BLOG

Almost everyone with internet access today utilizes some form of cloud storage medium to store files, pictures, and other digital content for easy access and retrieval across many different devices and platforms. We have a level of convenience in remote data access capabilities today that we have never previously had in the computing world. This is a great capability, but it comes at a cost. A primary principle in cybersecurity is to maintain privacy with data in all forms, whether it is stored or in transit, so that the owner of that data can be reasonably sure unauthorized users cannot access their information. Professors who teach in this field should highlight to their students the reality that cloud storage platforms are not as private as a user may think. 

Security Concerns in Cloud Storage 

Cloud storage technology exploded quickly into a capability everyone wanted and has grown into one that everyone needs. Unfortunately, like many new cutting-edge applications, security was not integral in the development process. Students are routinely taught that security should always be part of the programming process because the afterthought typically leads to vulnerabilities that require patches to shore up the holes or newer versions of the application to provide users with a more robust solution. Professors should continue to train their students that good security measures provide more than just a lock that a hacker cannot defeat. These measures also provide privacy for data so that the owner has full control over who has access.  

The Role of Encryption in Cloud Storage 

Privacy is not an integral part of most online storage platforms. Providers are not offering private storage of information; they are simply offering a storage solution to a large audience. Some platforms advertise the use of encryption on their devices so that, in the off chance a hacker gains access, they will not be able to access an unencrypted form of the data. But this encryption does not stop company employees from accessing the data. Students should be taught to ask two simple questions when researching cloud storage. Is it encrypted, and who holds the keys? Encryption is only good for the one holding the keys. For everyone else, it has no value. Most organizations that offer online storage solutions with some form of encryption maintain control of the keys. If they have the keys, they have access to all the data. This is an important element for professors to address because cybersecurity professionals need to understand the nuances of how encryption is applied in these situations. 

Challenges with Provider-Controlled Encryption 

Encryption is the key to keeping private information private, but it only works if the data owner maintains the keys! Students should be knowledgeable enough on this topic to steer their future clients away from potentially dangerous data storage situations. Anything stored on a cloud storage device without a proper measure of owner-controlled encryption could be viewed by any employee of the storage provider’s organization. To be fair, providers often have millions of users, so the chances that an employee will stumble upon a specific user’s valuable data are relatively low. But there is no need to take the risk. Professors should provide one specific piece of advice when using cloud storage. Do not store anything sensitive on a cloud storage medium unless it is encrypted.  

Third-Party Encryption Solutions 

Fortunately, there are free third-party encryption options that can be used to add an additional layer of user-controlled security over data, regardless of where it is stored. Any student pursuing a cybersecurity degree should be aware of the ability to create encrypted storage containers that use modern ciphers that are unbreakable by the most powerful computers when they are properly implemented. An encrypted file container is a special type of file or virtual storage unit that securely holds other files and folders and fully protects them with encryption. It is similar to placing physical files into an unbreakable safe. Each container sits on a storage device as a large file and can be mounted as a drive, which then allows read, write, and execute capabilities for all the files stored within the container. 

One well-known application used to create encrypted storage containers throughout the world is VeraCrypt. This tool has the ability to create file containers that can be safely stored anywhere on the internet. This essentially creates a secondary layer of protection outside of the control of a cloud provider. Similar methodologies are used with VPNs, which exist to secure communication across an insecure internet using the same encryption standards in these types of file containers.  

Practical Applications for Cybersecurity Students 

Cybersecurity professors should require students to complete projects that place encrypted file containers on commonly used cloud storage devices and test the ability to decrypt and access the containers' content from different locations. This will show the students how to protect information even when insecure systems are needed. 

Collaborative Benefits of Encrypted Containers 

This also has the added benefit of sharing private information between multiple parties when other secure communication options are unavailable. One encrypted file container placed on a shared cloud storage device could be used to collaborate with other individuals around the world. This is not as seamless as an encrypted voice call or secure video connection, but it could work well for asymmetric communications when all users cannot access the data at the same time. It is good for any student of cybersecurity to learn about different methods to secure communication because the disruption of normal operations requires creativity to maintain secure communications.  

Balancing Accessibility and Security 

The reality is that online storage that is accessible from anywhere in the world has essentially become a necessity in computing. This is a good thing, and it is not going anywhere. Having the ability to pull data out of the cloud that is accessible by many different people is preferable to maintaining that data on a single device, only accessible by one person. We should not be teaching our students to avoid this technology altogether, but rather showing them how to implement it in a secure way that allows for the benefits of the technology while eliminating the risk of unauthorized access.