Galloping BYOD spurs cloud services risk
David Gibson says the channel may need to help customers shut the stable door on their data now, following the rise in BYOD
Having brought their own devices, some workers are now bringing their own services too. In this latest development – bring your own service (BYOS) – end users are using apps that offer file synchronisation services that control the movement of data across their various devices, from laptops to tablet PCs.
The ease of use and convenience of consumer apps such as DropBox, Sugarsync and Huddle have persuaded some professional users to adopt them as de facto tools for sharing work between offices.
However, BYOS has a dark side. In my view, it threatens to sweep past company defences to carry away data.
While organisations might like to harness the power and ease that file synchronisation technology could give them, all too often these services will act as a Trojan, breaching the defences of a corporation, opening them up to all kinds of counter-attack.
The very strength of BYOS – ease of use – is also its vulnerability. A virtual folder, which looks and seemingly acts like a regular folder, replicates files placed in it as soon as possible to another computer, device, or so-called "cloud drive". The process is a no-brainer, and therein lies the problem. No-brainers typically have consequences.
The most serious repercussion from file synchronisation services is that security is threatened. Private data can become public property, and that means all kinds of rules will have been broken.
Depending on the circumstances, the person responsible for securing company data could fall foul of regulations on corporate governance, the most common being the Data Protection Act, the EU Privacy Directive, Sarbanes-Oxley, HIPAA and PCI DSS.
Customer organisations may need to act swiftly if they are to prevent data seepage through BYOS gateways.
Workforces have their own computers, smartphones, tablets and wireless data plans. They want to be able to work while outside the corporate network. Reversing this tide is akin to reversing time: thought to be impossible.
However, a policy prohibiting BYOS is not enough. Even if file synchronisation services are blocked on corporate networks and devices, employees will still use them. To control BYOS and BYOD, you need policy, technical controls to stop the unsanctioned services, and a sanctioned alternative to remove the temptation altogether.
Customers will need to figure out the size of their problem. The first step is to monitor network connection attempts for services such as Dropbox, Sugarsync and Huddle. In parallel, customers should also be able to watch for employees emailing documents to the company. This should reveal who is taking data out or storing it and creating it elsewhere in the first place.
Once you have identified which of your customers' employees actually needs to share files outside the traditional corporate platforms, you can work with them to verify that their use is legitimate and find out why they feel the need to use such services. Are they trying to share information with a third party? Are the files too big to email using the corporate set-up?
Perhaps it is because connecting to internal resources is not possible, feasible or is just too complex.
While cloud-based offerings are likely to go on improving, customers will require an immediate and straightforward answer. This likely resides in deploying premises-based software and file synchronisation capable of providing the experience of a cloud service while keeping precious data in the enterprise.
Will customers shut the stable door now, or after their data has bolted?
David Gibson is vice president of strategy at Varonis