The Cloud, Day 20: What About Security?

30 Days With the Cloud: Day 20

It seems like a week doesn’t go by without some sort of data breach incident. As I venture through the 30 Days With the Cloud journey, it occurs to me that I am placing an awful lot of faith in third parties to keep my data protected. So, the inevitable question becomes, “can I trust my data in the cloud?”

If I am going to keep gigabytes upon gigabytes of sensitive data stored online, I need some assurances that it is safe. The data needs to be secured, preferably encrypted, so that it is protected even in the event that the storage that contains it is compromised. But, even encrypting data can be tricky when it comes to third party cloud storage providers.

For example, cloud storage provider Dropbox was at the heart of some controversy last year related to its file encryption. Dropbox claimed that all files are encrypted and protected from unauthorized access, but Dropbox maintained control of the actual encryption keys.

That means that -- although other random people may not be able to access my data -- Dropbox employees can. They may share my data if compelled by law enforcement, or employees might access and view the files themselves. It is strictly forbidden as a matter of policy, but anyone who would surreptitiously view my data probably also lacks the moral compass to care about the policy.

Data stored online needs to be encrypted to protect it from unauthorized access.In defense of Dropbox, there is a reason it maintains control of the encryption keys -- simplicity. While it is more secure to allow customers to control their own data encryption keys, it can also create serious issues when the customer loses those keys and finds out that nobody else -- not even Dropbox -- can access the information. And, customers can still encrypt their data through other means with their own keys if they prefer.

That really seems to be the only viable solution. If I encrypt the data myself, I know that I hold the keys and theoretically only those people I authorize will be able to access my files. But that complicates things, and adds some administrative and processing overhead.

For businesses considering a move to the cloud, there are also compliance mandates to consider. Putting data online comes with some risks, and businesses need to take extra precautions to make sure that data is not exposed or compromised.

For tomorrow’s 30 Days With the Cloud post, I am going to examine the flip-side to this coin, and take a closer look at some ways that my data might actually be in better hands in the cloud.

By Tony Bradley, PCWorld