Today, the cloud is the new normal for enterprise apps, with 70 percent of all organizations having at least one app in the cloud, according to IDG¹s Enterprise Cloud Computing Survey 2016. The cloud makes sharing documents with customers and colleagues more convenient and allows access documents on your desktop or laptop from your phone while working remotely.

However, using the cloud also raises questions about security. While cloud storage services use many layers of encryption to protect user¹s information that data is relatively exposed when it is being transmitted to and from the service.

Shaun Murphy, a former government security consultant and the CEO of sndr.com, recently sat down with Inside Counsel to discuss cloud security issues law firms and the legal industry should be aware of and how to keep data safe.

“The term cloud quite literally refers to someone else's computer,” he said. “Increasingly the apps and services used today utilize some form of cloud computing. Whether its app data, location tracking or private messages, most individuals do not know where their data is being stored and are not able to safeguard it.”

While it is true some cloud services providers and moving to incorporate some levels encryption within their offering, they are generally focused on in-transit (securing the data between your devices and their servers) and at rest (when they save your data to their storage). This means that your data is protected if a third party is intercepting communications to servers or if a storage device is stolen but does nothing to protect your data from the service itself or the employees that have access to your data, per Murphy.

“A malicious party can easily gain entry to and access your messages through spear phishing tactics, he explained. “These types of attacks may appear to come from a reliable source such as a coworker or a vendor requesting sensitive information or providing a link to click. Internet security training, penetration testing and two-factor authentication should be implemented across employee internet usage policies.”

So, how can cloud-stored data be better protected?

When protecting data stored in the cloud one must use end to end cryptography (only you and your intended recipients can decrypt the data) and about securing endpoints. According to Murphy, data integrity is only as strong as its weakest link and any person or device with access to the cloud can be compromised. Safeguards like two factor authentications can help mitigate risk against compromised credentials or devices with access – all should be encrypted with 256 encryption rest, in-transit and end to end.

“All systems, local or cloud, can be compromised,” he said. “So, understanding the security pitfalls of both options, and determining employee access requirements are critical when assessing and selecting a service provider. Under the assumption that a closed off network is safer than storing eDiscovery and legal files on the cloud, law firms have been slow to adopt cloud services and legacy local systems are still intact.”