The cloud is more secure than an on-premise system
Assuming we’re talking about a reputable mainstream cloud, the answer is an emphatic ‘YES’, mostly. It makes sense that a major provider can afford to put multiple layers of expensive protection around their platforms that an average business just can’t afford. The physical security will be mission-impossible impressive, and the digital security equally so.
Businesses like Microsoft are very aware of how they have to earn customer’s trust and they know that security is an absolute bottom line. They go to town on this! Likewise, they are (successfully) fighting regulatory authorities to make sure they don’t hand over your data when the boys in dark suits and shiny badges appear at the door (which to be fair isn’t really a concern for most of us).
So, cloud services like Microsoft 365, Azure, Amazon and Google are reasonably secure. We know Microsoft the best, and we’re very impressed with their file security.
But people remain the main risk to file security
But, and it is a big BUT, people remain the biggest risk. We have already warned about this in terms of social engineering. But it’s generally mistakes or aberrant behaviour that is the biggest threat. Nothing is more frustrating than getting a call on Monday from a client “Jack (or Jill) left on Friday and I need to check if they copied any files and took them with them”. Generally, that’s a case of closing the door after the horse has bolted.
So, the problem is the cloud makes it easier to access data anywhere, anytime. It’s also incredibly easy to share files with external parties – which is great for collaborating on projects. That’s it’s great strength. But, its open to abuse. There are ways to monitor and alert for changes in your 365 behaviour such as
- monitor for email being auto-forwarded to external addresses
- account access from unusual or infrequent locations (e.g. eastern Europe)
- unusual file access volumes (eg. bulk copies or deletions)
- unusual ‘access privilege’ elevation
So we built this into our new KARE for Security service. It includes quarterly reporting on available alerting parameters, external identities, full mailbox rights and Azure group membership.
This is just the beginning. Office 365 includes a very rich set of file security and compliance tools. These range from a security assessment ‘secure score’ to a feature called ‘Data Leak Protection’ in which policies are created to protect content based on characteristics of that content. Setting that up varies immensely from business to business depending on their needs and we’re very excited to work through the options that best suit you as mini-IT projects. The best way to start this is with our [wow_colorme]“FlightPlan”[/wow_colorme] that will define the requirements clearly.
What is the risk?
The problem is that once data has leaked out, there is reputation risk and if you do have staff making errors of judgement, then the sooner you can identify it and address it, the better. You can cause people to cease before harm is done, and if there is a data breach, you have an obligation to report it, often with pretty severe penalties if you don’t.
KARE for Security complements your existing maintenance contract with an enhanced security package, designed for the modern cloud-anywhere world. It’s a mixture of tools that go beyond traditional IT support to help you harden your ICT against intruders.
What more can you do? Cert NZ is the NZ Government Cyber Security unit – it’s worth reading their top recommendations – https://www.cert.govt.nz/it-specialists/critical-controls/ – you’ll see that a Kinetics KARE plan helps you minimise your risk
Want to know more about how Kare for Security can enhance your protection?