Cloud services and security risks

Cloud services are probably not an unfamiliar term to most of you. They are used, for example, to store and back up data, but they can also be used for playing games or streaming content. Cloud services are used not only by individuals, but also by many companies, entrepreneurs and institutions. Alongside their undeniable advantages, however, cloud services also bring certain potential security risks.

Data in the clouds – and in the hands of the provider

When storing data in the cloud, put very simply, you hand it over into the hands of the provider of the relevant internet service. Try to imagine that you give your money to a friend for safekeeping and want to have it available to you at any time. Such a friend must be not only reliable, but also suitably careful, so that no one can steal your money. The same applies to the provision of cloud services, that is, storing content on the internet. At the end of last year, the National Cyber and Information Security Agency (NÚKIB) published a strategic analysis assessing the aspects of using cloud services in the Czech Republic.

The pandemic as a route to cloud computing

It is no news that the COVID pandemic significantly changed the extent and the manner in which humanity uses technology and the internet. Along with the forced move to home office, which took place in many places two years ago, individuals and companies also began to make heavy use of cloud computing, that is, a service enabling self-service access to computing resources. Within the cloud, people often worked with documents, but also with media content and other types of data, including games. Thanks to the fact that the data was stored in the so-called cloud, no demands were placed on the hardware or the fixed storage capacity of any of the parties involved.

In its report, NÚKIB divides cloud service models into four main categories: public, where data is shared and services are offered to the wider public; private, where the services are offered within a private internal network; hybrid, where the two previously mentioned ways of sharing data and providing services are combined; and community, where only selected organisations share data among themselves.

Security as a challenge

Not least in the context of the growing number of cyber attacks security is extremely important for cloud services and, among other things, it is a key part of the calling card of the providers of these services. Securing data in cloud services is a complex and complicated matter, involving multiple layers of encryption, the use of several mutually independent data centres for backups, and other similar steps. At first glance it might seem that using cloud services is always and in all circumstances a clear advantage, saving many companies and institutions the costs associated with purchasing hardware or securing data at company level (which is, of course, necessary to some extent regardless of whether the entity uses cloud computing). 

NÚKIB, however, points out in its report that before using cloud services, thorough and conscious research into their provider is necessary. "By using cloud services, the user automatically gives up part of the control over their data," NÚKIB writes, in connection with the need to always carefully verify where the data is physically stored, with regard to the legal systems of individual states. Account must also be taken of the fact that cloud storage is often managed by foreign companies. All these factors play a key role in how, by whom and on the basis of which legal regulations the data in question may be handled. 

Specifics of using cloud services in the Czech Republic

NÚKIB notes in its report that a growing trend in the use of cloud services can be observed here in the Czech Republic too, both by private entities and by public authorities. For now, however, the use of cloud services in our country is not subject to any particularly extensive regulation, and therefore not to special control processes either, which exposes the data, and the company storing that data in the cloud, to numerous risks. "In particular, the risk of losing access to data or of processing it outside the territory of the EU is so significant that it should not be overlooked," states the related report. A further complication is the fact that in many cases cloud service providers sell their services through a network of resellers. 

For companies and institutions that are considering the use of cloud services, NÚKIB strongly recommends assessing several questions as part of internet security. It is necessary to determine in which jurisdictions the data will be stored, whether in the short or the long term. That is, to analyse and assess the legal regime of that country, including whether data protection regulation applies to the data. Furthermore, it is necessary to answer the question of how long the organisation wants to use the cloud storage, to what extent and for what purposes. 

A number of uncertainties associated with the use of cloud services could be resolved by a decree on security rules for the use of cloud computing services by public authorities, which could enter into force as early as during the first quarter of 2023.

Read the next article, Bluetooth 5.0 protocol: what it can do and how to make the most of its strengths or take a look at the very latest articles.

Updated 15 April 2024​

​