GSN Aug/Sept Digital Edition

Cybersecurity and ConvergenceCloud File Sharing – Pandora’s BoxBy Scott Gordon, COO,FinalCode, IncKudos for the Departmentof Justice to take advantageof the economics of cloudbased storage and the meansto accelerate file collaborationacross agencies and jurisdictions.Moving to cloud-basedenterprise content managementsystems, such as Box.com and others,offers great benefit but with thatcomes inherit security risks.Gartner in its “Cool Vendors inPrinting and Imaging, 2015” reportnoted that: “Digital documents arevery easy to share, but once youshare them, you lose all control overwho else might receive them, whichis a big problem. With the rightcloud-based tools, you can both distributedocuments easily and controltheir distribution.” More so,they recommend, “Departmentalmanagers must recognize the opportunitiesand risks in documentcentriccloud services. Teams andindividuals will find them a veryquick and easy way to manage companyinformation, but you mustwork with the IT organization toprevent them from creating securityrisks and a confusingmess that others willbe left to clean up.”According to Sky-High networks CloudAdoption and RiskReport Q1-15, the averageemployee users3 cloud file-sharingservices regularly.This report cited 22% of files uploadedto a file-sharing service containedsensitive or confidential dataand and 8% of external collaborationand 8% of external collaborationrequests went to 3rd party emailaddresses. That’s a lot of confidentialinformation floating in cyberspace.When employees place a file in asanctioned, reputable cloud-basedfile storage or collaboration application,organizations can gain pieceof mind that systems communicationand storage should be secureand audit-capable. These systemstypically rely on the use of securecontainers on the endpoint. Whilethe files are stored in the cloud orwithin the container, organizationshave comprehensive and strong securitycontrol. But what happenswhen that file leaves the protectedcontainer. That’s when the security22model can denigrate.When online or in a container,file owners have visibility and control.You can readily update, recalland wipe files, and gain insight intofile use within the container. Butwe’ve all shared files with others inthese systems…. And then copiedthe file onto our device, forwardedto another device or possibly sharedit with another user we trust thatmay be outside the scope of identifiedrecipients. Once that file leavesthe container, is typically unprotected.For example, maybe the fileis locked with a simple password,but how often do users send thoseAdobe documents with the passwordin the body of the same email.Peeling back the onion even more,organizations may have encrypteda file in storage and transport… butthen what happens when that file issend/retrieved outside the networkand cloud container? Furthermore,what are the permissions associatedwith the users and the documentto prevent saving, copying, pasting,printing or even screenshots,and what happens across states andcountries. In a digital world, theseare some of the control risks thatneed to be considered with regards