Why you shouldn't just trust your Cloud Storage provider to back up your data..

Stuart · 05-04-2011, 12:42

http://www.theregister.co.uk/2011/04...zodiac_island/

A US Cloud Storage provider is being sued by a Hawaiian TV company as they failed to provide a recoverable backup of several files that were deleted by an angry ex-employe.

The files amounted to 340 Gig of data, but consisted of an entire season of a children's TV show. The files were the result of 2 years work from hundreds of people, spread across several production companies and consisting sounds, video, storyboards and animations.

The employee was able to log into the servers one month after termination and delete the data.

Now, this begs a couple of questions about the procedures at Cyberlink (the Cloud Storage provider, not the DVD player manufacturer).

1) We were taught at college that when firing someone in a position such as this, you make sure that they are escorted from the building ASAP, and before they leave the building, any access to any computer systems they have is terminated. The Uni where I work has procedures for this, why didn't the company?

2) Why didn't a company that apparently offers itself as a good backup solution HAVE a good backup solution in place?

Welshchris · 05-04-2011, 13:26

What gets me is why are they going after the firm and not the actual person who did it.

Acathla · 05-04-2011, 13:29

Because the contract to look after their data was with the Cloud Storage firm, not with the individual. The Storage company allowed unauthorised access to their data and it is them that are at fault.

Stuart · 05-04-2011, 14:12

Quote:

Originally Posted by Acathla

Because the contract to look after their data was with the Cloud Storage firm, not with the individual. The Storage company allowed unauthorised access to their data and it is them that are at fault.

Indeed. If they had working procedures in place, it would not have mattered what the individual did, they'd have been able to get the data even assuming he had been able to delete it.

---------- Post added at 14:12 ---------- Previous post was at 13:55 ----------

I think there is a couple of things we can all learn from this, whether we are just storing data for ourselves, or whether we are managing data storage for a company or large organisation.

1) Ensure you have access to backups that are both up to date and known to be restorable.
2) If you should use a cloud storage provider, you need to be able to verify that they will both hold the data securely (you wouldn't want your competitors accessing it, would you?) and they can retrieve the data from backup quickly for you in the event of problems.

Welshchris · 05-04-2011, 14:57

how did the firm know it was unauthorised though?

he at one time was employed by the firm whos data it was, the firm had no way of knowing he had been sacked. They themselves should take some responsibility in this and not lay it all on the data storage people.

gazzae · 05-04-2011, 15:11

Quote:

Originally Posted by Welshchris

how did the firm know it was unauthorised though?

he at one time was employed by the firm whos data it was, the firm had no way of knowing he had been sacked. They themselves should take some responsibility in this and not lay it all on the data storage people.

Think you need to reread the article. The person who deleted the data was an ex-employee of the data storage company.

djmagnifique · 05-04-2011, 16:06

When I used to work for an energy supplier I had access to a website that held info on the electric meters at every address in the uk. I was still able to access the info for almost a year after I left. Sometimes companies don't update who has permission to access sites for quite some time.

Acathla · 05-04-2011, 16:12

This might have been mentioned somewhere else but I haven't went looking and thought it was relevant. It's about the Amazon Cloud Storage and how they store your data unencrypted and within the T&C's have the right to access your data (selling as a tech support feature). Link Here: http://www.ghacks.net/2011/04/04/hav...n-cloud-drive/

For comparison, Dropbox, which uses Amazon Cloud Storage, encrypts all transfers and data it stores...

Halcyon · 08-04-2011, 17:19

Data is so easy to copy or move around that the most secure place for it to be is physically with you at all times.

idi banashapan · 08-04-2011, 19:10

Quote:

Originally Posted by heero_yuy

Call me paranoid but I'd rather have my important data kept where I know it is, and the backups and who has access to it. Storing un-encrypted personal data in the cloud is IMHO madness. If you can't get net access then your data is as good as lost anyway.

agreed. once you involve any third party, you introduce another point of failure, be it in terms of storage, security or any other factor. Obviously, it goes without saying that important backups should be held offsite - but I'm always dubious about 'cloud' storage, QED this article. cross-site backups within your own establishment imo, is a much safer option. you have much more control over your data, storage and links (to a point). trusting someone else with your most valuable asset (and a lot of companies will consider their data MOST valuable - without it, there simply is no business) in this day and age is just crazy.