Since its unlikely that you can depend on your public cloud provider to provide really good security any time soon, you need to take matters into your own hands. Here are a few things you can do:
- If possible, make sure your user name and password are unique to the service. If you must use your e-mail address for a user name, then use one not used elsewhere, even if you have to create one.
- Dont share your login information.
- Dont ever, under any circumstances, put documents or records subject to compliance requirements into a public cloud service. Not ever.
- Encrypt any files you put into a public cloud service before you upload them. There are a number of ways to do this, including some open source automatic encryption packages.
- If youre using a public cloud service, change your password. Now. Then do it again on a set schedule. This helps ensure that if you did reuse your password, a hacker wont have as much likelihood of getting to your data.
- Dont make the public cloud service the only place where you store critical data. Its great as a place to keep presentations so you dont lose them, pictures of your pets and grandchildren so you can show them off and things like to-do lists. If the data contains information that needs protection, such as credit card or social security numbers, encrypt it or dont store it there.
- Keep tabs on your account, check it for unusual activity or unexpected changes to content, or other evidence that someone else may have been there. If you find that, either change your password immediately, or get your stuff out of the cloud, close your account and find another provider with better security.
The one thing missing from Dropboxs statement about its breach is more detail on what theyre doing in terms of additional controls. Did they remove the employee from a position in which they had contact with customer data? Is there better management oversight? Is the company improving its training?
The sad truth is that there is no shortage of dumb things that users can do to compromise security. This has never been a secret and it isnt now. Dropbox should have anticipated this, and should have taken steps to make sure it wouldnt happen. Perhaps now the company will take those steps.
What it means to you is that before you store data thats even remotely important or sensitive, check the security policy and practices of the cloud service youre planning to use. Then encrypt everything anyway.