Is data genuinely safe in cloud storage? What should I check before handing it over?

Follow a simple three-step checklist before migrating: 1) Verify the provider's independent audit certifications (like ISO 27001) 2) Implement strict role-based access control for all users, 3) Look into middleware tools that encrypt files locally on your machines before pushing them up to the cloud.

If you implement client-side encryption on sensitive CAD files, neither the vendor nor any attacker compromising their infrastructure will see anything other than unreadable blobs of data. Using open-source encryption containers that also mask filenames and folder structures eliminates these concerns completely.

We migrated about 4 TB of architectural project data to the cloud back in 2021. The first thing we did was configure our old office NAS to pull an automated reverse backup from the cloud every Sunday night. We spend roughly 1,100 Euro a year and haven't lost a single file since.

our biggest headache was users saving passwords in their browsers doesn't matter how secure the cloud is if someone gets their password stolen the entire archive gets exposed mfa is a must.

The provider might not shut down but they could double the subscription price in year two. Don't sign anything before reading the fine print regarding data retrieval speeds when migrating and whether they charge extra download fees (egress fees).

note: I wrote this based on my own experience, it might not apply to everyone.

Definitely don't get rid of your old NAS device. Make the cloud your primary workspace, but keep your local device as a secondary backup location so you can keep working in the office when the internet drops and avoid vendor lock-in.

Do the NDAs you signed with your clients have a clause permitting data to be stored on third-party cloud servers? Some corporate clients contractually prohibit drawings from leaving certain countries.

During the process of migrating data to the cloud, a Data Processing Agreement (DPA) must strictly be concluded with the service provider. This agreement must provide legal guarantees regarding the geographical region where data will be stored and who will have access to it.

Correction: I misremembered the figure, it was a bit lower.

The discussion got scattered, let me summarize. Payment information changes are never verified through the channel they came from.

That's all, sorry if I went on too long.

Saved. Hasty decisions become decisions you have to fix six months later.

Your time to detect an issue directly determines its cost. Correct me if I'm wrong.

i've been down this road, let me tell you and the answer varies greatly by industry; there is no one-size-fits-all rule.

if you scold false alarms, nobody will report again then like proven by experience.

Let me summarize what's been said so far. honestly having backups accessible on the same network and with the same identity makes them part of the target.

That's all, sorry if I went on too long.

Id appreciate it if you shared the outcome.

Let's separate the concepts they're getting mixed up... An automated scan report is not the same as a penetration test.

If 2FA is on a stolen password alone is useless. I'm also curious if anyone does it differently.

Good call starting this thread. The answer varies greatly by industry; there is no one-size-fits-all rule.

If I were you, I'd go this route.

The discussion got scattered, let me summarize. The answer varies greatly by industry; there is no one-size-fits-all rule.

The harder it is to reverse a decision, the slower you should make it.

Could you elaborate on that? The biggest time-waster for us was not knowing who had the final say.

I'm also curious if anyone does it differently.

There's a common mistake people make when doing this. Processes without records never improve, because you don't know what to fix.

The answer varies greatly by industry; there is no one-size-fits-all rule. Proven by experience.