You know the old adage - "For every rule there is an exception." (Please temporarily ignore the paradox this creates). This saying certainly seems to apply to every cloud access policy I have ever seen. Here are some of the most common examples:
Most websites have patched SSL but they are reissuing and revoking certificates at a much slower pace. Netcraft reported that only 30,000 websites (out of more than 500,000) reissued new certificates by the end of last week, and even fewer have revoked their certificates. While not completely eliminating the risk of a man-in-the-middle attack (MITM) this is a critical step in reducing the risk of these attacks.
A financial services company sees only risk and no value in providing access to social media platforms from desktop workstations, but then the Marketing group needs to promote the brand on Facebook and Twitter so they are given an exception to use social media services.
A tech company's sales team is not permitted to access their corporate Cloud Security services like Salesforce from personal tablets without having to VPN into the corporate network. However, when the CEO and VP of Sales want to travel with their iPads only, they are granted an exception to directly access the services they use everyday, like Salesforce, Workday, Netsuite, and Box.
These exceptions make sense. IT wants to enable business units to use the services that help them do their jobs, and sometimes those services exist outside of the blanket cloud access policies governing day-to-day usage.
So guess what happens when a company has to grant access to a service? There is no easy way to grant access just to a service, so the exception is granted for the entire category. The result: employees are granted broad access to all services in the category, effectively allowing an access level beyond the intent of the policy exception.
Here's an example - a healthcare company had fairly restrictive cloud storage policies due to the HIPAA and HITECH Cloud Compliance requirements. They prohibited all use of personal cloud storage services, but their CIO was asked to make a policy exception for a newly acquired business unit to use Mozy, an online back-up service. When granting access to this service, they allowed the entire cloud storage category for these users. Only later and by accident did they discover that usage had crept beyond Mozy to several high risk file sharing services including Dropbox, Zippyshare, and Carbonite, creating a compliance and security risk that was in violation of their corporate policies.
The lesson here is that when you grant exceptions, you also need visibility to make sure usage hasn't unintentionally crept beyond the intended exceptions to new, high risk services that lead to greater compliance, security and governance risks.
Most websites have patched SSL but they are reissuing and revoking certificates at a much slower pace. Netcraft reported that only 30,000 websites (out of more than 500,000) reissued new certificates by the end of last week, and even fewer have revoked their certificates. While not completely eliminating the risk of a man-in-the-middle attack (MITM) this is a critical step in reducing the risk of these attacks.
A financial services company sees only risk and no value in providing access to social media platforms from desktop workstations, but then the Marketing group needs to promote the brand on Facebook and Twitter so they are given an exception to use social media services.
A tech company's sales team is not permitted to access their corporate Cloud Security services like Salesforce from personal tablets without having to VPN into the corporate network. However, when the CEO and VP of Sales want to travel with their iPads only, they are granted an exception to directly access the services they use everyday, like Salesforce, Workday, Netsuite, and Box.
These exceptions make sense. IT wants to enable business units to use the services that help them do their jobs, and sometimes those services exist outside of the blanket cloud access policies governing day-to-day usage.
So guess what happens when a company has to grant access to a service? There is no easy way to grant access just to a service, so the exception is granted for the entire category. The result: employees are granted broad access to all services in the category, effectively allowing an access level beyond the intent of the policy exception.
Here's an example - a healthcare company had fairly restrictive cloud storage policies due to the HIPAA and HITECH Cloud Compliance requirements. They prohibited all use of personal cloud storage services, but their CIO was asked to make a policy exception for a newly acquired business unit to use Mozy, an online back-up service. When granting access to this service, they allowed the entire cloud storage category for these users. Only later and by accident did they discover that usage had crept beyond Mozy to several high risk file sharing services including Dropbox, Zippyshare, and Carbonite, creating a compliance and security risk that was in violation of their corporate policies.
The lesson here is that when you grant exceptions, you also need visibility to make sure usage hasn't unintentionally crept beyond the intended exceptions to new, high risk services that lead to greater compliance, security and governance risks.