Dropbox’s response is not adequate. It’s not enough for them to bury their head in the sand and to say that this security gap is not their problem if a hacker has physical access to the computer. The very nature of Dropbox lets its users increase their physical presence onto many more computers. As such, these users are increasing the risk of their information being stolen and their businesses being compromised.
Instead, Dropbox needs to say what steps they are taking to close this security gap. If Dropbox wants to minimize the impact to their business and to increase their presence as a responsible corporate citizen, Dropbox needs to make this security issue theirs to resolve.
Encryption is the best way for Dropbox to proceed right now. Encrypting their configuration files would be the first and best place to start. Second, Dropbox (like Google or my credit card company) should monitor users’ accounts for unusual activity. Whenever they notice a blip or a change in user’s activity, they should send the user an email or SMS.
Third, no application or user should be given implicit access to a user’s files. All access needs to be explicit. An end user needs to specify each application and user that has permission to view, update, copy or remove their files.
As all our transactions become electronic, it’s more important than ever that securing the data, securing access to the data without compromising usability and authorized access is the number one requirement for software vendors.
André Bakken is Director of Product Management at Ipswitch File Transfer. His secured and encrypted Managed File Transfer applications have helped companies comply with PCI for years. Mr. Bakken is responsible for the roadmap, strategy and requirements for Ipswitch's enterprise-class applications. Before joining Ipswitch, Mr. Bakken was Director of Product Management for secured Managed File Transfer products at Axway and Tumbleweed. Mr. Bakken comes to Ipswitch with over 16 years of successful product management and product marketing experience at secured, enterprise-class and consumer companies like Macrovision, Alphablox, Hyperion and Microsoft (Great Plains Software). Mr. Bakken holds a bachelor's degree in computer engineering from the University of Arizona.
One Response to “A Security Hole – is Dropbox Dropping the Ball?”
Leave a Reply