Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ten-bucks-a-month web hosts that also serves their two page website) to transport most of this data.

Is data passing mail-servers not at the same level of risk as the various cloud storage solutions (Dropbox, AWS, etc)?

share|improve this question
    
This totally depends what every single person considers an important secret. For someone it's a mail, for someone else it's a file etc. –  cen Dec 20 '12 at 5:53

3 Answers 3

As cen commented, this, like so many security decisions, depends entirely on what you want to protect.

Many organisations keep their mail in house (although anything that needs to travel to a recipient elsewhere has to travel across systems you don't control... )

You need to weigh up your risk appetite and decide what can and what can't be outsourced based on your needs.

share|improve this answer
    
For a business that collects data via email that travels through out-of-house mail servers, I'm arguing that rejecting other cloud services due security risks is somehow irrational since the data has already been or currently is minimally protected (e.g. copies of the files received by email lay on a IMAP server). –  Drew Lex Dec 20 '12 at 8:23
2  
Keep in mind that if your "cloud" mail service is hosted in the United States, the emails may be considered a business record, which you automatically lose all rights to. –  Polynomial Dec 20 '12 at 10:02

In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements.

I'd say that there's a slight difference between e-mail and cloud services in that the programs and servers for e-mail storage and transport are quite mature and most of them will have been through the mill of vulnerability disclosure, whereas a lot of cloud services will be newer codebases that may not have had the same level of scrutiny. Of course that is a bit of a generalisation but may well still hold.

share|improve this answer

I would challenge that using most third party SAAS data storage services are MORE secure than e-mail. Some of them even use encryption on the communication to prevent unauthorized access to the data in transit. E-mail on the other hand offers no such protection in most cases. I think you are running in to the "security concern" of "I don't like it, it is new and I don't understand it." It's unfortunately a fairly common "security" concern.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.