Who Should Protect Our Data in The Cloud?

You would think that cloud service providers are safe havens for your personal data – they all have a ‘security’ component embedded into their offerings and claim to be more secure than, well, my old kryptonite bicycle lock. AWS, Google Cloud, and Azure are seeing their growth and adaptation spiking, as they displace ‘hosting’ solutions and ‘servers’ while technology races ahead. Data has migrated to the cloud, the future is here, and you need this! Ah, but not so fast. Is the ubiquitous cloud providing any more security to you today than AOL provided with a password back in the Stone Age?

Consider the wave of recent data breaches to make this determination. From massive healthcare clearinghouse compromises to the exposure of tens of millions of records within the UK National Health Service and US Office of Personnel Management, patient data remains under constant siege. These incidents have compromised sensitive Social Security numbers and credit card data on a global scale.

Recent high-profile breaches at major medical business associates have proven that even the largest clouds can fail without specific, medical-grade hardening. These incidents underscore a critical reality: standard hosting is a liability in an era of AI-driven ransomware. To survive an audit today, organizations are moving beyond basic passwords toward HIPAA-compliant private cloud hosting providers that treat security as a continuous process. This transition requires a move to HIPAA compliant hosting with multi-factor authentication and audit logs as a mandatory baseline. For a strategic roadmap on securing your infrastructure against these modern threats, explore our HIPAA hosting 2026 compliance guide. By implementing HIPAA hosting requirements for EMR EHR and partnering with the best HIPAA hosting platforms for telehealth 2026, you move your data out of the “Stone Age” and into a resilient, audit-proof future.

Here are several steps that leadership can take today to protect the data that they oversee:

Implement multi factor authentication

A baseline for individual users accessing or updating sensitive personal information for credit cards, financial transactions and increasingly IoT applications.  This service is being developed typically by smaller and early stage companies and is sold to CIOs/CTOs as Authentication as a Service (AAAS). The user no longer requires a password, only a smartphone, pin and biometric identifier.

Develop internal corporate cloud and systems management

CIOs and CTOs should take the lead on developing and establishing solutions and processes for cloud management. Very few cyber solutions providers can offer a one-stop shop for everything a company may require and patching together solutions from different providers can end up being more costly – and less effective – than going with an industry leader.  That said, industry leaders need to stay ahead of the threat prevention and mitigation curve.

Education and Training

CIOs and CTOs should encourage all customers and employees to steer clear from emails or texts from unknown external sources.  You should never ‘click this link’ or ‘access here’ when the email or text sent to you has an unfamiliar suffix or username. One option to ensure internal compliance, is to penalize users who cause harm to internal IT systems, like hikers and snowboarders taking liberty with unauthorized trail access.

Don’t Go on Autopilot

Leadership should discourage employees from leaving passwords and usernames on ‘auto-pilot’ from their work computers, and even from smartphones. Access to bank or social media accounts from remote computers, from places that have public access or from your friend’s device should be restricted. This is not dissimilar to the challenges we are facing with coronavirus – be smart and don’t share germs, data or anything that can infect your health or device(s)

The CIO/CTO role has become much more complicated, and covets not only the mind of a technologist, but also the street smarts, dexterity and ingenuity of the nefarious actor.  This is one more reason why highly performing CIOs and CTOs are often compensated at the level of the COO or even CFO – technology is becoming the most critical, and exposed, role in a company’s portfolio.

The cloud is changing how we interact with entities holding our corporate and personal data.  On the one hand, we perceive an enhanced level of trust and confidence in ‘cloud and hybrid services environments’ while on the other hand we do not fully understand emerging threats associated with cloud provisioning.  The individual needs to take action to prevent data leaks and access, and the services provider’s leadership must do the same – protecting itself and its stakeholders, customers and even shareholders from breaches and hacking.  Cloud and data technology (and adaptation) is moving forward very quickly, in direct correlation to the increasing level of exposure to threats and hazard. The time for action is not tomorrow, but yesterday.

By Martin Mendelsohn