Get Off of My Cloud

Is cloud computing safe?

cloud computingWith regular scare stories, isn’t it safer to keep your precious documents and photos locked in your devices?

What if they break, get lost or stolen? Do you back up your data every day?

Don’t panic. Use the professionals.

Why Go with the Pros?

You may believe you are doing what’s best by keeping your data on your device.

However, compared to you, professional companies such as Dropbox, Google, Apple and Microsoft:

  • invest considerably more in security than you
  • are far more motivated to store data securely

On saying that, trust is still a barrier.

Documented below, is a technical summary of how the IT security experts currently view Dropbox, Google Drive, iCloud & OneDrive?*

Dropbox

The Scare

2012. A compromised password allowed access to a Dropbox employee’s account.
Contained a file with user email addresses that got spammed.

The Reality

Stored data was never at risk.

Privacy Concerns

Dropbox employees can’t view content of a client’s files. They only have access to ‘metadata’ for technical support.

However, a small number of Dropbox employees can access stored files. This is only if required, for legal reasons.

DropBox Geeks

Data in transit

Encrypted using Secure Sockets Layer (SSL)

Data at rest

Encrypted using AES-256 bit encryption. Dropbox holds the keys.

Lost or stolen devices

Easy to ‘unlink’ from your account.

Extra protection

Following the breach, Dropbox offered:
Optional ‘2-step verification’ log in (NONCE passwords).
Passwords & expirations for shared links on DropBox Pro.

Google Drive

The Scare

In 2014 nearly 5 million Gmail accounts were hacked when a database was dumped on a Russian security forum.

As Google Drive users use their Gmail login to access documents, these were also potentially compromised.

The Reality

The dump was of old phished passwords.

Less than 2% may have worked – but Google reset them all.

Google Geeks

Data in transit

Encrypted using SSL

Data at rest

Only data stored is encrypted using 128-bit AES.
HTTPS used for all of its services.
Accessed with same Gmail login. Google internally monitors potential compromised account login activity.

Extra protection

Google offers 2-step verification, so use it!

Apple iCloud

The Scare

In 2014 hackers apparently stole photos of celebrities and published them online.

The Reality

Not to do with iCloud security

The celebs got their AppleID passwords compromised through successful phishing attacks elsewhere.

Privacy Concerns

Apple can’t access your iCloud keychain encryption keys. They are created on your own devices.

Apple cannot access any of the core material that could be used to decrypt that key data. Only trusted devices, that you have approved, can access your iCloud keychain.

iCloud Geeks

Data in transit

Encrypted using SSL

Data at rest

Uses ‘minimum: 128-bit AES’. Less than Dropbox’ 256-bit, but uses AES-256-bit for the iCloud keychain (which stores & transmits passwords, credit card data).

Uses key wrapping and elliptic curve asymetric cryptography

Extra protection

Secure tokens are used for authentication to access iCloud from other Apple apps (Mail, Calendar…)

Optional 2-step verification via text message or device generated code for making changes to account information or signing into iCloud from a new device.

Microsoft One Drive

The Scare

Formerly called SkyDrive, so far OneDrive has avoided security breach headlines.

However, alongside privacy issues there is one more concern: user error, i.e. the wrong file sharing permissions and password.

The Reality

Files aren’t shared with other people, unless you save them in the Public folder or choose to share them.

Privacy Concerns

Microsoft reserves the right to scan your files for ‘objectionable content’. Data and your account could be deleted.

Microsoft Geeks

Data in transit

Encrypted using SSL

Data at rest

Only encrypted for business users: each file is encrypted with a unique key; if a key is compromised, only gives access to one file, not all data.

Extra protection

All OneDrive users get access to two-step verification login, using the One Time Code app or text message.

Conclusion

Cloud services are extremely secure.

It removes the risk of losing documents and photos, should a device get damaged or corrupted.

However, to help you sleep at night, use the two-step verification option, to keep your documents safe.

*Based on article by Davey Winder, July 2015

2017-09-25T14:23:28+00:00 Jan 6, 2016|Security|