Third party data breaches continue at a pace even at 2018 closes, with the latest being the healthcare provider Atrium Health.
The move to Cloud is for many companies is both a blessing and a curse as it creates a potentially larger attack vector surface areas for would be hackers coupled with an increased reliance on external providers who may themselves be attacked.
Increased compliance legislation for personal data leaks, such as the European GDPR regulations, and the forthcoming Californian Privacy Act, mean that the the issue is not only reparatory as penalties for such breaches can have a real fiscal impact on a companies finances.
Through 2018 breach incidents have almost become normal rather than the exception. 2018 has seen Sony, Marriott, Quora, British Airways, Equifax, and others have major data breaches. The Equifax breach was particularly large with sensitive information of more than 123 million households being exposed an Amazon S3 cloud storage bucket was incorrectly secured.
Unstructured file data has a huge breach potential as increasingly companies are outsourcing their file based infrastructure to services such as Google, Office 365, DropBOx, Box, Amazon S3 etc.
So what is to be done ?
Companies should focus on making it as difficult as possible for any potential attacker to get into a system and this can be done effectively by security gates.
Companies should first ensure that an identity management solution is in place (such as Active Directory, LDAP or SAML) and not just rely on a third party vendors access security and additionally they should ideally place multi-factor authentication in place. They should review access controls and ensure that these are applied as granularly as possible rather than course-grained access to everything .
Companies should conduct an information governance review and identify sensitive data and categorise and classify data sets.
Companies should also, ideally encrypt all data, even if the external data provider provides at rest encryption. In a disaster scenario where an solution is breached or a mistake is made additional encryption is a best effort way to mitigate an information leak.
To mitigate ransomware risks companies should implement an active archive to ensure that recovery from ransomware scenarios is quick and painless.
The Enterprise File Fabric is a solution that targets these areas providing a security wrapper around existing data sets whether on-site or on-cloud and providing integrations with identity managements systems, transparent encryption, and an active archive for ransomware protection. It can for example encrypt data stored on Box or Google in a transparent way which does not get in the way employees work.
If you would like to find out more then please contact us to schedule a demo or have a chat.
by 
Latest posts by Storage Made Easy (see all)
- How to securely web enable access to CIFS / SMB File Shares - January 12, 2021
- How To Easily Create Private Password Protected Amazon S3 Links And Folders - March 12, 2019
