Securing Data in the Cloud

Storing data in the cloud is standard practice in today’s enterprise. What was once stored on premises is no longer and while now commonplace, the security of data in the cloud is not something to take for granted or to become complacent about.

But how do CIO’s keep company data safe from the threats hidden in VPN’s, downloads and apps?

Many think the immediate and only answer is in the encryption of that data. Encryption definitely has its advantages including its level of complexity makes access harder for threat vectors and it’s more secure than unencrypted data, as long as keys are stored separately and it is updated regularly. However, encryption is better suited for data that is not accessed very often, contradicting the very benefit of storing data in the cloud, easy access, anytime, anywhere.

As more and more daily business is done in the cloud and the use of remote access and BYOD increases, enterprises need to be concerned more than ever about security. External threats are widely known but threats are not just external as many data breaches come from within the organisation. Weak or stolen user credentials are hackers preferred approach and are found in more than 75 percent of all network breaches.

For this reason, just encrypting the data itself is not enough. Monitoring and access control need to be a big part, almost a requirement, of keeping cloud data safe. Organisations need to know who has accessed what, where from and what they are doing with that data, and if the person accessing the data is even allowed to access that particular data.

Data security needs to be a layered approach and one of the layers that can safeguard encryption and provide visibility on employee app use is multi-factor authentication technology that allows controlled access to the data by ensuring that only the right people have access to that data.

Multi-factor authentication technology offers security that requires more than one method of authentication from independent categories of credentials to verify the user’s identity for logins and other transactions.

Multi-factor authentication not only provides organisations with the highest level of factors to validate a user’s identity, it looks at multiple factors surrounding each particular login. These factors include geo-location, network IP, type of system being accessed, time of login etc. wherein all of these factors add context that help to determine the level of trust and whether the user should be authenticated or blocked, which provides organisations with increased confidence that their data is safe.

The majority of data breaches involve the use of valid credentials that are misused including employees accessing third-party resources, downloading apps where work data is being shared to access from remote locations or credentials that have been lost or stolen. It is clear that even if data is encrypted, if someone has access to the data in an uncontrolled way, organizations are still vulnerable.

In fact, ABI Research, also supports the value of multi-factor authentication stating in a recent report, “Enterprises are finally realizing that they should not view MFA as a luxury security technology, one only for IT personnel, managers, and C-Level executives.

With the BYOD culture in enterprises, it is becoming a necessity for businesses to deploy newer authentication technologies to fight detection-resistant malware, phishing attacks, credential theft, rootkit deployments, cross site scripting, and other threats.”

In our world of ever changing cyber threats, to be able to truly exploit the value of the cloud and use the data stored within, organisations need to look beyond the protection that encryption provides and consider multi-factor authentication as it provides the link between enterprise security and employee authentication in the workplace.

Information- Management:         8 in 10 IT Pros Believe Data Is Cloud Safer: