DATA THEFT AND DEFENSE

Some of the recent headlines were so shocking that made stunned people all over the world. The links are presented for anyone who cares to read further and know for themselves. 

Industrial espionage goes a long way back to the mid-90s [remember the incident in Intel when one of the employees tried to sell sensitive documents to competitor].

How did Volkswagen dupe millions of car owners, flout stringent US norms? 

Apple hack exposes flaws in building apps behind 'Great Firewall'

Apple Removes 300 Infected Apps from App Store | WIRED 

Apple Targeted as Malware Infects China Mobile Apps - WSJ

In the digital era, the cybercrime is quite steep given the climbing numbers and catastrophic consequences. The links listed aren't of distant past but relatively new - some or still unveiling and some under investigation. What shocks the learned and layperson is when technology is no longer nascent why the threat should not be nipped in the bud? Nipped?! These bloopers don’t blossom from a bud – be it insider job or outsider, but come to light after shaking our faith and foundation.

The worst threat for now is the cyber threat and measures are mounted to step up cyber security despite which the crime rate scaling is both puzzling and perplexing. If there are breaches in security, the damage could be colossal, making it mandate in tying the loose ends. The best anti-virus is unable to prevent a malware from harming the programs; the best social engineering is not able to mitigate but only makes lives miserable. Ashley Madison hack’s ramification ruined personal life and which is an intrusion into privacy and revelation is damning both to the customers and commerce. When powerhouses like apple’s app store with a reputation of rigid and robust ‘firewall’ is no longer impregnable, anything can be infiltrated, and as endorsers or end-users we lost our insulation and immunity. 

Software is susceptible 

Every software is susceptible and hardware vulnerable? So where is the power of protection? Unfortunately there is no anti-dote ready that can anticipate attack and annihilate the assailant. Surely some minds are busy at ‘work-is-in-progress’ in chalking out a solution. A more complex encryption or safe vault or something very innovative and effective. When the shadow of the danger grows in size threat looms large. 

Disturbing as it gets for the very hand trusted was the one that gave it away. One can defend from outside but how to discern that ‘insider’. Even after closing all gaps, plugging holes, locking doors, securing and sanitizing, how does that slip happen and that too under our very nose? TECHNOLOGY.

Technology is always a double-edged sword. The insiders also use ‘Cloud’ facilities to make away with their goodies. Cloud services are proving to be almost indispensable. Line up the companies offering cloud capabilities and it will feature the heavyweights in the industry: Amazon, Microsoft, apple. So as a safety chute should we just shut down access to the services so that any possible ‘breach’ prevented? Or restrict access? The sanction of cloud services are strictly on need and merit and of course trust.

The vast majority of cloud services don’t encrypt data (as opposed to in transmission), only 15% support multi-factor authentication, and even fewer (6%) are ISO certified, says Sky high CEO Rajiv Gupta. (ISO 27001 was created in 2013 to ensure that security risks and threats to the business are assessed and managed, that physical security processes such as restricted access are enforced consistently, and that audits are conducted regularly.) [source : https://hbr.org/2015/09/what-do-you-do-when-employees-start-using-a-free-cloud-service]

Because it’s so difficult to monitor and regulate employees’ use of file-sharing sites and other cloud services, many CIOs grapple with the whole issue.

So what are the defence mechanisms with regard to data security in cloud?

Data hashing is a technology that creates a hash, or specific code, to identify a given dataset. This allows the integrity of the data to be checked every time the data is used or accessed by a credential individual at the firm. Hashing would prevent data from being changed by an unauthorized third party.

Digital watermarks allow data to be tracked. While this approach does not protect the data, it does allow it to be linked back to the individual who placed it on a cloud or at an unsanctioned location, making that person potentially responsible for any consequences to the data’s misappropriation.

Researchers are attempting to create simple yet effective means of facilitating cross-cloud single-sign-on authentication, where a “foreign” cloud provider is required to gain trusted third-party status from the “home” cloud before being able to communicate with the user and the user’s applications.

Still the advice holds well that sensitive and critical data is guarded and under heavy security and scrutiny.

SalesForce recently introduced Salesforce Shield to protect its cloud apps assuring users that the encryption is by far the best and chances of breach is very slim. But can it be slammed down from slim to simply impossible?

We scratched the surface with regard to Data Defence with Cloud based survives. In the next post, let us look at ways to safeguard out data against any attack.

We welcome your thoughts about Data Security…..

image courtesy: https://destekhizmeti.com/bilgi-guvenligi-hizmetleri