The (encryption) key to dealing with data insecurity
Valuable data stored in the cloud is sure to be a target. What can be done to make it harder to steal?
Computerworld - Ah, the cloud. Much has been written about the benefits and drawbacks of storing massive amounts of corporate data in remotely located servers around the globe. As a lawyer who works with technology companies, I feel that one of the less appreciated disadvantages of the wholesale movement of data to the cloud is the extent to which it can cause lawyers to lose sleep (and hair).
The first problem that we lawyers have when we hear "data" and "cloud" used in the same sentence is that data is valuable, and the cloud concentrates that value. Having large amounts of business and consumer data stored on Internet-connected servers tends to attract the wrong sort of attention. To paraphrase Willie Sutton, this happens because large storage providers are where the data is. Fortunately, the largest providers (like the banks that drew Sutton's interest) know this, and so they build strong walls and safeguards to secure the ever-increasing amounts of data they are contracted to store.
But as the amount of stored data increases, the law of large numbers predicts that the number of attempted and successful intrusions will rise as well. And so it has. For instance, from January 2009 to February 2012, there were approximately 300 publicly reported data breaches, and an unknown but likely larger number of unreported incidents. The Identify Theft Resource Center reported that hacking represented over 30% of the data breaches recorded during the first six months of 2012, on pace for a record year.
The second problem is that the damages from a data breach can be breathtakingly large. Even if a business merely suspects a security breach, the costs begin to pile up. First, the task of discovering the nature of the breach and the extent of the damage will require technical and legal experts and their associated fees. If the investigation requires critical servers to be taken offline, then any lost revenues will add to the total. Further legal assistance will be required to evaluate the potential liability (especially if any sort of financial or healthcare data is involved), analyze mitigation strategies and navigate the patchwork of federal and state laws related to data privacy and security. Notification of customers and associated remedial measures, including arranging for data theft insurance for affected individuals, will also not come cheap. Finally, there is the unquantifiable reputational damage from the publicity surrounding such an event -- the affected business may need to undertake broad marketing campaigns to overcome the negative impressions and win back customers.
Faced with these two problems, lawyers asked to advise on a cloud-computing plan might be inclined to just say no rather than compromise their ability to get a good night's sleep. But balanced against these very real drawbacks are benefits that are just as real: the ease of use and lower cost afforded by cloud-based storage. Denied the option of saying no, the lawyers turn their attention to the cloud-computing contract and use it to assign responsibility and liability between the parties. In legal jargon, this task is known as "risk allocation."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts