Your Data Might Be Safe in the Cloud But What Happens When It Leaves the Cloud? In the age of data breaches, companies have a responsibility to safeguard sensitive information. Entrepreneurs can protect data during transactions by taking 4 simple steps.
By Robin Hau •
Opinions expressed by Entrepreneur contributors are their own.
With more sensitive data stored in the cloud than ever before, entrepreneurs need to know how to keep information regarding their companies and their customers safe.
Cloud service providers can successfully protect data physically and technologically while it is in the cloud, but that information can be vulnerable to hacking as soon as it leaves the cloud to interact with another system. Even when companies implement entirely cloud-based systems, they often use data backups and on-site storage in some way. These systems also fall under your responsibility.
Just look at February's StreetEasy breach, in which hackers stole information from a million accounts. Hackers didn't access this information during the real estate company's day-to-day operations; they stole it using a database backup from 2016. Personal information from those accounts -- including email addresses, usernames, the last four digits of credit cards, expiration dates and more -- is now available for sale on the dark web. This lesson is hard (and costly) for entrepreneurs: You have to protect data every step of the way.
Related: 7 Surprising Places Hackers Hide
Ironically, the myriad benefits of cloud-based data storage can become risks if businesses aren't careful. Transactional data requests can be made and fulfilled from virtually anywhere in the world, using any connected device -- when a physician's office requests access to a patient's hospitalization records, for instance, or when a customer purchases shoes online.
This rapid-fire communication makes business operations run smoother, faster and far more efficiently. It also means that data can be left exposed unless you take the proper precautions. To protect your data through every transaction, take the following measures:
1. Practice internet safety.
Using virtual private networks (VPNs) and secure socket layer/transport layer security (SSL/TLS) helps ensure that your internet connection doesn't leave you exposed when working with data that travels from one system to another. A VPN makes your connection private and keeps your online activity, IP address and device information anonymous. Use VPNs to access computers or networks remotely, especially if you or your employees are using public Wi-Fi.
SSL/TLS encrypts and safeguards sensitive data as it's transferred between two systems (such as client/server or shopping cart/browser), preventing would-be criminals from reading and modifying that information. When accessing a website to make a purchase, make sure that the address begins with "https," which verifies that the site is encrypting and hiding your data from prying eyes.
Related: 12 Simple Things You Can Do to Be More Secure Online
2. Encrypt connected devices.
Your encryption processes need to extend beyond the information you store in the cloud, especially with so many connected and external devices used in normal business operations. As a business owner, you must make sure that you encrypt any connected devices, hard disks, USB drives and related devices. Any unencrypted data stored on these devices endangers the privacy, finances and identity of your company and your customers.
Some of the biggest international data breaches in history have been tracked back to infected USB drives, notably including a U.S. Department of Defense breach in 2008. For example, we had a healthcare client that was legally required to safeguard any devices that might contain patient health information (PHI). Unfortunately, someone stole a physician's unencrypted laptop that contained patient records from his car during a lunch break, resulting in a violation that incurred a hefty fine (HIPAA violations can range from $100 to $1.5 million).
Unencrypted data is like handing your wallet over to a stranger, including your credit cards, insurance cards and forms of identification. By encrypting your devices, you ensure that people cannot retrieve sensitive data from a stolen or lost hard drive without an encryption key.
3. Multiple factors are better than one.
What training does your company currently give employees about creating, storing and protecting their passwords? How does your company offer password-protected customer accounts? The reality is that most passwords aren't secure -- easy to remember usually means easy to hack.
Businesses should use multifactor authentication (MFA) as a baseline. The principle behind MFA is that no single authentication factor is perfect. A second or third factor can compensate for the weaknesses of others. Supplement your password with one or two authentication factors that aren't easy for other people to guess, using an authenticator on your mobile device, for example, or a biometrics factor like fingerprint or voice.
Related: What You Need to Know About Multifactor Authentication
4. Protect backups in the face of ransomware.
When ransomware attacks a machine, backups are usually the last line of defense. This is why modern attackers are using more sophisticated programs to penetrate safeguards. In March 2018, the cybersecurity world was introduced to ransomware Zenis, which not only encrypts files but also purposely deletes backups until the victim meets the hacker's demands.
A 2017 Malwarebytes report found that ransomware detections were up 90 and 93 percent for businesses and consumers, respectively, and that these attacks are becoming more prevalent. Always protect hardware and software with anti-virus and anti-malware applications, or you'll be an easy target.
With the number of connected devices, data transfers and backups required to perform typical business operations, companies need to protect data every step of the way. Even with cloud storage or a cloud computing system, data can be vulnerable when it's in transit, in backups or stored on unencrypted devices. Take the above steps to protect your data and your customers' information.
