Topic 3: Data Protection, Cloud Storage & Backups

Data is the core asset of your business. Protecting client records, financial transactions, and operational files requires safeguarding data wherever it lives—in active software, during transit, in cloud storage, and inside backup archives.

Items Ranked by Priority

The items below focus on recovery preparedness first, followed by data exposure and storage management.

1. Having No Automated Backup Strategy (The 3-2-1 Rule)

Why It’s a Threat: Relying on manual file copying means backups get skipped during busy periods. Hardware failure or ransomware during these gaps causes permanent data loss.

Real-World Example: A firm forgets manual backups during peak season. A hard drive fails, destroying three weeks of unrecoverable client transaction data.

Solution: Automate daily encrypted backups using the 3-2-1 Rule: keep 3 copies of data across 2 different local media types, with 1 isolated offsite copy.

2. Keeping Backups Stored Locally Only (Air-Gap Failure)

Why It’s a Threat: Ransomware scans local networks and permanently attached USB drives, encrypting backup drives at the same time it locks main computers.

Real-World Example: Ransomware infects a desktop via a phishing email, scans for connected drives, and scrambles both the computer files and an attached USB backup drive simultaneously.

Solution: Maintain an offsite or secondary backup with an "air-gap"—disconnected from the local network or using immutable (cannot be changed) cloud storage that local scripts cannot overwrite.

3. Never Testing Data Restores (Unverified Backups) (Data at Rest)

Why It’s a Threat: [NOTE: Data has two "states" - at rest (in a file on a disk) and in motion (sending data over the Internet). Here, we are talking about Data at Rest. In Item 9we discuss Data in Motion.]

Backup software can fail quietly due to full storage or software errors. Assuming backups work without testing leaves you vulnerable during a real crash.

Real-World Example: A server drive dies, and the business discovers their backup software encountered a permission error six months prior and has not saved a file since.

Solution: Schedule periodic restore tests by recovering sample files to a test location and verifying that the data restored opens completely intact.

4. Sensitive Data Unencrypted at Rest

Why It’s a Threat: Storing unencrypted client files or tax forms on workstations or external drives means anyone who gains physical access can read all files directly.

Real-World Example: An unencrypted laptop stolen from a vehicle exposes customer Social Security numbers and bank details extracted directly from the physical hard drive.

Solution: Turn on full-disk encryption (BitLocker or FileVault) on all workstations and mobile storage devices so data cannot be read if hardware is stolen.

5. Lack of a Data Classification Policy

Why It’s a Threat: If staff cannot distinguish public files from confidential records, they will treat all company data with the same casual level of security, causing leaks.

Real-World Example: An employee emails an internal spreadsheet containing salary details to an outside vendor who requested it because the employee did not recognize the file was confidential.

Solution: Classify business information into clear categories (Public, Internal, Confidential) and set clear handling rules for sensitive files.

6. Lack of Document Version Control

Why It’s a Threat: Working without version control leads to team members editing local copies or overwriting shared files, destroying historical edits or legal contract figures.

Real-World Example: Two staff members work on separate copies of a proposal, and one accidentally overwrites the master file on the shared drive with an incomplete version.

Solution: Use cloud storage tools with version history enabled so previous edits can be reviewed and restored easily.

7. Undefined Data Retention and Shredding Schedule

Why It’s a Threat: Keeping client records indefinitely creates unnecessary legal liability; old records exposed during a breach multiply regulatory fine risks.

Real-World Example: A server breach exposes 15 years of credit applications that should have been deleted years prior under standard retention policies.

Solution: Mandate automatic deletion or cross-cut shredding of customer and business files once required legal retention timeframes expire.

8. Cloud Storage Buckets & Shared Folders Left Publicly Accessible

Why It’s a Threat: Setting cloud folders to "Public" or "Anyone with the link" exposes company documents to automated web scanners that look for exposed files.

Real-World Example: An employee sets a cloud folder to public access for a temporary project, and an automated bot discovers and downloads the confidential client records inside.

Solution: Restrict cloud sharing permissions to authenticated users only and audit active shared folder links quarterly.

9. Transmitting Customer PII Without Encryption (No TLS/HTTPS)

Why It’s a Threat: Sending Personally Identifiable Information (PII) (Data in Motion) over plain-text forms or unencrypted web traffic allows network eavesdroppers to intercept sensitive data.

Real-World Example: A customer fills out a contact form on a site lacking HTTPS encryption (TLS), allowing a hacker monitoring the network to capture submitted details in plain text.

Solution: Ensure all web forms and client portals enforce HTTPS encryption across all web connections.

10. Shadow IT: Staff Using Unauthorized Cloud Services & Apps

Why It’s a Threat: Using untested and unapproved web tools or personal cloud storage moves company data onto personal accounts outside your control, backup policies, and security oversight.

Real-World Example: An employee uses personal cloud storage for remote work. Subsequently, they leave the company, but the client data remains accessible on their personal account.

Solution: Provide approved file-sharing tools, maintain a clear software policy, and require staff to request approval before using new web applications.

11. Mishandling Sensitive Printouts and Paper Documents

Why It’s a Threat: Physical paper records sitting on open desks or shared printer trays can be viewed or photographed by unauthorized visitors or cleaners.

Real-World Example: A staff member prints client financial records and leaves them on the printer tray overnight, where an after-hours visitor takes photos of them.

Solution: Enforce a "Clean Desk" policy, retrieve printouts immediately, lock paper records in cabinets overnight, and cross-cut shred confidential documents.