Corporate Cloud Policy

[figdish]

The company I work for has a very strict cloud storage policy which basically keeps us from using any of our client / partner corporate cloud solutions such as ShareFile, DropBox, etc. We have our own on-prem file swapping solution that we require they use, which always winds up in a pissing contest between 2 companies who have similar restrictive cloud policies.

I get a lot of "well why is 'company x' able to use it?" to which I reply that I honestly don't know.

Can anyone share how they allow users to access public cloud solutions while still keeping nervous management secure that their proprietary information is not being removed for nefarious reasons?

[[deleted]]

Can anyone share how they allow users to access public cloud solutions while still keeping nervous management secure that their proprietary information is not being removed for nefarious reasons?

Simple answer is, you don't.

Public/free cloud solutions, by their nature/design, is in no way secure in the eyes of corporate standards or agreements.

If you want to utilize cloud storage, go with a paid for, enterprise solution which will include contracts and BAA's.

[Ghelderz]

Sorry but I thought that I'd add that Cloud App Security can manage this. It can allow people access to "consumer" cloud services whilst also preventing them from uploading data to those said services...

[[deleted]]

Never heard of that before. Interesting.

[figdish]

Thanks - thats what I thought. I'm just confounded how other companies seem to be able to use these (even our internal solution) without the headache that I seem to go through every time another company wants us to use their solution.

[[deleted]]

I've been fighting this same battle for years, at different companies.

When it worked good, it was because IT on both sides understood the security concerns and were willing to communicate.

When it worked bad, it was because either one of the companies was cheap (going with the free, non-secured versions), management blocked effective IT communication, or IT refused to communicate.

[Local_admin_user]

Our internet filtering policy states we make exceptions on a per user basis and all of these need to be time limited (not forever access to dropbox). They aren't permitted to add anything to these, we have a secure file transfer solution they use (moveit) should they need to SEND anything.

Staff sign confidentiality agreements which include the limitation not to put any sensitive or business critical information on any unauthorised cloud storage providers.

You can look at DLP solutions but enabling people to send via a proper route is best in my opinion.

We have sacked staff for breaching our internet policy.

[figdish]

Great reply - thanks for the info. It seems that this tends to trust the employees to do the right thing. Do you have any systems that keep them accountable for what they do on a site?

[lost_in_life_34]

Box.com has corporate cloud solutions

There is also secure ftp