![]() ![]() ![]() There is obviously a protocol dropbox itself uses to communicate with its clients - is it encrypted? Is it immune to buffer overflows? Man in the middle attacks? Sniffing? Replay attacks? Is it possible to, using the standard protocol, place files inside or even outside the standard dropbox area? If the protocol has a buffer overflow, is it possible to compromise it in a way to allow full access to the machine? Network shares on the machine? As is, using normal operations, one can't just go through that door and look at other things on the computer - only items within the dropbox can be seen, and new items can only be created in that area, but that's assuming that the dropbox application itself can't be compromised.įurther, Dropbox claims a great deal of security, but what is actually provable to you? It's possible someone can sneak in that window remotely from a completely different PC and attempt to put infected documents and programs onto the work PC. Virus/trojan/bot writers don't target dropbox (yet) but if they decide to, then you've got a virtual unlocked door from a company controlled PC on a secure network to an unsecure computer on an unsecure network. That extension is worse than a USB key in the sense that infections on one PC can get onto all the other PCs using that share much more easily than with a USB key. Dropbox enables an extension to another computer's hard drive. Or make sure that the provider supports business accounts that you can somehow group employees under. ![]() Coordinate all accounts through this person (or a couple of people as proxies). If you are going to let individuals have their own account then have a single point of contact for your company.Make sure your data is encrypted BEFORE it gets sent to the service's repository.Make sure you can generate your own encryption key(s) for storing the data and that the key(s) are not shared with the service provider.These services would bypass any automated document retention mechanisms you have in place which adds another area for you to manually cover for document retention.You as the business MUST be in control of the accounts if you don't want some disgruntled employee to have access to things after getting fired. Former employees potentially have access to business data after employment has been terminated.It's much safer, albeit more expensive, to issue laptops with a VPN connection. It depends on your business and your level of paranoia. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |