Article from
Cloud Software – 9 Key Points for Security & Data Protection
Cloud software is generally unbeatable in terms of price-performance ratio – and therefore particularly attractive for small and medium-sized enterprises. Those who have security concerns about web-based software should pay special attention to the following points. They concern the choice of the provider as well as the handling of the software by each individual user.
English image not yet available...Concerns about the security of company data in the cloud are fundamentally justified. However, self-hosting is not automatically the better way. To achieve similar protection against access and data loss as an experienced provider, you need someone internally to take care of it. This person must bring knowledge, diligence, and time. Know-how can be lost when personnel changes. Updates, maintenance, and support can also become expensive quickly. Therefore, especially for smaller companies, cloud software offers an unbeatable price-performance ratio.
When choosing cloud software, special attention should be paid to the following points regarding security & data protection:
1. Choose a reputable software provider
If you want to rely on a reputable provider, you should pay attention to the following factors in addition to the great marketing phrases:
- Good references
- Transparency
- High reliability of the online service
- An AVV – the provider should be GDPR-compliant
- A few years of experience in the cloud business
- A significant number of existing customers
2. Ensure that data is processed in a country with an EU-equivalent level of data protection
The servers should be located in Europe – or more importantly – in a country with an adequate level of data protection according to the EU.
A third country like the USA is possible under the EU-US Privacy Shield. However, the legal basis is considered risky. It is therefore advisable to reassess this regularly. Nevertheless, most and best cloud solutions still come from the USA.
A third country like the USA is possible under the EU-US Privacy Shield. However, the legal basis is considered risky. It is therefore advisable to reassess this regularly. Nevertheless, most and best cloud solutions still come from the USA.
3. Conclude a data processing agreement (AVV)
A serious provider provides an AVV. This clearly and GDPR-compliantly sets out how personal data is handled.
4. Assign your own password
The initial login password assigned by the system should be changed as soon as possible after the first login.
5. Choose the right password
Many people struggle with choosing the right passwords. Important for a good choice is
- Not to use standards like 12345 or words found in a dictionary
- Not to use a chosen, difficult password for multiple logins
- It should be at least 8 characters long. Generally, "the longer, the better"
- It is not recommended to simply add simple digits at the end of the password or one of the usual special characters $ ! ? # at the beginning or end of an otherwise simple password.
- A password should be easy to remember
Quite a lot to ask, right?
We recommend taking note of the tips for optimal password selection and instead implementing point three:
We recommend taking note of the tips for optimal password selection and instead implementing point three:
6. Use a password manager
1Password is an example of such a password manager. Or the keychain on the Mac.
The good thing about a password manager is: passwords are secure and handling is easy. You only need to remember ONE really good password that you need to open the password manager. The following things are then taken care of by the password manager:
The good thing about a password manager is: passwords are secure and handling is easy. You only need to remember ONE really good password that you need to open the password manager. The following things are then taken care of by the password manager:
- It generates a long, secure password from various random characters at the push of a button. You could never remember that.
- At a first login, it offers to save the login in the manager
- Usually, the password can be automatically filled in after opening the manager. If this is not technically possible for some reason, the password manager offers to "copy-paste" the data.
- The password manager can also be installed as an app on mobile phones – and thus passwords can be accessed securely on the go.
It is really worth taking the time to deal with a password manager once and for all.
7. Use two-factor authentication
Many online service providers offer two-factor authentication, or 2FA for short. This is an additional security level when logging in.
This so-called two-factor authentication comes in numerous variants, ranging from an individual code via SMS to a hardware-based TAN generator. In particular, hardware-based methods offer a high level of security and should be used in addition to a strong password if possible. Possible weak passwords of employees can thus be secured.
Functionality in MOCO: In addition to entering a password, you identify yourself via your smartphone.
This so-called two-factor authentication comes in numerous variants, ranging from an individual code via SMS to a hardware-based TAN generator. In particular, hardware-based methods offer a high level of security and should be used in addition to a strong password if possible. Possible weak passwords of employees can thus be secured.
Functionality in MOCO: In addition to entering a password, you identify yourself via your smartphone.
8. Keep operating system and browser up to date
By keeping your operating system and browser up to date, you additionally protect yourself against attacks.
9. Ensure your own backups
With a permanently installed solution, you are completely responsible for backups – with a cloud solution, partially. A serious cloud provider regularly and reliably secures data so that it can be restored if necessary. Nevertheless, they should also offer additional exports, through which you can regularly export your data and store it yourself. It is advisable to do this at least once a year.
Exports should be in a readable format (e.g., CSV, Excel) so that you can do something with them if you switch software.
» An overview of all export options in MOCO
Exports should be in a readable format (e.g., CSV, Excel) so that you can do something with them if you switch software.
» An overview of all export options in MOCO
