Slashdot Mirror
Dropbox Pursues Business Accounts, But Falls Short On Privacy Laws
deadeyefred writes "Dropbox last month launched its Teams service, targeted at small and mid-sized businesses — but acknowledges it's not PCI-, HIPAA- or Sarbanes-Oxley compliant. Company executives say they also don't provide a highly visible warning largely because customers in beta tests didn't make it an issue. Should cloud services focused at businesses provide clear warnings if they are not compliant with key regulatory requirements, or should business customers just assume they are not?"
Yes, businesses that need PCI, HIPAA or SarbOx compliance ought to be directly asking, that's no excuse for not posting it in a prominent place.
I'd personally be more concerned with the possibility of having some of my data clobbered if there's a collision with a hash for somebody elses file.
But with computers and storage being relatively cheap, and with internet access being ubiquitous, why exactly should I trust a 3rd party with my data anyway?
Seven puppies were harmed during the making of this post.
If they are smart they will be compliant, and advertise that highly. How long until a competitor springs up who is compliant? When it comes to business needs, security is rightly a key focus. Not catering to that is ignoring the very market they want to serve.
There are no cloud storage solutions that provide any measurable degree of security, except perhaps Wuala but even that's funky.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
A business should know what it's doing and therefore not assume anything. So it should have people going over the fine print (and of course as provider, put out fine print to read).
But depending on type of agreement & exact conditions, some of that fine print may not even be legally binding. So if it's important enough: consult a lawyer. And consider consequences of privacy breaches, regardless of legal implications.
no, they should just not claim to be compliant. there are so many regulations in the world to which you can be compliant that a company who needs to be compliant just needs to *verify* that all services used are as compliant as its needed.
Companies should assume they are not compliant unless the company tells them they are. I don't think Dropbox should need to put they are not compliant on their webpage, but they should be able to answer questions regarding their compliance if asked by a prospective business client.
If a company requires compliance with certain information security standards, then they should be checking these things prior to signing up. If it's not clear on their website, then a quick question sent to their sales staff should clear it up. If that doesn't clear it up, then I'd be concerned just because I'm not getting decent answers from their sales staff. I tend to contact sales staff and fire a bunch of questions at them anyway, just to get an initial idea of whether their service will be any good. If their sales staff know their stuff, then there's a chance the support staff might too. A good pre-sales experience doesn't necessarily mean post-purchase service will be up to scratch, but if they're poor at answering my pre-sales questions, then that usually means they're crossed off my list.
This is targeted at small and mid-sized businesses....
SARBOX only applies to publicly traded companies, of which very few in this market are, and even those few will be big enough to have professional IT resources.
Hell, don't deal with this particular outfit, period. I mean, how could people forget them basically turning passwords off for four hours in June?!
Are they can point out to the VP or other higher ups that NO YOU CAN'T USE IT for your work and point to a clear warning so the VP can take the fall and IT can say there was a clear warning and the VP did not read it and used it anyways.
No serious business would use Dropbox for security reasons.
SparkleShare is a free open-source Dropbox-like GUI for GIT repos. Once setup using passwordless PGP keys, non-technical users see and use SparkleShare exactly as they would DropBox. While under the hood is tried-and-true GIT source code version control. You can even set it up as PCI DSS since it only uses your own infrastructure.
On Ubuntu I also installed Rabbit VCS which gave me a range of right-click GIT options (like check-in, merge, etc.) Seriously, I failed earlier attempts setting up either Bazaar or GIT, whereas trying to get SparkleShare setup I finally succeeded and wow, this is a seriously cool project.
http://sparkleshare.org/
http://www.webupd8.org/2011/03/set-up-sparkleshare-with-your-own.html
http://www.moosechips.com/2011/02/sparkleshare-testing-ubuntu/#comments
https://github.com/hbons/SparkleShare/wiki/How-to-set-up-your-own-server
http://is101507.students.fhstp.ac.at/?p=33
http://www.instructables.com/id/SparkleShare-for-OSX-a-Dropbox-alternative/
[Note: To 'remove' a SparkleShare client from the infrastructure pool, revoke the PGP keys at the server-level.]
You can't be ahead of the curve, if you're stuck in a loop.
The thing with PCI compliance is, some of the businesses having to wrestle with it AREN'T storing the credit card information in any way, shape or them on their systems. If they use a web based card processor and don't ever keep any paper copies of anything with the card info printed on it, I fail to see why it's much of an issue for them to comply with PCI regulations at all? The ways the card info might get compromised from their side of the equation, at that point, come down to things like a 3rd. party intercepting the data (say, with a key-logger they installed on the PC they sign into the web to enter the cards on?), or employees stealing the info they're entrusted with when they accept a customer's card in the first place.
