Understanding of cloud usage and creating data security policy to avoid risk
Posted by skyhighnetworks on March 4th, 2014
Understand Your Cloud Usage and Exposure
Check this box to agree to the terms and conditions of this website/app/service.No doubt youve seen this countless times, but do you read the 30-page terms and conditions every time you sign up for a new cloud service? When it comes to your companys confidential information, your employees are uploading and downloading data to many services without reading the fine print. These licenses contain details such as who owns the intellectual property you upload to the site and what happens to your data if the cloud provider goes out of business.
Real-life example:
A finance executive at a Fortune 500 company uploaded a confidential presentation to a popular cloud-based presentation service, so she could present quarterly financial results while on the road. What she didnt realize was that even though the presentation wasnt shared publicly, by uploading it to the site she granted cloud-based presentation service a wide-reaching and irrevocable usage license for the presentations content. That key piece of information was hidden in the sites terms and conditions, and IT had no program in place to identify these legal risks and educate employees.
Checklist to protect your organization:
1. Create an inventory of the cloud services employees are using by analyzing files from egress devices (firewalls, proxies, SIEMs)
2. Perform periodic risk assessments on Cloud Security services and compare legal and business security risks across services
3. Update employees as the risk profile of popularly used services increases
Create a Data Security Policy and Enforce It
If youre like most companies, you probably have policies for what types of devices can access your corporate network and which cloud services are allowed or blocked by your firewall. But then there are exceptions, like when Marketing gets permission to use Twitter. Depending on your firewall solution, you may end up allowing a broad social media category that includes numerous riskier services, or even unrelated services that have been misclassified. If youre blocking Twitter you also need to block third party sites and apps that serve as Twitter proxies, like TweetDeck and HootSuite.
Real-life example:
A large US-based financial institution routinely blocked access to cloud storage services over their network. However, when executives requested a policy exception that allowed them access to cloud-based backup service, their IT team had to unlock the entire cloud storage category, which also included higher-risk services like 4shared and DropSend. In the end, several users started using these other services to store confidential, board-level information, putting the company at legal and compliance risk.
Checklist to protect your organization:
1. Bring together IT, Information Security, Compliance, and Legal to develop a comprehensive policy for what devices and cloud services are allowed.
2. Regularly audit the enforcement of policies across your firewall solutions worldwide to ensure consistent enforcement
As an extra step, stop personally identifiable information (PII) from leaving the company by extending your DLP solutions to cloud services.
Author :
Skyhigh Networks, the Cloud Security Services company, enables companies to embrace Cloud Security Services with appropriate levels of security, compliance, and governance while lowering overall risk and cost. With customers in financial services, healthcare, high technology, media, manufacturing, and legal verticals, the company was a finalist for the RSA Conference 2013 Most Innovative Company award and was recently named a "Cool Vendor" by Gartner, Inc. Headquartered in Cupertino, Calif., Skyhigh Networks is led by an experienced team and is venture-backed by Greylock Partners and Sequoia Capital. For more information, visit us at http://www.skyhighnetworks.com or follow us on Twitter@skyhighnetworks.
