At the time we began embracing the (public) cloud, we also started changing the way we safeguard our data. In the classic datacenter model, our data was buried deep within a datacenter that was separated from the outside world by using a firewall. It was your single entry point for accessing your companies data. Solutions to make your data accessible when away from the office was by using a VPN or other remote connection such as a Citrix or VDI environment.

Modern workplace environments don’t rely on the firewall anymore to protect data from being accessed by the outside world. We trust cloud providers to take care of the datacenter part and companies themselves are made responsible to safeguard their data. In this modern cloud approach the user account itself is at the center of accessing data. If anyone with bad intentions is able to get their hands on a username and password combination this gives them access to all the data the user has access to, for example in the Microsoft Cloud (Onedrive, Sharepoint, etc).

So we should make sure our users change their password periodically so bad people have a hard time guessing passwords right? Wrong.

Continue reading “Periodic password resets, ancient myth or modern need?” →