What do the cloud based backup services such as Evernote, Dropbox and Spideroak have all in common? In some form or another they all give us the ability to centrally store our digital assets such as our photos, documents, music files, or virtually anything that is digital to their cloud based servers and give us the ability to access them from anywhere in the world. That seems a very cool thing since for many of us it will simplify the storage and retrieval of our digital assets. Just drop it on the cloud and then retrieve whenever you need it. For personal usage i think these services offer great convenience by allowing us to store our files and have them accessed anytime from anywhere. With proper security precautions it shouldn’t be a problem using these services.
In enterprise networks, there should be a careful study of why these services are needed, who should have access to them, and what information is or is not allowed to be posted to these services. With the proliferation of these cloud services, their usage becomes a real concern because of the opportunity it presents for sensitive corporate to leave the corporate boundary. For this reason i think it should be an important topic that should visible on the radar of IT security departments.
Most of these services use either the HTTP or HTTPS protocols to send and synchronize data between the client and their servers. Hence, it will be very difficult for the IT controls most organizations have to detect malicious users using these channels to leak important data. Unless a stringent information security policies coupled with technological controls such NAC, DLP, and Web filtering are in place, these channels will fast become proffered channels for data to leave the boundaries of an organization.
Some related articles
- A good article by Darragh Delaney http://blogs.computerworld.com/18443/file_hosting_services_and_their_data_leakage_risks