Today, there's a false sense of privacy felt by consumers and businesses using cloud-based services like Gmail and Dropbox to communicate about everything – from their personal relationships to financials. Because these services are cloud-based and accessible by password, it's assumed that the communications and files being shared are secure and private. But, the reality is – they aren't

Mass migration to cloud computing means that more data is stored on the cloud than ever before. And, that makes the cloud a bigger target for hackers and makes it even riskier to store data there.

Inside Counsel sat down with Randy Battat, CEO and co-founder of PreVeil, an up and coming company helmed by tech entrepreneurs that provides next generation email, file-sharing, and storage systems that turn this “false sense of privacy” on its head.

Users are misled by marketing materials that list services as “secure” and user data as “encrypted” or “protected.” According to Battat, the types of encryption used by these companies do not provide any privacy for a user's information. Cloud providers use encryption in transit and encryption at rest, but even with both types of encryption, the cloud provider retains the ability to access a user's information.

“While these companies don't tell you they can read your data, their Terms of Service make this clear,” he said. “They read your data to sell advertising or to provide additional services to consumers or businesses.”

For example, a series of 2014 federal and state privacy lawsuits led Google to finally update their Terms of Service, clearly acknowledging that they read your content. Their recent (privacy announcement did not change this fact. For paying business users and consumers alike, the fact remains that most cloud providers read all your data to sell advertising and/or provide additional services. The bottom line is that most users simply don't realize they are making this privacy tradeoff.

“If a service provider can read user information, so can a hacker,” explained Battat. “The vast majority of cloud-based services have a fundamental design vulnerability in which they can read all user information. Because these services can access user data, it's not possible to guarantee that the data can't be seen by an attacker as well.”

In fact, Verizon's Data Breach Investigations Report 2017 shows that 81 percent of hacking-related breaches leveraged either stolen and/or weak passwords. Password re-use exacerbates the problem as more than 80 percent of people in one study admitted using the same password for more than one service, so hackers can steal a user's password by attacking a different, more weakly protected service.

IT is migrating to the cloud – almost half of all IT services are being delivered by the cloud, according to Battat. As the cloud gets bigger, it becomes a larger and more attractive target – especially as companies capture and store increasingly important data in the cloud. The cloud providers are a central point of attack. “By targeting cloud service providers, hackers can access data from multiple companies at once. An additional benefit to hackers is that the cloud can be attacked from anywhere in the world,” he said.

Storing data in cloud-based services is like handing your phone to a stranger, per Battat.

He added, “By using a cloud-based service that doesn't use end-to-end encryption, you are effectively giving them any data you store with them. Exposing your information to the world. Not only can the service provider read your data, but so can anyone who hacks them. If a service provider is breached, your data can be exposed – even if you're not the intended target.”

So, how can businesses and consumers ensure that their data is their business only?

Battat's advice is to encrypt information with end-to-end encryption – this ensures that only the intended recipients can decrypt the encrypted information. With end-to-end encryption, nobody else, not even the service provider can read a user's information. Next, reassess information sharing policies and protocols – encryption methods are most effective when used in conjunction with well-aligned internal policies. Additionally, decentralize access to data when possible, minimize or eliminate accounts with privileged access, and carefully consider the risks when deciding to share data or use SaaS services. And finally, ensure that encryption tools are easy to use. Encryption tools are only effective if they are used.