Public cloud-based file sharing tools are gaining popularity among the enterprise users. Numerous features and easy-to-use interfaces have triggered the wide-spread adoption of such tools. Additionally, the limitations posed by the enterprise-level Email tools force the users to quickly switch to freeware for ease of use. Typical limitations of enterprise tools include file size and sharing of business critical files.
Sharing files publicly pose severe security vulnerabilities for enterprises. Some Enterprises have responded by blocking access to identified threats. Today, enterprises are expected to look beyond Email systems to address the needs of large business files. But on the other hand, several organizations don’t consider public file transfer tools as a threat, and continue to permit its usage.
This has led to numerous cloud-based file sharing tools being available publicly in the market, targeting corporates of all sizes. At an enterprise level, these turn out to be less expensive than maintaining the in-house, custom built file sharing platform. But enterprises find it difficult in spreading awareness and hence most employees are unaware of the security risks and associated consequences. Individuals transfer business critical files such as financial data, corporate strategies, customer information, RFI/RFPs etc. Security breaches at the public cloud go unnoticed, putting the enterprise at a difficult position when this data leaks. By the time this sees the light, there are immense losses for the enterprise!
The following risks are increasingly being noticed by the large enterprises recently:
- Lack of control over the information being shared over public cloud sharing tools Enterprises do not have any control over the information being sent through these systems. The information is made available over the cloud till the time it is manually deleted by the user or system, since it is not based on any custom corporate policy.
- Let us consider a simple case: If an employee moves out of the organization, who can disable the associated user account? Very few products provide integration with corporate LDAP [Lightweight Directory Access Protocol] systems by which enterprises can control/monitor the user accounts. It is believed that exposing LDAP to external systems exposes the enterprise to high vulnerabilities.
- Inability to control the flow of sensitive and business critical information through custom policy-based enforcements. Enterprises do not have any mechanism to enforce policies on the public systems. Hence they are not able to impart custom policies like disable login on multiple login failures, etc.
- Inability to track and monitor the usage and purpose of file transfer. Enterprises do not have any mechanism to monitor the usage over these platforms. Hence tracking of files and usage patterns become impossible, raising concerns during scheduled/unscheduled audits.
These challenges make most enterprises block such public tools. What are some of the other challenges that you have noticed with using public file sharing services and are there any solutions to counter them?