(A trading company s staff, Ken, is opening the office s door)

Transcription

1 Information Security Animations Cloud Service Case Study (Script) First Set Setting: At a Trading Company (A trading company s staff, Ken, is opening the office s door) Ken: Boss, what happened? Mr. Chung: The company s server was down and we lost all the import and export information between Mainland and Hong Kong. As you re more familiar with computing, could you help to try rescuing the data? Ken: Yes, of course! Ken: Oh no! The backup data is too outdated so it s useless. Mr. Chung: Why didn t we back up the data regularly? Who is responsible for this? Ken: No one in the company is. Hey! Let s set up an IT Department and upgrade the existing system, then we don t have to worry again! Mr. Chung: I ve considered this too but we are small and medium enterprise (SME) with limited budget, setting up a new department requires money. Regular upgrade of computer systems is not that economical. Uh! Do we have other alternatives? Ken: This Let me look it up on the Internet. Ken: Can we consider cloud services, boss? Mr. Chung: What are cloud services? Ken: As you see, cloud computing is a means of computing based on the Internet, where the shared hardware and software resources as well as information are provided to users computers and other devices on demand.cloud service providers can deliver cloud services to individuals as well as SMEs via cloud computing. Cloud services are designed to provide users with simple and easy access to applications, resources and services, which are fully managed by a cloud service provider. Examples of such services include webmail, data storage, document management, etc. This is very suitable for our company. The benefits of using cloud services include operational savings, agility, innovation and so on. Mr. Chung: How does it work to save operating cost? Ken: Based on their needs, SMEs can use cloud services of relatively low-cost. In general, the cost will be based on the usage of the services or a fixed monthly charge. Mr. Chung: Is it reliable? Ken: No problem! Many companies are using it. Mr. Chung: If that s the case I ll rely on you to give it a try. Ken: No problem! You can count on me! Second Set Setting: Mr. Chung s Home (Mr. Chung s daughter, Wan, and her friend, Keung, are arriving at her home s opening front door after a voluntary activity.) Keung: I m going to leave now. Page 1 of 6

2 Wan: Thank you for the hard work today! Mother: Wan, you re back! Oh? And Keung is here too! Keung: Aunt Chung, How are you doing? Mother: I m fine, thanks! Would you like to have dinner with us tonight? Keung: No, thank you. I feel sorry to keep bothering you. Mother: It s alright. We rarely have a chance to have dinner with you. Keung: Then I d better accept your invitation. Thank you! Mother: Don t be too courteous to me! Little Brother: I am very hungry. What can I eat? (Wan is opening an enveloped birthday card that was put on the coffee table.) Little Brother: Wow! This birthday card is cool! Who sent it to you? Wan: Mind your own business! Give it back to me! Little Brother: Wait a second. Let me take a photo and share it with friends via my mobile phone. Wan: Those friends on social networking sites again? Little Brother: That is a website providing services on a cloud platform. Keung: Wait a second! (The photo has been uploaded successfully.) Little Brother: When did you start acting like my mother, Keung? You even bother to interfere me with photo upload? Keung: Excuse me if I interfere with you. However, the photo you took contains image of the envelope with Wan s personal data, such as name, date of birth and address. Little Brother: And so what? Keung: Just like using other online services, it s very important to protect information on cloud platform. When you upload Wan s sensitive information to the Internet, this could bring trouble to Wan if the information is exposed to people with illicit intent. Little Brother: Don t worry! My selected cloud service provider has applied adequate security measures. It s really safe! Keung: Knowing the security measures applied by cloud service provider is not sufficient to protect sensitive information. Have you read and understand the details of the Terms of Services as well as Security and Privacy Policy of your service provider? These include how information is being stored and protected, and how to report an security incident, etc. Little Brother: Um but this user account is mine. Does the service provider have the right to make use of my photos? Keung: It s possible. That s why we have to be cautious before uploading any sensitive information to the cloud platform. Wan: Anyway, delete the photo now! (Wan grabs her little bother s mobile phone immediately and delete the photo from the cloud platform.) (In the living room, Wan is uploading photos of the voluntary activity to the cloud storage platform.) Wan: I ve just shared the photos with you, Keung. You could now easily complete the highlights of today s Page 2 of 6

3 activities. Keung: Yes, I got it. Thank you! I also downloaded your resume and found that we studied in the same primary school! Wan: What? No way! Keung: In fact, you should pay attention to access limitation settings, and check if the default permission of files or folders is appropriate. If not, then it will be like the file containing your resume, which is available for download to anyone like me. Keung: When using mobile devices, for example a smartphone, to connect to the cloud services, you need to properly protect it because of its small size. You should also enable the password protected screen savers to lock the access devices and keep operating systems, browsers and applications of the access devices up-to-date with the latest software versions and security patches. Also, refrain from jailbreaking the access devices, which means removing usage and access limitation controls. Wan: Okay! May I use your mobile phone to change my settings on the cloud platform? Keung: No! You should only use trustworthy devices to access your cloud service, such as your laptop. Never use public computers to handle sensitive information on cloud platform. You should also securely setup your access account, including a strong password. Use different passwords for different accounts. Log off from the cloud services when it is not required. Wan: I see. Let s change the settings right away, or else my little brother will eat up all the food! Third Set Setting: Mr. Chung s Home (Mr. Chung gets back home after work.) Mother: Why are you so late from work? It s rare that Keung joined us for dinner tonight. Mr. Chung: Our company s server was down. We lost all our recent data and we need to input it all over again. I ve been busy all day. Keung: Uncle, why don t you upgrade the system? Mr. Chung: I ve considered that, but we will have to invest a lot. Little Brother: Dad, have you heard of cloud services? It s so popular now and I m using it! Mother: You just don t understand. By storing important data in some kind of so-called cloud, you wouldn t even know when people steal them! Forget it, and don t follow the trend. Mr. Chung: His suggestion is actually constructive this time. My colleague also suggested using cloud services, but I m worried about what would happen if the cloud services are unavailable and the stored data could not be accessed. What if personal privacy is being disclosed or someone steals business secrets from the company? Little Brother: I ve been using cloud services for so long but I never see such accidents happened before. Keung: Actually, cloud services are not that unsafe as you think. As long as uncle s company have a thorough understanding on the security measures for selecting cloud service providers and using cloud services, then cloud services can be used safely. Mr. Chung: You also know about cloud services? Page 3 of 6

