Cloud Computing

Praised for its innovative and security benefits, the cloud can quickly become a burden when a company is hit with a cyberattack and must understand the scope of the data held on public and privately owned servers.

In late February, Experian released its "Is Your Company Ready for a Big Data Breach?" study conducted by the Ponemon Institute, which collected the responses of over 1,000 information technology security, compliance and privacy professionals in the U.S., Europe, Middle East and Africa. Along with finding most companies lack data breach readiness, respondents also said the proliferation of cloud services was one of the top barriers to improving IT's ability to respond to a data breach.

Waiting for confirmation of what data was impacted and knowing where all the company's data resides are the pitfalls that commonly delay breach responses, cybersecurity observers said.

While the Experian study highlighted answers provided by IT, Morgan, Lewis & Bockius partner Mark Krotoski said corporate legal departments share similar fears that determining what data is on the cloud can be too time-consuming. "We have seen there can be delays in determining the scope of the breach and accessing if there's notification [required]," he explained.

Krotoski described a frequent occurrence where a company is notified by its cloud-based service provider that an incident occurred. When the client's in-house legal and IT team asks for more details about the scope of the impact, a response may take weeks or months.

Unless contractually obligated, the third party can take as long as needed to provide its client with details, Krotoski noted. But as the client waits, the General Data Protection Regulation's 72-hour reporting requirement or any state's data breach notification deadline could be ticking.

Likewise, Brian Lapidus, Kroll's identity theft and breach notification global practice leader, described the "frenetic energy" when companies don't know what data is on the cloud after an incident.

"We've seen it with our clients. They don't know what data they have on the cloud, they don't have that expertise in-house, and it affects their timing," he said.

Kroll cyber risk associate managing director Keith Novak recommended implementing detection and monitoring tools and appropriately limiting and deactivating access to data.

"Traditional on-premise monitoring and detection tools do not operate well in cloud environments and organizations are blind in many cases to the amount of data being stored on the cloud," Novak said.

He cited "shadow IT," applications that are used without notifying the organization, as one of the leading causes for confusion as to what data is on the cloud.

"What happens is the organization as a whole hasn't adopted a cloud policy, and that hasn't happened because I don't think they realize the extent of their adoption already," he said.

To mitigate the risk when placing personal information on cloud-based programs or storage, many legal departments are adding detailed breach notification and liability requirements into their vendor contracts.

"By itself the cloud has a lot of good security features, but because you are creating another link in the chain, companies want to do their due diligence to ensure there is sufficient security on the cloud and they can be timely notified if there's an incident," Krotoski said.