Cloud Drives: Opportunity or Vulnerability?

By William H. Butler,  Chair, Cybersecurity Program, Capitol Technology University

It's becoming rare to find an employee at any company or organization who does not use Cloud-based services to help get his or her work done. Dropbox and Google Drive are two popular examples.

We turn to such services if there is a perceived capacity shortfall in our corporate IT offerings. Can you access shared drives and workspaces while away from your enterprise network? If the answer is no, then you've probably at least thought about seeking out personal cloud storage services. If the company's IT resources aren't enabling us to do our jobs, many are inevitably going to take matters into their own hands and procure IT services from outside the workplace. Solving our own IT needs can bring about a sense of personal satisfaction.

Unfortunately, it also brings risks. Are we unwittingly exposing corporate data to unintentional disclosure or modification by hackers? Are we making it easier for cyber criminals when hosting our data on a Cloud service? How many personal Cloud drives do you have? Do you know where all of your data is being hosted? How many Cloud drives have you forgotten about? Take charge of your data today!

IT staffs would do well to pay attention to the unmet needs of their customers and employees and come up with new ways to serve them. Companies are implementing data loss prevention (DLP) strategies to prevent the unintentional or intentional leakage of corporate data. What better way to prevent data leakage in the first place than to give employees secured storage solutions which are readily accessible via anytime, anywhere, on any platform, but in a secure manner? The point is not that commercial offerings are not secure enough for personal or corporate data. The point is that employees should not be driven to solve their own accessibility challenges. That’s IT’s job.

IT’s job is a difficult indeed; one that I would not want. However, these “shadow IT” solutions can pose a threat if not properly integrated into the IT and security plans. Always keep an eye on those free cloud drives and don’t forget about them after you are done with the phone or computer. Proper disposal is the last phase of the IT life cycle and arguably just as important as defining the requirement.

I would love to hear your stories about forgotten cloud drives and do-it-yourself IT solutions – See you next month.