{"id":886,"date":"2021-12-01T11:02:00","date_gmt":"2021-12-01T11:02:00","guid":{"rendered":"https:\/\/dev.cryptoloc.au\/?p=886"},"modified":"2023-10-03T06:16:55","modified_gmt":"2023-10-03T06:16:55","slug":"how-secure-are-the-major-cloud-storage-providers","status":"publish","type":"post","link":"https:\/\/127.0.0.1\/how-secure-are-the-major-cloud-storage-providers\/","title":{"rendered":"How secure are the major cloud storage providers?"},"content":{"rendered":"\n
In the wake of COVID-19, most of us are more dependent on cloud storage services than ever. Uploading our files to the cloud is a great way to be able to collaborate with colleagues remotely and work across multiple devices \u2013 but with cybercriminals more determined to access our data than ever, it\u2019s also important to consider how safe our files really<\/em> are when we upload them to a cloud storage provider. <\/p>\n\n\n\n This June, IDCare \u2013 Australia and New Zealand\u2019s national identity and cyber support service \u2013 reported a 34 per cent increase in demand<\/a> for its frontline case management services. This reflects a wider trend of cybercriminals looking to capitalise on a world that has been forced to adopt remote work quicker than it\u2019s been able to adapt the best security practices for doing so.<\/p>\n\n\n\n The explosion in remote work and the acceleration in digitalisation caused by COVID-19 has exponentially increased the attack surfaces that are available to cybercriminals, and made it harder for breaches to be discovered. The Australian Cyber Security Centre recently saw a 200 per cent increase in reports of ransomware<\/a>, while the cost of a typical data breach<\/a> has risen where remote work is a factor, and cyber insurance policies are struggling to keep up. <\/p>\n\n\n\n We shouldn\u2019t assume, then, that we can simply store our files in a popular cloud server and forget about it. If you want to ensure your important documents are protected, you need to know you\u2019re going with a secure service. <\/p>\n\n\n\n Right off the bat, there are a couple of things that each of the major providers are doing right. Firstly, they each offer optional two-factor authentication, which adds an extra layer of security to your account by requiring two separate forms of identification to access your account. The first is usually a password, and the second can be a code sent to your phone or email address, or a biometric scan using your fingerprint, face or retina. <\/p>\n\n\n\n And they each offer at least some level of encryption, both for data at rest (data not actively moving from device to device or network to network) and data in transit (data actively moving from one location to another, either across the internet or through a private network).<\/p>\n\n\n\n And while there have been blemishes \u2013 some bigger than others<\/a> \u2013 most of them have managed to avoid major breaches so far, although the same can\u2019t be said<\/a> for their parent companies<\/a>. <\/p>\n\n\n\n But there\u2019s one major problem that hobbles each of the major cloud services \u2013 and it has to do with who can access your encrypted files. <\/p>\n\n\n\n When it comes to cloud storage security, the gold standard is Zero Knowledge encryption. Under Zero Knowledge protocols, your cloud service provider doesn\u2019t store a copy of your encryption key, so they can\u2019t decrypt your files \u2013 even if they wanted to.<\/p>\n\n\n\n The problem is that none of the mainstream cloud storage providers \u2013 the ones attached to giant parent corporations, for the most part \u2013 follow these protocols. Instead, the encryption key to access the files in your cloud stays with them. <\/p>\n\n\n\n That means that no matter how strong your encryption is, or how strong your passwords are, your cloud storage provider still has access to all of your data, and can decrypt it whenever they want, bypassing all of your security. <\/p>\n\n\n\n There are a couple of reasons why they do this. The first is that most of the major cloud storage providers tend to be part of a suite of products, or a workspace, if you will. By holding onto your encryption key, they can access your files faster and speed up the connection between these products. <\/p>\n\n\n\nWho holds the key? <\/h3>\n\n\n\n