If you work in the law profession or are an IT professional responsible for law firm records, you know to what extent your business depends on the ability to keep sensitive client information confidential. The issues raised by storing law firm client data digitally are data security, data accessibility and the maintaining of legal privilege.
When you store client information in the cloud, issues such as legal privilege have to be analyzed even more precisely than when you store them on your own servers. Clients want guarantees of secure data management and want to know how you ensure confidentiality. Your guarantees must be based on verifiable secure policies and procedures. Clients who are not familiar with complicated IT technology must be able to easily understand how you guarantee client confidentiality.
While it is easier to develop, implement and verify secure data practices in house, you are still likely to use unsecured email to communicate with your clients. Avoiding the cloud altogether is therefore not a comprehensive solution, and it may eventually hurt your business. The use of cloud-based services is inexpensive and convenient. Cloud servers may actually be more secure than those on your own premises, and cloud-based software is powerful, easy to use and reliable. You need a tool that will give both yourself and your clients the confidence that their data is safe in the cloud while offering an easily understood process and third-party verification.
Client Data Security in the Cloud
Cloud services suppliers tell you that they have a high level of secure data protection. They use terms like bank-grade or military grade security. What they are referring to is the highly secure process of data transmission they use to get the data from your device or network into their data center. They are also correct in that the data center itself usually has excellent physical security.
Typically, cloud services use 256-bit encryption to transfer data to their servers. The data centers use strategies such as outlined by CSO Online for physical protection against the entry of unauthorized personnel and for data security. Employees have to provide identification to enter the data centers, and they have secure login procedures to prevent unauthorized access.
The weaknesses of this system lie in what happens when the data has to be decrypted in the cloud. Data using standard encryption can't be stored in databases using formats of specific types because standard encryption creates an unformatted hash of characters. When the database requires data in the format of a date, a number or a name, it won't accept random characters that don't fit the specified format. Other database encryption strategies have disadvantages as well. When your data is stored in unencrypted form, unauthorized access immediately leads to a data breach. People who access the database can read your data.
The storing of unencrypted data in the cloud leads to additional specific questions beyond the issues law firms face when storing their data on their own servers. The legal privilege protects law firms against government orders to hand over the keys to the data they hold but does not protect third parties. When cloud services providers receive security letters asking them to turn over data to law enforcement officers and forbidding them to reveal that they have done so or even that they have received such a letter, they usually comply. They may hand over law firm records as well, and you or your clients may never know.
Data Protection in the Cloud Using Data Masking
New encryption technology called Masking allows you to encrypt data as it is entered into the system before it leaves your device. Only you as the owner of the data have the keys to decrypt it. The data can stay encrypted while being stored and processed in the cloud but nobody, not even the cloud services provider or your own administrator, can see the clear data. Only when the data is used, is it decrypted for viewing by yourself or someone you have authorized? The process is simple, transparent, easy-to-explain and reliably secure.
The storage and processing of encrypted data in the cloud become possible when you encrypt with masking. Instead of producing an unformatted hash, such encryption retains the format of the original data. A name still looks like a name and a number is still a number, but the characters have been replaced. The data looks like clear text, but it no longer makes sense or has any meaning. The only way to read the original data is to decrypt it with your keys.
When you use masking, you can give your clients an ironclad guarantee that their data will remain confidential. You can re-assure them that your cloud services provider has all the usual high levels of data security, but you can add that you have an additional last line of defense. Even if cloud security is breached, nobody can read your client's data. You can give an easily understood explanation and follow up with third-party certification if required. When your livelihood depends on confidentiality, having complete data security is extremely valuable.
How to Implement Cloud protection with masking
Securely managing your data with masking can be implemented easily and transparently. A downloadable extension on your browser handles the encryption, and the data stays encrypted until you use your keys to decrypt it or authorize someone else to see the clear data. The authorized person will also have the browser extension installed, and the extensions will transfer the keys and handle the decryption. Your new secure data management application provides complete end-to-end data protection and guaranteed client confidentiality. When third parties can't access your data while it is in the cloud, legal privilege is maintained as well. You can have the low cost and convenience of cloud data storage while improving client data security and eliminating any potential gaps in legal privilege.
With CloudMask, only your authorized parties can decrypt and see your data. Not hackers with your valid password, Not Cloud Providers, Not Government Agencies, and Not even CloudMask can see your protected data. Twenty-six government cybersecurity agencies around the world back these claims.
Watch our video and demo at www.vimeo.com/cloudmask
