5 ways to stop malware in the cloud

SAN FRANCISCO — It starts out innocently enough. You’re in HR and there’s a job opening that you’re hoping to fill as quickly as possible.

You send out a request for resumes, maybe on LinkedIn or another job-related site. All of a sudden you get a bunch of emails with resumes attached. So you decide to move the resumes to a cloud-based sync folder where other people on your team can access the resumes.

With automated sync, the resumes are quickly and efficiently shared. But there’s one problem. One of the resumes contained malware and now everyone on your team has been infected. Welcome to the world of “fan-out” malware, says Krishna Narayanaswamy, chief scientist at Netskope.

Narayanaswamy was speaking at the Cloud Security Alliance summit, which took place Monday in conjunction with the RSA Conference.

His company analyzed data stored in cloud applications and found that four out of every 100 files contains malware. That spells data breaches and ransomware attacks. “The havoc it can cause is serious,” Narayanaswamy says.

+ NOT AT THE SHOW? See all the news as it happens +

When people think about cloud security, they think about data stored with cloud service providers through conventional IT channels. But there’s another attack vector that involves unsanctioned cloud apps that may or may not be enterprise ready.

In fact, Narayanaswamy says, surveys have shown that only 10% of cloud apps in the average enterprise are IT led. A full 70% are business led and 10% are user led. So, there’s plenty of business data living in the cloud that is invisible to IT.

“Controls are needed to cover all clients, not just browsers,’’ he adds. In terms of best practices, he recommends five steps that enterprises should take to deal with malware in cloud-based data.

1. It’s critical to have real-time backup of critical cloud-based content so prior versions of data can be easily accessed. That’s a great way to thwart ransomware.
2. Enterprises need tools to look for malware in cloud data at rest.
3. Enterprises need to identify malware and detonate it inside of a sandbox.
4. Also, enterprises need to be constantly on the lookout for anomalous behavior. For example, lots of files moving all at once.
5. Finally, companies need to monitor the network for data exfiltration, using DLP tools to block data from leaving the network in real time.