If you ask any seasoned IT professional at a Managed Service Provider (MSP), “what is your greatest cybersecurity weakness in the protection of customers”, the answer will undoubtedly be; the end users they serve.
It’s not because the end users they serve are malicious. It’s because most end users simply are not aware or ignore all the important configuration options and settings that exist in the applications they use every day. Once more, most IT professionals are not aware of the multitude of SaaS applications their end users are leveraging in their quest to make their jobs easier.
A great example would be Dropbox. Dropbox is used by over 500 million people every year. Many of these users are from all types of companies, from the smallest of the small to large enterprises (this blog is backed up on Dropbox). But if we evaluate some of the overlooked end user configurations for a popular application like Dropbox, then we find some troubling security holes.
For example, here are 4 commonly overlooked issues by end users that can be resolved through proper diligence (the problem is the average end user is not known for their diligence).
1. Delist Linked Devices: Often Dropbox users will change their devices (laptops, smart phones, tablets etc) multiple times while their Dropbox subscription continues on. But devices can also be passed on to other people and if those devices are not properly wiped, said devices may be used to link back ones Dropbox account. To avoid this issue, users should always “delist” their devices when they retire them. Here is a screenshot of the setting in Dropbox to accomplish this:
2. Check Web Sessions: One of the great features of Dropbox is the ability to collaborate with other people or groups. Many times users will engage with another company on a project and they will use Dropbox to share important files. Once the project is complete there is no longer a need to share files between the two parties go about their business without the need to collaborate further. But what happens to those “orphaned” Dropbox links? Could someone use an orphaned link to tunnel back into ones Dropbox account? The answer is, “yes’. So, it’s important to monitor ones Dropbox web sessions. On the same Security page just above the list of linked devices, users can view their current web sessions which shows which browsers are currently logged into your Dropbox account. This however, requires end user diligence.
3. Manage Your Linked Apps: When you sign into Dropbox through a third party app, the company shares your personal information with that app. Over time you may forget which apps you have given permission to access your Dropbox account and may have stopped using those apps altogether.
Towards the bottom of Dropbox’s security settings page you can view all the apps you have given permission to over the years and just as with de-listing trusted devices, you can easily revoke permission for any given app.
4. Email Notifications: When changes occur in your Dropbox account such as, logins from new devices or deletion of files you can set up email alerts within Dropbox that will notify you. Email notifications can be managed from the Profile panels of the Settings menu.
These four measures are not difficult to do, but they do require the right configurations, policy management and ongoing diligence, which as stated before can be difficult for end users to keep up with and Dropox is just one app of dozens someone will leverage daily. If you’re an MSP or IT Administrator looking for a comprehensive product that monitors SaaS applications and creates alerts around unusual end user behavior, please go to www.saasalerts.com for more information.
Welcome to WordPress. This is your first post. Edit or delete it, then start writing!