Yet as I understand it, they still DO have to maintain a certain class of PCI compliance in these scenarios. Seems like it really is there just to serve as a threat, hanging over their heads.
I can tell you right now, there's a groundswell in my organisation towards "consumerisation", and it's really frustrating. On one hand, I can build them a secure, backed up, accessible system that the business actually owns, in our own country. However, there's no budget. OTOH, there's Internet at all their workstations, and more importantly, they already have their own personal iPad. So why not simply change what they used to do (email it to gmail) by uploading it to dropbox, and then they too can show everyone their iPad and pertinent documents...
Not denying the usefulness of a form factor that's instant on, and fast enough to do what they want. But consider a device with a swipe unlock, access to a bunch of information that would interest media people, and I have no visibility of any of this in Operations. All I know is my internet traffic is up, and if I block dropbox tomorrow it'll be another service they find via google in 5 seconds.
Talk to your business, help find the balance between what they need/want from the technology, and help channel that enthusiasm into the best solution you can find. If you have compliance to worry about too, then that'll help the job. Classification of information and what devices/locations can access it will go a long way to making it clearer for everyone :)
Should cloud services focused at businesses provide clear warnings if they are not compliant with key regulatory requirements, or should business customers just assume they are not?"
Neither. With all of those compliance regulations, it is the job of the company to ascertain compliance. You don't assume anything - if you do, you're not compliant. You not only need to know, you need to document your knowledge.
So really, it's a non-issue except that it means Dropbox won't be used in environments that require this kind of compliance.
Disclaimer: I used to be SOX compliance manager. I know what I'm talking about. /. would be a much better place if people submitting stories would, too.
Assorted stuff I do sometimes: Lemuria.org
Should cloud services focused at businesses provide clear warnings if they are not compliant with key regulatory requirements, or should business customers just assume they are not?
Seriously, no matter what Dropbox does or doesn't comply with these companies should - and must, I would hope - assume they're not. How would this work for anything? Backups? SLAs? Oh, we just assumed a seven 9's uptime and continuous multiple off-site backups in secured facilities, since the company didn't prominently say anything else. If it's not in the terms, you should never assume it is part of the package. Why, pray tell, should this be anything different for regulatory compliance? I don't need regulatory compliance, neither does many others. If your needs are special, make sure they're being met. And if you haven't done that, the blame falls squarely on your shoulders IMO.
Live today, because you never know what tomorrow brings
State-owned enterprises in New Zealand also have to abide by a few regulations that Dropbox Teams doesn't address. I think its imperative that we all boycot Dropbox until all possible warnings are made prominent.
Sarbanes-Oxley, HIPPA and PCI apply to a *tiny* subset of shareable business content globally. Welcome to the cloud. It's a big world - get used to it.
Their service has been shown to be less secure than normal FTP which is something that could be provided by any web service provider on the planet, so how's that for an epic fail? All that is required is for somebody to supply a similar front end to one of many secure back ends and you've got a superior service by any measure.
Remember these are the guys that had a problem where anybody could log into anyone else's account without a password? Then they had the long standing security flaw where once you gave somebody access to your account they had it forever, but users didn't know that because they could change their password to give the illusion of locking people out. That's not all, there are others that made it to stories here and other .
Dropbox is about backups and disaster recovery. It's a terrific service for SMBs who are worried that important files might get damaged, corrupted, lost, or stolen. They do NOT claim to securely store, they only claim to securely communicate. You want secure storage, you have to encrypt the file that gets backed-up on Dropbox yourself.
So, no, Dropbox is not your solution to PCI, SOX, or HIPPA. All of those standards require a whole heckuva lot more that just using a great online backup solution. The real question ought to be why anyone even remotely would think that Dropbox is providing solutions in this space. They're either trying to cast some good ol' FUD because they work for the competition, or they're just plain incompetent.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
This is the key point. Compliance is a "systematic solution" -- a process that leverages IT architecture, coding practices, and human behavior to meet a set of standards.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
to use DropBox. Ffter the last SNAFU with their TOS they don't use them anymore. DropBox is simply not to be trusted.
They now have several terabytes of storage on their servers and some screaming fast LTO4 tape drives in three tape changers that back up everything every night, and those are shipped off site every night.
Hey KID! Yeah you, get the fuck off my lawn!
Why would anyone use DropBox when there is SpiderOak? Hmmm?
Most businesses shouldn't be retaining payment card data. Just pass it to the bank, do the transaction, and keep the last 4 digits of the credit card number for checking purposes. If you operate that way, PCI data never reaches DropBox.
