Stay networked. Get informed. Broadcast your projects.

You can rely on the data stored in the cloud?

We can not deny that more and more companies are using cloud-based applications to store documents and files. The Sotware as a Service (SaaS acronym) has seen increasing demand for online applications and file storage.

One of the most common problems concerning security controls in the cloud, specifically: provable data integrity. The difficulty is to know if your files have been tampered with or compromised because, in general, they are held by a third party.

The cloud-based services create control issues and documentation:

Companies no longer have complete control over the design and management of protection systems and possession of your files.
It is important to document the security, integrity and chain of custody of the records to prevent loss of relevant information.

That's why companies need to be completely sure of the confidentiality of their files before moving to use cloud services.

Some people believe that only encrypt the files is enough, but do not know that they are still vulnerables.para attackers do not need to break encryption algorithms to get the encrypted data. can achieve their goals more easily by exploiting web vulnerabilities or using social engineering to obtain end-user credentials and then use them to access confidential files.

Once an attacker obtains the credentials of a legitimate user can access, decode, change, re-encrypting and saving files. Server side file encryption not provide evidence that the files were handled.

The missing component for cloud security is a data protection service file integrity based on cryptographic timestamping. This technology allows enterprises and cloud service providers to seal and then validate files - that is, to generate unique fingerprints and time points for the files and then validating that a recovered copy is exactly the same as the version stored weeks, years or decades earlier.

When encryption protects the confidentiality of the files, cryptographic timestamping can prove its authenticity and integrity.

Comment

You need to be a member of Diplo Internet Governance Community to add comments!

Join Diplo Internet Governance Community

Comment by Juan Manuel Rojas on January 14, 2013 at 6:22pm: Stephanie, thanks for your comments.

I believe that cryptography and timpestamping would be a part of solution to make a true validation between files stored on server and those downloaded. I think it is not just a comparison between documents but an automatized exchange of files to do this better and faster.

We are agree on this services must to be offered by cloud services providers to generate confidence on their users.

Comment by Stephanie on January 10, 2013 at 11:37am: Juan, the data protection service file integrity system sounds like a plausible solution. How would the validation of a recovered file work? Would this compare the modification dates of document, just like a simple 'compare documents' tool found in most document editing software?

I wonder whether this is a system that needs to be offered by cloud service providers, or that users need to start using before uploading files (assuming cloud providers allow documents encrypted in this manner to be uploaded)... If users discover their documents have been tempered with, I'm pretty sure they would change provider, making this system work against the business interests of the providers themselves.

RSS

Welcome to
Diplo Internet Governance Community

Sign Up
or Sign In

Members

View All

Groups

IGF 2013 Bali

37 members
Diplo @ISOC

79 members

e-Government

44 members
Community Networks Africa

1 member

ICT Policy

39 members

View All

Website and downloads

Visit Diplo's IG website, www.diplomacy.edu/ig for info on programmes, events, and resources.

The full text of the book An Introduction to Internet Governance (6th edition) is available here. The translated versions in Serbian/BCS, French, Spanish, Arabic, Russian, Chinese, and Portuguese are also available for download.