Threat Category: Enterprise Mobility
ID: EMM-9
Threat Description: Enterprise data may be synchronized to unmanaged and potentially insecure 3rd party cloud services.
Threat Origin
Man in the Cloud: Threat, Impact, Resolution and the Bigger Picture 1
Exploit Examples
Not Applicable
CVE Examples
Not Applicable
Possible Countermeasures
To avoid this threat, use a combination of EMM/MDM solutions and devices that successfully enforce a policy that prohibits devices from synchronizing enterprise data to unauthorized cloud services.
To reduce the risk of a loss of confidentiality for enterprise data stored by an authorized cloud-based file storage or synchronization service, use a combination of EMM/MDM solutions and devices that successfully enforce a policy to encrypt any enterprise data synchronized to authorized but potentially unmanaged cloud services.
References
S. Raghuram, “Man in the Cloud: Threat, Impact, Resolution and the Bigger Picture”, blog, 2015; www.skyhighnetworks.com/cloud-security-blog/man-in-the-cloud-threat-impact-resolution-and-the-bigger-picture/ [accessed 8/23/2016] ↩