Organisations around the world continue to store more and more of their information in the cloud. This is fundamentally a good thing, as the cloud is almost always more secure than a local office or a company's own data centre. Unfortunately, security does not always keep pace with the influx of data into the cloud. For example, not all data at rest is encrypted, there is full transparency about what data actually exists in the company’s cloud applications, or Data Loss Prevention (DLP) features are used to protect against various types of data loss. Many companies also allow access to company-approved cloud services from personal devices, which can lead to sensitive information being downloaded from the cloud to an uncontrolled personal device.
For anyone handling sensitive information – not least personal data and customer data – it is extremely important that everything is correctly set up, that you have the right security procedures in place (which are also followed) and full transparency about where and how data is stored and protected.
The regulations governing the handling of personal data have existed for several years, and until now the major American cloud service providers have relied on the Privacy Shield agreement. Since the European Court invalidated Privacy Shield, it is no longer allowed to rely solely on this agreement to demonstrate EU compliance. Instead, it is now up to each individual company to assess whether sufficient protection exists to meet the requirements of GDPR.
Encryption of data can provide such protection for the organisation, but it is important to bear in mind that the burden of proof in this case lies with the individual company. It is therefore the company that must be able to guarantee that no external organisation (such as the US NSA) has broken the current encryption levels. This guarantee is very difficult, if not impossible, for individual organisations to provide.
All in all, we have a situation where the risk of sensitive data falling into the wrong hands is increasing – something that can ultimately also have financial consequences for the companies handling the data.
Below are some important things that everyone handling personal data (such as customer data) must ensure and consider.
Gaining insight into the cloud and protecting sensitive data is not as difficult as it may seem. But of course, it is about knowing where to start and what to focus on. And it concerns technical solutions, policies and procedures, as well as raising awareness among all employees.
Make sure you know the data protection laws that apply in the country where your data will be stored, such as GDPR within the EU, and if there are other laws that may trump national legislation, such as the US CLOUD Act. Remember that it is the domicile country of the cloud service provider that determines which rules apply to data and applications, not the geographical location of the data centre.
When migrating to the cloud, or switching clouds, you need to ensure that your platform and cloud solutions offer the possibility to encrypt data – both when data is stored in the cloud and when data is transmitted or shared with business partners. Also stay up to date on encryption – encryption technologies and processes develop rapidly. Organisations that have not reviewed and updated their encryption methods as needed are often vulnerable to attacks.
Create a device control strategy to identify and control the use of all devices that can store or download data. This not only reduces the risk of malicious things entering your network – it can also help prevent sensitive information from leaking out, either accidentally or intentionally. Use application control to track and limit unnecessary or risky software.
Also consider limiting access to customer information – not everyone in an organisation needs to be able to see customers’ personal information. The fewer people who have a genuine need for access, the fewer opportunities there are for attackers to find a weak point and steal data.
It may also be a good idea to separate your networks. Today’s cybercriminals want more than just a user’s password and some files – they want access to your backend databases, your PoS network and your test network. Therefore, consider separating your networks with powerful firewalls that treat your internal departments as potentially hostile to each other, instead of having one big “internal” defence against the feared "outside".
There are a number of things you should always have in your security toolbox – whether we are talking about protecting personal data in the cloud or elsewhere. For example, ensure you have effective endpoint, network, and email protection that filters out most spam, malware, and files. Teach your employees to be suspicious of emails, especially those with attachments, and to always report unusual emails or attachments to the IT department. Unfortunately, there are still far too many company employees who accidentally download malware by clicking on links or attachments in emails.
Furthermore, you should obviously have rigorous password policies in place, and not allow child names, birthdays or favourite teams to be used as logins to cloud platforms where sensitive data is stored. If available, you should always implement multifactor authentication – in fact, many now talk about completely abolishing passwords and instead using biometric solutions.
So-called "shadow IT" is a situation that arises when employees use countless cloud services without your knowledge. Try to get an overview of which services are actually used in your organisation and how they are used. Inform your employees about how inappropriate it is to move sensitive company data to a private Dropbox or similar. Even if it is “more convenient” right now, it can greatly increase the risk that the information falls into the wrong hands (especially if the password for the Dropbox account is weak or has never been changed).
Rapid and continuous patching is another very important part of your security work. Known but unpatched security holes are one of the most common attack vectors exploited by criminals. Unfortunately, patching is often given low priority and neglected. Therefore, consider purchasing tools or services that manage patching for you. This ensures that your operating system and applications are always updated with the latest security fixes.
Collecting unnecessary customer data is not only a waste of energy and resources, but also provides a larger target for attackers to focus on. It can also easily make customers worried and wonder why you need to collect so much information in the first place. So collect and store only what you really need for business purposes. You can also take it a step further and offer customers the option to choose whether they want to share personal information with you or not.
Instead of always trying to get as much as possible out of customer data (many companies still automatically subscribe their customers to mailings immediately after a transaction), you should, when your company is done with communication with them, consider destroying all data after you have used it. This type of security thinking strengthens customers’ trust in your privacy efforts.
Data protection concerns everyone. Customer security is far too important to be handled by a few selected people. When you have extensive security procedures and policies in place, make sure everyone in your organisation understands them and above all follows them. For example, pay extra attention to ensuring your employees understand the potential risks of using their own devices or networks outside the office.
We are driven by helping our customers achieve greater innovation and cost-effective IT. Would you also like to benefit from the latest in high-performance cloud services?
