Personal and Business Cloud Security
[Originally published March 26, 2013]
In 2013, businesses and consumers were racing into the cloud. Bring Your Own Device (BYOD) policies were becoming mainstream, with employees using personal phones and laptops to access corporate systems. Apple pushed iCloud, Google pushed Drive, and Microsoft tied users to SkyDrive. Independent providers like Dropbox, Box, and SugarSync were gaining traction as well.
The direction was clear: our files, both personal and business, were headed into the cloud. With that shift came an urgent question: how secure was our data?
Was Cloud Security a Real Problem?
The short answer: yes.
Searches in 2013 pulled up headlines like:
- Dropbox suffered breaches that exposed user credentials
- Evernote forced a service-wide password reset after attackers gained access
- Law firms reported leaked case documents from compromised accounts
Some users avoided putting sensitive files in the cloud entirely. Others continued emailing driver’s licenses or passports to insurance agents without hesitation. Once sent, control was gone.
The Promise vs. the Reality
Providers promised strong security, but the reality was simpler: your data was only as safe as the weakest link, whether that was the provider, the recipient, or the human handling your file.
Email was, and still is, one of the worst ways to share sensitive documents. Cloud services offered password-protected accounts, but providers still held the master keys. Dropbox’s own policy at the time spelled out its right to retain and access files under certain conditions.
Securing Data Before It Leaves You
The surest answer was, and still is: encrypt your data before uploading it.
Tools like 7-zip made this possible with AES-256 encryption. But this surfaced another issue: credential management.
The Credential Management Gap
Encryption is only as strong as its passwords, and most people reused the same few. If one account was compromised, others followed.
What was needed, and still is, was a seamless credential management system.
A good one requires five things:
- Unique passwords for every file
- Secure ways to share and revoke access
- Recovery methods for forgotten keys
- Open standards for long-term accessibility
- Invisible complexity so users never feel the burden
In 2013, nothing met all five. Arguably, nothing still does.
The Takeaway
Cloud security was not theoretical. The breaches were public record. The solutions were straightforward in concept but difficult in practice: encrypt before upload, manage credentials securely, and demand transparent, user-first standards from providers.
Until then, every promise of cloud security had to be read with caution. The lockbox was only as trustworthy as the people holding the keys.
2025 Note: A decade later, that last line still holds. The lockbox got fancier, but we are still arguing about who holds the keys.