If the business does retain credit card data, usually for recurring billing, much higher levels of security are required. Those are the most vulnerable systems, the ones that are worth breaking into. Merchants that do that have to comply with a long list of tough requirements. They also face big penalties if they screw up. None of that data should ever enter DropBox.
Remember when Sony screwed up? Their ability to take credit cards was shut down for weeks by Visa International and MasterCard. Visa sent in outside auditors. Sony had to pay for all that, plus a big penalty.
And that's the good case. A small merchant who violates the PCI standards and has a data leak may have their merchant account cancelled and won't be able to get another one.
The PCI standards are quite straightforward. There are only a few data items that have to be protected. They really do have to be protected; organized crime is constantly trying to get hold of that data to turn it into money.
Actually, while PCI-DSS may not be law, it's so deeply ingrained in the industry that it might as well be. I mean as far as international law exists, PCI-DSS holds the distinction of actually being adhered to outside of the US. Hell, even Iran's government follows this system.
if you screw up and leak the data, no amount of protesting that you were PCI compliant is going to get you off the hook.
The law, unless I'm very mistaken, simply requires that you implement "reasonable" security measures and register with the authorities. I believe there's also a requirement that you tell the police as soon as you find out that something's happened. Other than that, there's no legal requirement. However, the state is never going to reimburse damages to you, so really, this hardly matters at all.
Where PCI-DSS gets you of the hook is with insurance companies. If you accept payments, and you screw up while adhering to PCI-DSS, they will cover most of your losses. One of the ways to screw up within PCI-DSS is to have 2 saboteurs cooperating inside your organisation, which has happened.
Here's the big difference : if you screw up and lose other people's credit card numbers, there's 2 options :
1) you did not implement PCI-DSS : you will get sued and you're responsible for all damage done with the stolen credit cards. This can, obviously be a lot
2) you did implement PCI-DSS : you will not get money for fraudulent transactions. VISA or the issuing bank assumes responsibility for further fraudulent transactions made on other sites.
In both cases you're "fucked" in that you lose money (which is a good thing imho, after all, you screwed up), but if you implement PCI-DSS you're significantly less screwed.
Also, in many places (the US being one of the major exceptions) the banks will simply refuse to accept transactions from any non-PCI-compliant source. Anyone who's attempted to implement payments on a website will (should) know this.
What bothers most people about this system is that there is no way to get a definitive answer on a transaction, either for a card holder or a business, given that you don't know it's fraudulent or not. The banks, paypal, credit card processors, even ATM centrals may give you the "OK" on a transaction, and register it, and *still* refuse to pay you the money afterwards, claiming fraudulent use of the card. There's no way to protect yourself 100% against this. It is a very American system : it protects the innocent, but not 100%. You can be fucked even in the case where you did not (knowingly) did anything wrong, and where it was not a case of negligence either. On average it works really well, but in the almost-never-happens cases there is no clear procedure to follow and there's lots of uncertainties.
.. and all the security providers are facing uphill battles. Yes - it is inconvenient to use high security systems instead of email. Yes, it's easy to store files on drop box or Microsoft 365. Remember how long it took to convince people that virus scanners are important? And it's not only the regulated data. Whenever a business transfers or stores customer data, it should act very responsibly. But it is the sad truth, that most businesses don't know (or don't want to know) anything about secure storage or transfer services. I am working with a company called 'closedXchange' and we are providing high security data storage and -transfer solutions. We are working hard every day trying to explain our customers, that they should never store or transfer confidential data out of their environment unless they can be 100% sure that it is safe. But how can one be sure that the data is not messed with? The only solution is point-to-point encryption: The data must be encrypted on one's own computer before it is sent or stored. We will see a lot more break-ins, data theft and privacy violations. Tons of data will be lost to international competitors, be used in blackmailing and to clear people's accounts. As I am deeply involved within this environment, I am _very_ careful whenever it comes to my personal data. Believe me, I know that plenty of companies are losing data every day. That companies are being blackmailed and forced to buy their own data back from specialized black hats in eastern Europe and Asia. And - don't forget our very own agencies who are very interested in data too. Yes - dropbox is all about convenience. But if they don't inform their customers about potential problems, they should be held liable. My two cents, m.
This silly use of dropbox is easy to fix. Just dump some huge files there every day. Such as a handful of dvd images. Watch their computers do nothing by syncing - syncing - syncing. Do it from some other computer. When there are enough complaints, tell them that dropbox is the problem. You don't suffer because you don't bother with it. "Yeah, it was *easy*, but it kills performance." Then offer them the proper solution, which is a file server. No stupid syncing, and working directly on the server folder is ok. And later you can add backup and such - if necessary.
Laptop accessories[/URL] like have been sole online as well as usually with discreet investigate you can find a befitting cover stand