Keeping Up with the Cloud
It seems like we read about new cloud computing security concerns everyday. Interestingly enough, it appears that smartphones are adding a few new layers of risk, particuiarly around apps used to access data files: Here's what they found: "Using mobile forensic toolkits, data can be recovered from a smartphone device which has accessed a cloud storage service," they said. "The results from the experiment have shown that it is possible to recover files from the Dropbox, Box and SugarSync services using smartphone devices." In addition, artifacts left by those services' mobile apps in some cases allowed the researchers to gain a "proxy view" of files not stored on the device, but stored by the cloud service. The extent to which they could recover files varied based on the operating system studied. "On the HTC Desire, both deleted and available files were recovered. The forensic toolkits recovered 9 files from Dropbox, 15 from Box and 11 from SugarSync," the researchers said. "On the iPhone, depending on application and device manipulation either 5 or 7 files were recovered from Dropbox, 7 or 15 from SugarSync and 5 from Box. No deleted application files were recovered from the iPhone." Interestingly, the investigators could also use the Box app's file artifacts that they recovered to access copies of files that were no longer stored on devices, but still stored with Box. This required recovering file IDs for Box files that had been accessed, as well as authentication tokens linked to a specific Box user's account. With both pieces of information, the researchers could create a URL which accessed the Box API to download copies of files not present on the device, all without logging into the service. This digital forensic investigation technique worked on both the iPhone and Android devices. Of course, in detailing these concerns the next step is always the same- figure out a solution: Going forward, the researchers said in their paper that they hope to detail "the data leakage risk that cloud applications introduce to corporate environments" in greater detail, as well as to "propose a set of security measures for both cloud providers and smartphone users to mitigate the potential risk of data leakage." "These services are being used in corporate environments more and more ... so it's a potential source of risk for an organization," said Storer. "Sensitive documents may end up on someone's device that's subject to analysis." But businesses might minimize those types of risks by steering their employees to use devices from which it's more difficult to recover usable information, forensically speaking. Likewise, cloud service providers could offer their corporate customers specialized services that scrubbed all data stored by their mobile apps, once a user no longer needed to view it. Maybe those might be good ideas, but they can be costly and add complications. As we always say, "keep it simple". Data masking addresses a myriad of data concerns in the cloud: Data masking helps organization secure and control their data. "This technique manipulates data so that it's still useable by the company, but if it's taken out of the cloud or accessed outside of the designated application it becomes useless. But, if a company needs to move its data from one cloud provider to another, the data remains intact. The cloud provider cannot alter it. That's also true if a company decides to exit the cloud altogether," Santangelo stresses. He says data masking also enhances security. Companies using data masking needn't disclose a security breach because the data is unable to be used by thieves, therefore minimizing the risk of exposure. It's an effective measure to protect against both cyber thieves and accidental losses, enabling businesses to leverage the benefits that are inherent in the cloud. So whether it's a smartphone leaving a data footprint in the cloud or moving data from one cloud to the next, if you protect the data at the source, added layers of emerging security risks will be less and less likely to hurt your business later.