In the last five years, organisations have increasingly embraced cloud applications to help them innovate and transform their business. Applications that automate sales processes, HR management, collaboration, email and file sharing are growing fast and enabling organisations to meet their needs in a shorter timeframe than ever before.
Cloud applications are ubiquitously employed across all industries. However, there are increased concerns about security and compliance of sensitive information, particularly in banking, insurance and in the public sector. A wide range of regulations and privacy laws make organisations directly responsible for protecting regulated information, but when this data is stored in the cloud, they have less direct control over leaks, theft or forced legal disclosure.
The UK Data Protection Act and the perfect storm
In the UK, the Information Commissioner’s Office (ICO), which has the ability to levy severe financial penalties for companies that breach the Data Protection Act, has assigned responsibility for securing information in the cloud unequivocally to the company that owns the data – not the cloud provider on whose systems it resides.
At the same time, leaks and thefts are occurring with increased frequency. The ICO reported a tenfold increase in UK breaches over the past five years, and a 2012 Ernst & Young survey found that only 38% of organisations implement an adequate security strategy.
A three-step approach to navigating compliance complexities
Though the risks – from malicious hacks to insider threats – can seem high, a holistic approach to cloud information protection can help companies reduce the risks of adopting the cloud.
First is the discovery stage. Before you can protect information in the cloud, you need to know where it is and who has access to it:
• Who should have access to certain information and who should not?
• What content is sensitive, proprietary, or regulated and how can it be identified?
• Where will this data reside in the cloud and what range of regional privacy, disclosure and other laws might apply?
Then, you need to protect the information using the correct tools:
• Encrypt: as a baseline, unbreakable code – like military grade 256-bit AES – can scramble sensitive information into undecipherable gibberish to protect it from unauthorised viewers. Installing a cloud information protection platform at the network’s edge ensures any data moving to the cloud is fully protected before it leaves the organisation.
• Retain keys: keep the keys that encrypt and decipher information under the control of the user organisation. This ensures that all information requests must involve the owner, even if information is stored on a third-party cloud.
• Cloud data loss prevention: customise policies on this to scan, detect and take action to protect information according to its level of sensitivity. This provides an additional level of security and control.
• Cloud malware detection: screen information exchanges, including external and internal user uploaded attachments, in cloud applications in real-time for virus, malware and other embedded threats.
Finally, a recent breakthrough – operations-preserving encryption – has solved encryption’s longstanding problem of breaking cloud application functions. This advancement enables users to search, sort and report on encrypted data in the cloud. Additionally, an open platform capable of supporting all cloud applications and integrating third-party tools provides a stable foundation for protection.
The popularity of the cloud has driven privacy laws and data residency restrictions around the world. Businesses and chief information officers need to collaborate in finding new security models to use the cloud while assuring sensitive information is fully protected. By embracing a new ecosystem of cloud-based security solutions, businesses can safely extend their virtual security perimeter while still complying with privacy regulations.
