Who Should Protect Our Data?

Who Should Protect Our Data in The Cloud?

You would think that cloud service providers are safe havens for your personal data – they all have a ‘security’ component embedded into their offerings and claim to be more secure than, well, my old kryptonite bicycle lock. AWS, Google Cloud and Azure are seeing their growth and adaptation spiking, as they displace ‘hosting’ solutions and ‘servers’ while technology races ahead.  Data has migrated to the cloud, the future is here, and you need this! Ah, but not so fast. Is the ubiquitous cloud providing any more security to you today than AOL provided with a password back in the Stone Age?  

Consider a few very recent data ‘leaks’ to make this determination.: Facebook – 540 million personal records accessed in a 2019 breach, UK National Health Service and US Office of Personnel Management -tens of millions of citizens’ personal data compromised, Equifax – 140 million personal data records accessed by unauthorized hackers, including Social Security numbers and credit card data.  

Hiding Your Data

In the face of these hacks, we continue to upload our data to the cloud. Why? Ease of use. It’s hard to break away from platforms that allow us to download and share our data from anywhere and with anyone. Even better, we don’t have to make too many decisions, as we trust the cloud to protect important internal and external information. But, with great power comes great responsibility. If we’re going to relinquish control to the cloud, then the CIOs and CTOs that oversee these platforms need to protect us. 

The role of the CIO/CTO should be to think strategically regarding longer term threats and challenges, of course, while at the same time keeping close to dark web and hacker industry developments. Here are several steps that leadership can take today to protect the data that they oversee:

Implement multi factor authentication 

A baseline for individual users accessing or updating sensitive personal information for credit cards, financial transactions and increasingly IoT applications.  This service is being developed typically by smaller and early stage companies and is sold to CIOs/CTOs as Authentication as a Service (AAAS). The user no longer requires a password, only a smartphone, pin and biometric identifier.  

Develop internal corporate cloud and systems management

CIOs and CTOs should take the lead on developing and establishing solutions and processes for cloud management. Very few cyber solutions providers can offer a one-stop shop for everything a company may require and patching together solutions from different providers can end up being more costly – and less effective – than going with an industry leader.  That said, industry leaders need to stay ahead of the threat prevention and mitigation curve.  

Education and Training

CIOs and CTOs should encourage all customers and employees to steer clear from emails or texts from unknown external sources.  You should never ‘click this link’ or ‘access here’ when the email or text sent to you has an unfamiliar suffix or username. One option to ensure internal compliance, is to penalize users who cause harm to internal IT systems, like hikers and snowboarders taking liberty with unauthorized trail access.

Don’t Go on Autopilot

Leadership should discourage employees from leaving passwords and usernames on ‘auto-pilot’ from their work computers, and even from smartphones. Access to bank or social media accounts from remote computers, from places that have public access or from your friend’s device should be restricted. This is not dissimilar to the challenges we are facing with coronavirus – be smart and don’t share germs, data or anything that can infect your health or device(s)

The CIO/CTO role has become much more complicated, and covets not only the mind of a technologist, but also the street smarts, dexterity and ingenuity of the nefarious actor.  This is one more reason why highly performing CIOs and CTOs are often compensated at the level of the COO or even CFO – technology is becoming the most critical, and exposed, role in a company’s portfolio.  

The cloud is changing how we interact with entities holding our corporate and personal data.  On the one hand, we perceive an enhanced level of trust and confidence in ‘cloud and hybrid services environments’ while on the other hand we do not fully understand emerging threats associated with cloud provisioning.  The individual needs to take action to prevent data leaks and access, and the services provider’s leadership must do the same – protecting itself and its stakeholders, customers and even shareholders from breaches and hacking.  Cloud and data technology (and adaptation) is moving forward very quickly, in direct correlation to the increasing level of exposure to threats and hazard. The time for action is not tomorrow, but yesterday.

By Martin Mendelsohn

Growing Up.png
Disaster Recovery Plan.png
Disaster Plan.png
The Backup.png
Alex Tkatch
Best Practices for Designing and Executing a Product Launch Nothing in entrepreneurial life is more exciting, frustrating, time-consuming and uncertain than launching a new product. Creating something new and different can be exhilarating, assuming everything ...
Kelly Dyer
Achieving Data Security Compliance As individuals, we go through life sharing information about ourselves in every aspect of our daily existence. From credit checks for securing a loan, through to entire personal and family medical ...
Matrix
When sci-fi films like Tom Cruise’s Oblivion depict humans living in the clouds, we imagine that humanity might one day leave our primitive dwellings attached to the ground and ascend to floating castles in the ...
Rakesh Soni
Multi-tenant clouds are becoming more popular than ever because they're incredibly cost effective and easy to set up. If you're considering switching your business over to a multi-tenant cloud platform, this article is for you ...
Bi Tools
BI Tools For Data Scientists Many data scientists prefer to use open-source framework to code scripts; after all, it’s something they already trust to work. Business intelligence tools like Qlik Sense, Power BI, or Tableau, ...
  • Plural Site

    Pluralsite

    Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization.

  • Isc2

    ISC2

    (ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees. If you want a job in cybersecurity, this is the route to take.

  • App Academy

    App Academy

    Immersive software engineering programs. No experience required. Pay $0 until you're hired. Join an online info session to learn more

  • Cybrary

    Cybrary

    CYBRARY Open source Cyber Security learning. Free for everyone, forever. The world's largest cyber security community. Cybrary provides free IT training and paid IT certificates. Courses for beginners, intermediates, and advanced users are available.