Security researcher Derek Newton and a few Dropbox users have found a significant security hole in Dropbox. They published their results and Dropbox responded.
Dropbox’s response is not adequate. It’s not enough for them to bury their head in the sand and to say that this security gap is not their problem if a hacker has physical access to the computer. The very nature of Dropbox lets its users increase their physical presence onto many more computers. As such, these users are increasing the risk of their information being stolen and their businesses being compromised.
Instead, Dropbox needs to say what steps they are taking to close this security gap. If Dropbox wants to minimize the impact to their business and to increase their presence as a responsible corporate citizen, Dropbox needs to make this security issue theirs to resolve.
Encryption is the best way for Dropbox to proceed right now. Encrypting their configuration files would be the first and best place to start. Second, Dropbox (like Google or my credit card company) should monitor users’ accounts for unusual activity. Whenever they notice a blip or a change in user’s activity, they should send the user an email or SMS.
Third, no application or user should be given implicit access to a user’s files. All access needs to be explicit. An end user needs to specify each application and user that has permission to view, update, copy or remove their files.
As all our transactions become electronic, it’s more important than ever that securing the data, securing access to the data without compromising usability and authorized access is the number one requirement for software vendors.
About abakken:
André Bakken is Director of Product Management at Ipswitch File Transfer. His secured and encrypted Managed File Transfer applications have helped companies comply with PCI for years. Mr. Bakken is responsible for the roadmap, strategy and requirements for Ipswitch's enterprise-class applications. Before joining Ipswitch, Mr. Bakken was Director of Product Management for secured Managed File Transfer products at Axway and Tumbleweed. Mr. Bakken comes to Ipswitch with over 16 years of successful product management and product marketing experience at secured, enterprise-class and consumer companies like Macrovision, Alphablox, Hyperion and Microsoft (Great Plains Software). Mr. Bakken holds a bachelor's degree in computer engineering from the University of Arizona.
You can leave a response, or trackback from your own site.
One Response to “A Security Hole – is Dropbox Dropping the Ball?”
Leave a Reply
Dropbox is a consumer product that is roughly equivalent to an external hard drive in the cloud. To approach it differently is absurd. If you want your files protected treat them the same way you would if you put them on an external hd (i.e. Encrypt them).