In-depth

Lessons the enterprise can learn from the iCloud photo leak

iCloud security isn't the problem, argues Davey Winder. Lack of knowledge about how to implement it is

The supposed Apple iCloud "breach" made TV news bulletins last week, which is no surprise given that it centred around the leaking of naked female celebrity photos.

It was also no big wow that Apple quickly responded to such a major reputational shafting by insisting it takes security very seriously (yada yada yada), and had not been 'hacked' and will take steps to ramp up account protection in future.

Advertisement - Article continues below

That ramping up will include, as IT Pro reported at the end of last week, email and push notifications when password changes are attempted and if iCloud data restoration to a new device is requested, as well as when someone attempts to log in from a previously unknown device.

In an ideal world you'd be able to inject employees with a drug to prevent them from acting like idiots, or at the very least exert complete control over the devices and services they use.

Some, including myself, would argue Apple should be doing this already. It's pretty much right there in the first chapter of Cloud Security for Complete Newbies, after all.

Flick to chapter two of this virtual tome and the heading would probably be something like 'Use Two-Factor Authentication' which, funnily enough, Apple also says it will be encouraging more people to do now.

Advertisement
Advertisement - Article continues below

Before the fanboys start sharpening their pen protectors in readiness for attack, I had better add that this isn't an attack on Apple; it's an attack on pathetic security measures.

Advertisement - Article continues below

The iCloud hack was as much to do with the usual lack of security awareness on the part of users as it was a lack of security understanding by Apple, which allowed hackers using the iBrute tool to repeatedly submit potential passwords to Apple's Find My iPhone service login page without locking them out.

But what lessons can the enterprise learn from this? That's simple:

1. No organisation is too big to get it wrong, and everyone has to keep their eye on the ball. Unfortunately, users are mostly blind and didn't even know there *was* a ball.

2. iCloud may well impact your security even if you don't take naked photos of the CEO with an iPhone.

Roll both of these lessons into one and out spits the little insecure nugget that the iCloud keychain will happily store login credentials, synced across Apple devices, in the iCloud.

That users can opt to backup that keychain data locally, but tend to take the easiest route and just leave it in the cloud with just a password and pin for protection, is another incident waiting to happen.

Advertisement - Article continues below

It's back to the eyes thing, use them and ensure that data is not being stored in iCloud that you do not want to be there; and that the data which is stored in the cloud is properly encrypted and protected.

In an ideal world you'd be able to inject employees with a drug to prevent them from acting like idiots, or at the very least exert complete control over the devices and services they use.

As neither are likely in the real world, then a combination of policy, awareness training and multi-factor authentication will have to do. Oh, and never forget that it's all about the data at the end of the day, so ensure the data which really matters is at the heart of your security policy and things become a lot more straightforward.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement
Advertisement

Recommended

Visit/hardware/mobile/355116/apples-iphone-12-could-be-delayed-by-months-due-to-the-coronavirus-crisis
Mobile

Apple's 5G iPhone 12 could be delayed by the coronavirus pandemic

26 Mar 2020
Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business/policy-legislation/355010/apple-fined-ps1bn-12bn-by-french-antitrust-regulator
Policy & legislation

Apple fined £1bn ($1.2bn) by French antitrust regulator

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020

Most Popular

Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/security/privacy/355155/zoom-kills-facebook-integration-after-data-transfer-backlash
privacy

Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020