Cloud Software Security & Data Protection: 9 Key Points

Article from

Cloud Software – 9 Key Points for Security & Data Protection.

Cloud software typically offers unbeatable value for money, making it particularly attractive to small and medium-sized enterprises. If you have security concerns about web-based software, pay special attention to the following points. They relate to both the choice of provider and how each user interacts with the software.


Cloud Software: Sicherheit & Datenschutz(English image not yet available)

Concerns about the security of company data in the cloud are generally justified. However, self-hosting is not automatically the better option. To achieve a similar level of protection against access and data loss as a skilled provider, you need someone internally to manage it. This person must have the expertise, diligence, and time. Knowledge can be lost with staff changes. Updates, maintenance, and support can also become costly quickly. Therefore, cloud software offers an unbeatable value proposition, especially for smaller companies. 

If you choose cloud software, you should place particular emphasis on the following points regarding security & data protection:

1. Choose a reputable software provider

If you want to rely on a reputable provider, it's wise to look beyond the impressive marketing phrases and consider the following factors:
  • Good references
  • Transparency 
  • High reliability of the online service
  • A data processing agreement (DPA) – the provider should be GDPR-compliant
  • Several years of experience in the cloud business
  • A significant number of existing clients

2. Ensure data is processed in a country with EU-equivalent data protection

The servers should be located in Europe – or more importantly – in a country with adequate data protection levels equivalent to the EU

A third country like the USA is possible under the EU-US Privacy Shield. However, the legal basis is often considered risky, so it's advisable to regularly reassess this. Nonetheless, most of the best cloud solutions still come from the USA.

3. Sign a data processing agreement (DPA)

A reputable provider will offer a DPA. This document clearly and GDPR-compliantly outlines how personal data is handled.

4. Set your own password

The initial login password assigned by the system should be changed as soon as possible after the first login.

5. Choose the right password

Many struggle with choosing the right passwords. Important considerations for a good choice include 
  • Avoiding standards like 12345 or words found in a dictionary
  • Not using a chosen, complex password for multiple logins
  • It should be at least 8 characters long. Generally, "the longer, the better"
  • Appending simple numbers at the end of the password or adding one of the usual special characters $ ! ? # at the beginning or end of an otherwise simple password is not recommended.
  • A password should be memorable 
Quite demanding, isn't it?
We recommend simply acknowledging the tips for optimal password choice and instead implementing point three:

6. Use a password manager

1Password is an example of such a password manager. Or the Keychain on a Mac.

The advantage of a password manager is: passwords are secure and easy to handle. You only need to remember ONE really good password to open the password manager. The password manager then handles the following for you:
  • It generates a long, secure password from various random characters at the push of a button. You could never remember it yourself.
  • It offers to save the login in the manager during the first login
  • Usually, the password can be automatically filled in during login after opening the manager. If this is not technically possible for some reason, the password manager offers the data for "copy-pasting".
  • The password manager can also be installed as an app on mobile phones – allowing secure access to passwords on the go.
It's truly worthwhile to engage with a password manager once and then have peace of mind forever.

7. Use two-factor authentication

Many online service providers offer two-factor authentication, or 2FA for short. This is an additional security layer during login.

This so-called two-factor authentication comes in numerous variants, ranging from individual codes via SMS to hardware-supported TAN generators. Hardware-supported methods, in particular, offer a high level of security and should be used in addition to a strong password whenever possible. This can secure potentially weak passwords from employees.

Functionality in MOCO: In addition to entering a password, you identify yourself here via your smartphone. 

8. Keep operating system and browser up to date

By keeping your operating system and browser up to date, you further protect yourself from attacks.

9. Ensure your own backups

With an on-premise solution, you are entirely responsible for backups – with a cloud solution, partially. A reputable cloud provider regularly and reliably secures data so that it can be restored if needed. However, they should also offer exports, allowing you to regularly export and store your data yourself. It's advisable to do this at least once a year.

Exports should be in a readable format (e.g., CSV, Excel) so that you can make use of them if you switch software.

» An overview of all export options in MOCO

Try for free for 30 days

Account ready to go immediately. No payment details required.