Are Employees Putting Organizations at Risk?

According to a recent report released by Forrester Research, the global public cloud market is expected to hit $191 billion by 2020, based on Forrester's last forecast (published in 2011), this represents a 20% increase over the same time period. It also represents a significant increase from where the market is currently, Forrester estimates that the market was public cloud market was $58 billion at the end of 2013.

However, the challenge facing enterprises with cloud adoption is quite concerning. According a recent article published by Computerworld, "There's a tug-of-war tension in the enterprise right now," said Gartner analyst Lydia Leong. "IT administrators very rarely voluntarily want to go with the public cloud. I call this the 'turkeys don't vote for thanksgiving' theory. The people who are pushing for these services are not IT operations people but business people."

There is no doubt that the business owner is making this selection to drive their business and sees little to no risk with their decision. However, IT security and the lack of oversight, digital loss prevention techniques and audit requirements can leave a company in precarious situation.

The question is, how does IT and the business user coexist as a partners and not as roadblocks to business growth? The key is a common product and sales technique. Understanding the business requirements is critical to forming the right partnership. IT needs to focus on delivering products that help the business become more efficient and meet their needs to facilitate business. The business needs to be the buyer, but IT needs to be there to make sure the corporation remains well protected.

One of the very real risks that corporations are facing today is cloud based file sharing, the reality is that these applications can be acquired very easily by the business, unfortunately, there is no way to control what is actually being store outside the firewall or if the service provider even meets corporate standards. Many companies have blocked the most popular URLs to prevent internal use, but Gartner lists over 100+ competitors, many approaching file sharing from a different industry focus, so it is unrealistic to expect an IT department to be able to prevent all files sharing solutions.

This is just one example of the risk that the business faces when they acquire technology without going through the correct process. But IT must also understand, they are not the business, nor must they decided what is best for the business, rather they must learn to deliver the business requirements, while ensuring that the product or service meets with the Corporate Security Standards. Only then wll the risk of Rouge IT applications subside!

Do File Sharing Sites Provide Enough Security?

Whether you are a consumer or a business you must carefully consider what you are willing to put out in the public arena. Even if you believe your data is encrypted or protected by the provider, once it leaves your control, you have to accept the fact that you are relying on someone else to deliver the same level of care to your documents. On May 6th this year, ARS Technica published the following article, “Dropbox disables old shared links after tax returns end up on Google, Vulnerability that may also affect Box sent shared documents to Google AdWords.”

For most consumers, these file sharing sites are an easy way to share pictures with friends and families, but, more and more users are using these sites to store personal data. In fact, file sharing sites are expected to host more than 36% of personal data by 2016. While Dropbox did resolve the aforementioned issue, the question is not whether it is good enough, but rather when will the next vulnerability occur?

As more and more businesses move to increase collaborative efforts between their employees and trading partners and utilize public File Sharing Sites, the Security Team has to be concerned with what data is leaving the firewall. Even with encryption at rest and encryption during transit, vulnerabilities will always be identified. Sometimes they are even trivialized until it becomes wide spread. Box.com, one of the larger file sharing sites for businesses posted the following on their Box.Com blog: “Once someone has access to the user's auth-token they are able use that for browser login. This is a known issue and was a product decision to leave in for Box Sync.”

Is it fair to ask a company to protect data the same way for all customers? Does a large Enterprise require more security than a Small Enterprise and does a consumer need the same level of security? More security means more complexity and greater overhead for systems and bandwidth transfers. In reality each person and business needs to decide what data is relevant for file sharing services versus on premise solutions. If you are not comfortable with the data being exposed then you must look long and hard with keeping your sensitive data on someone else’s “secure” environment.