High profile data breaches and leaks have brought a lot of attention to cyber security of late. With so much information now stored in the cloud, many people are naturally concerned about how to prevent data leaks. Although, in many ways, cloud storage is more secure than traditional on-site storage, there are still concerns. Here are seven good ways to make sure that your cloud data is secure:
1. Use good quality encryption, both on stored data and connections. Avoid sending sensitive information “in the clear.” Avoid using public and hotel wi-fi. If you travel frequently for work you should set up a VPN which will encrypt your data regardless of how you are connected.
2. Educate employees about phishing. The easiest way to access cloud data is to trick somebody out of their username and password. Make sure all employees know that they should not click on links in email unless they know who sent it and were expecting the email. Some phishing emails can look very authentic. It can be worth having IT periodically send out phishing emails to see who is fooled by them, targeting individuals for extra training.
3. Use two-factor authentication. Although this can be a pain for users, it means that if somebody’s username and password are stolen, the criminals will still have to do a lot more work to get into their account. This could be as simple as asking security questions or it could be requiring somebody to use a verification code sent to their phone. Device-based authentication is generally the most secure.
4. Have a decent password policy. Traditional password policies often create passwords that are hard for humans to remember and easy for computers to guess. Educate employees on using pass phrases and other systems that are harder to hack. Encourage the use of a password manager to allow for more complicated passwords with less risk of forgetting (or of people storing passwords in a less secure location because they can’t remember them. Also make sure that passwords expire every 90 days or so. Some systems will not allow the same password to be repeated within two years or so.
5. Set correct user permissions. If somebody is terminated, you should close down their access immediately (ideally at the exact time you tell them so they cannot do damage on their way out). Do not give people access to data they don’t need access to. It’s not about not trusting them, but about minimizing the damage compromising one account can do. Also, accidents happen. We have all seen that private email that gets sent to the entire company network. With modern computer systems auto completing emails, it’s easy for sensitive data to be sent to the wrong party.
6. Keep backups. It’s worth keeping an extra backup outside your normal cloud provider, especially for the most important data. It can also be worth keeping at least some data on a physical drive that is protected by site security. Good backups can protect you from ransomware and similar attacks or from data destruction, intentional or otherwise.
7. Use the right cloud provider. Have a conversation with your cloud provider about their security methods. How do they back up your data? Do they have site security to prevent physical access to the servers? A good cloud provider will care as much about the security of your data as you do, especially as their reputation hinges on it.
If you are looking for a high-quality cloud provider who will help you protect your data and support the continuity of your business, contact Otava today.