquitous cloud providing any more security to you today than AOL provided with a password back in the Stone Age?  

Consider a few very recent data ‘leaks’ to make this determination.: Facebook – 540 million personal records accessed in a 2019 breach, UK National Health Service and US Office of Personnel Management -tens of millions of citizens’ personal data compromised, Equifax – 140 million personal data records accessed by unauthorized hackers, including Social Security numbers and credit card data.  

Hiding Your Data

In the face of these hacks, we continue to upload our data to the cloud. Why? Ease of use. It’s hard to break away from platforms that allow us to download and share our data from anywhere and with anyone. Even better, we don’t have to make too many decisions, as we trust the cloud to protect important internal and external information. But, with great power comes great responsibility. If we’re going to relinquish control to the cloud, then the CIOs and CTOs that oversee these platforms need to protect us. 

The role of the CIO/CTO should be to think strategically regarding longer term threats and challenges, of course, while at the same time keeping close to dark web and hacker industry developments. Here are several steps that leadership can take today to protect the data that they oversee:

Implement multi factor authentication 

A baseline for individual users accessing or updating sensitive personal information for credit cards, financial transactions and increasingly IoT applications.  This service is being developed typically by smaller and early stage companies and is sold to CIOs/CTOs as Authentication as a Service (AAAS). The user no longer requires a password, only a smartphone, pin and biometric identifier.  

Develop internal corporate cloud and systems management

CIOs and CTOs should take the lead on developing and establishing solutions and processes for cloud management. Very few cyber solutions providers can offer a one-stop shop for everything a company may require and patching together solutions from different providers can end up being more costly – and less effective – than going with an industry leader.  That said, industry leaders need to stay ahead of the threat prevention and mitigation curve.  

Education and Training

CIOs and CTOs should encourage all customers and employees to steer clear from emails or texts from unknown external sources.  You should never ‘click this link’ or ‘access here’ when the email or text sent to you has an unfamiliar suffix or username. One option to ensure internal compliance, is to penalize users who cause harm to internal IT systems, like hikers and snowboarders taking liberty with unauthorized trail access.

Don’t Go on Autopilot

Leadership should discourage employees from leaving passwords and usernames on ‘auto-pilot’ from their work computers, and even from smartphones. Access to bank or social media accounts from remote computers, from places that have public access or from your friend’s device should be restricted. This is not dissimilar to the challenges we are facing with coronavirus – be smart and don’t share germs, data or anything that can infect your health or device(s)

The CIO/CTO role has become much more complicated, and covets not only the mind of a technologist, but also the street smarts, dexterity and ingenuity of the nefarious actor.  This is one more reason why highly performing CIOs and CTOs are often compensated at the level of the COO or even CFO – technology is becoming the most critical, and exposed, role in a company’s portfolio.  

The cloud is changing how we interact with entities holding our corporate and personal data.  On the one hand, we perceive an enhanced level of trust and confidence in ‘cloud and hybrid services environments’ while on the other hand we do not fully understand emerging threats associated with cloud provisioning.  The individual needs to take action to prevent data leaks and access, and the services provider’s leadership must do the same – protecting itself and its stakeholders, customers and even shareholders from breaches and hacking.  Cloud and data technology (and adaptation) is moving forward very quickly, in direct correlation to the increasing level of exposure to threats and hazard. The time for action is not tomorrow, but yesterday.

By Martin Mendelsohn

Mark Greenlaw
Free Cloud Migrations are Expensive The cloud is becoming the primary place where work gets done. By 2025, Gartner estimates that enterprise spending on public cloud computing will overtake traditional IT hardware. Why? One reason ...
Security Breach 10 Useful Cloud Security Tools
Cloud Security Tools Cloud providing vendors need to embed cloud security tools within their infrastructure. They should not emphasize keeping high uptime at the expense of security. Cloud computing has become a business solution for ...
Josh Miramant
Benefits of a Data-First Culture When it comes to analytics solutions, centralization versus decentralization is one constant tension that’s plagued data architects for years now. Both options offer their own sets of advantages and disadvantages, ...
Gilad David Maayan
Network Security in the Public Cloud What is Network Security? Network security is a strategic approach to securing an organization’s resources and data across the corporate network. It helps protect organizations of all sizes, industries, ...
Maxim Melamedov
Trouble is Brewing Cloud Paradise - 2023 Will Determine Company's Long-Term Plans for Cloud Use The relationship between developers and the cloud was practically love at first sight. For years, migration to the cloud in ...
David Discenza
Four Ways to Improve Cybersecurity (Updated: December 9th, 2022 ) Cyber-attacks on businesses have become common place. In fact, it’s estimated that a cyber-attack occurs every 39 seconds. Who are the targets of these attacks? ...
Cybersecurity Bootcamps To Help Build Your Career
Cybersecurity Bootcamps We've discussed the importance of training and the hiring of cybersecurity professionals many times on CloudTweaks over the past 10+ years. Now more than ever as the world enters into a dark era ...
Stacey Farrar
Modern Auth and Exchange Online Migrations Microsoft has phased out Basic Authentication (Basic Auth), replacing it with Modern Authentication (Modern Auth) to provide increased protection and user security. Through this, Microsoft has turned off Basic ...