4 Keung: A bit. Wan: You are so humble! Dad, he s a technical consultant on cloud services! You found the right person! Mr. Chung: That s great! Keung, I ve seen on the Internet that there are different types of cloud services. In terms of information security, how can I choose the right service provider that can make me feel safe? Keung: SMEs should understand the Terms of Service and Security & Privacy Policy. For example, how to report an incident, whether the privacy policy follows the data protection principles, and how to process the data retained on cloud platform after service termination. You should also understand data ownership, for example, check whether the service provider can use, disclose, or make your information public. Mr. Chung: What else should I pay attention to? Keung: Besides, you should choose a service provider that can clearly explain what security features they could provide. And this service provider should preferably possess with independent information security management certificates, such as the ISO/IEC Meanwhile, the service provider under selection should not have history of major security incident, or one that could provide a clear explanation of what happened during the incident and what follow up actions have been taken afterwards. Mr. Chung: I see. However, how do I ensure that my information is well protected? Keung: You can choose a service provider that can provide encryption (such as Secure Sockets Layer (SSL)) to transmit data. Encryption should be provided when storing static data. If the service provider does not provide encryption, you should encrypt your data before storing them on the cloud platform and protect the encryption key securely. Mr. Chung: Got it. However, I want to know more about the things that I should pay attention to when using the cloud services. Are you free to come to my office and tell me more about it, Keung? You will be well rewarded! Keung: No problem! Reward is not needed and I think having dinners at your home more often would be fine, if Aunt Chung doesn t mind. Fourth Set Setting: In the office of Mr. Chung s company (Mr. Chung invited Keung to meet at his office. Ken is preparing to store sensitive information onto the cloud platform.) Ken: We ll upload this that and this file to the cloud platform, encrypt the data and properly set up account authentication. Then it ll be alright. Good morning, boss. Mr. Chung: Good morning, Ken. I invited a cloud services expert, Keung, to our office today. You can ask him any issues on cloud services. Ken: Cloud services are quite easy to use, boss. I consider myself a semi-expert now! Mr. Chung: You should be careful when handling company s sensitive information. There are many areas related to data protection that you need to pay attention. Keung: That s right! Before handling sensitive information, you should read the Terms of Service and Security &Privacy Policy. You should also understand whether your service provider has access to your company data. If so, how to restrict that access. Sometimes there may be secondary uses on user Page 4 of 6

5 account information without user s knowledge or consent. Ken: What is Secondary uses? Keung: For example, information stored in the cloud may be used for tailor advertisements. If you don t understand these terms, company information may be leaked without your notice. At the same time, you should understand the data location, and assess whether there are impacts on security procedures. Mr. Chung: If you store company s sensitive information on the cloud without understanding such issues, what happens if our data is being leaked? Ken: I thought as long as I set up user accounts with authentication and apply encryption for data protection, then it would be very secure. I didn t know that there are other areas requiring our attention. Keung: Yes. When using cloud services, you should use strong authentication method, such as two-factor authentication. It refers to a combination of any two factors of:, what you know, what you have and what you are. Also you should change your passwords periodically. In addition, you should delete access accounts or change passwords immediately when there are staff changes. This can avoid unauthorised access of sensitive information which causes potential damage to the company. At the same time, data protection is also important., for example, you should understand and keep a record of what type of data are stored in the cloud and avoid sharing out data to unintended parties, etc. Mr. Chung: Ken, as you are our company s cloud service administrator, you should be familiar with how to protect the data on cloud platform. If you have any questions, you can seek Keung s advice! Ken: That s very good! Are there any other duties for a cloud service administrator? Keung: You also need to know how to manage the cloud and understand service continuity. For example, you should perform regular backup of the data stored in the cloud service and maintain a local backup copy of your important data. In doing so, you can ensure that the data can still be available when the service provider s provided service is out of service temporarily or permanently. You should also establish a simple set of access account policies and usage policies for using the cloud services for your staff to comply with. You should also conduct regular reviews of access rights on staff having access to cloud data and provide basic security awareness training for staff using cloud service. Ken: What else should I pay attention to? (Ken continues to seek advice from Keung on cloud service administration.) Ken: I understand now. I have just realised that a cloud service administrator should pay attention to so many details, which deviates from what I thought that it s all about uploading data. I would like to ask for a salary increase! Mr. Chung: A salary increase? Keung taught you so much that you should be the one paying for that. Page 5 of 6

6 To learn more about information security, please visit the InfoSec website at: Page 6 of 6