Benefits of cloud storage
Even if you take all the right steps to protect your computers against malware and physical theft, it is still possible for a determined adversary to hack into your computer or local parliamentary server. It is much harder for them to defeat the security defenses of, for example, Google or Microsoft. Good cloud storage companies have unparalleled security resources and have a strong business incentive to provide maximum security to their users. In short: a trusted cloud storage strategy will be much easier to implement and keep secure over time. So instead of trying to identify (and retain) the number of dedicated and highly skilled cybersecurity staff required to protect local servers in your parliament, focus your energy on a handful of simpler tasks. These include choosing the right cloud storage option for your data privacy and localization needs, implementing good account security, training staff to properly share (and not share) folders and documents (in general, you should set up folders within your cloud storage drive that limit access to only the staff that need it for given files), and routinely auditing your system to make sure that staff and members are not “oversharing” any files (such as by turning on universal link sharing for files that should instead be limited to just a few people).
Keeping the bulk of your information in the cloud helps with a range of common risks. Was someone’s computer left in a restaurant or their phone on the bus? Did your child tip a glass of juice onto your keyboard, leaving your device inoperable? Do you need to compartmentalize data that belongs to an MP herself from information she generates for parliament itself? Does a staffer have malware and need to erase their computer and start fresh? If most documents and data are in the cloud, it is easy to re-synchronize and start fresh on a cleaned or entirely new computer. Also if malware gets into a computer or if a thief scans a hard drive, there is nothing to steal if most documents are accessed through the web browser.
Can we really trust cloud storage?
In short, there is nothing inherently untrustworthy about cloud storage. As mentioned above, most major cloud storage providers have teams of the world’s best security engineers working to protect their products every day, and offer security support to their customers beyond what most small IT departments might be able to provide on their own. Keep in mind, however, that traditional cloud storage services usually require granting access to sensitive data to a third-party company that provides the service. With that said, every individual parliament will have its own political considerations and legal requirements (such as data localization mandates) to consider when choosing whether it can trust and use a given cloud storage provider.
What cloud storage provider should we choose?
If your parliament does not have to consider any data localization requirements, and has no issue with a trusted third-party company sharing access to data, the two most popular cloud storage options are Google Workspace (formerly known as GSuite) and Microsoft 365. If your parliament already uses Gmail, signing it up for Google Workspace and storing data in Google Drive with its built-in Google Docs, Sheets, and Slides apps for word processing, spreadsheets, and presentations make a lot of sense. Similarly, if your parliament is reliant on Excel and Word, the easy choice is to sign up for Microsoft 365, which grants access to Outlook for email and licensed versions of Microsoft Word, Excel, PowerPoint, and Teams.
What if we need to control our own data or comply with data localization laws?
For many parliaments, such a simple option might not be feasible given either data localization requirements or specific expectations that require exclusive parliamentary control over its own data. The good news is that recently, secure cloud storage providers have developed options that allow enterprise customers to either choose the location of their data (note that this is mostly limited to European customers for now), or to control their own encryption keys. In practice, this means that your parliament has options to control its own data while still benefiting from the infrastructure and security of cloud storage.
If your parliament is currently using or interested in Google Workspace for cloud data storage and sharing, Google introduced a feature enabling Client-side encryption for Enterprise Plus organizations. While currently in a testing phase and available only to the most expensive Google Workspace plans, this feature provides an option to take advantage of Google Drive’s full suite of data storage and sharing functions - and the security features built into them - while limiting Google’s ability to access your parliament’s sensitive or private information. With client-side encryption, you can choose to integrate an additional key management service, such as Virtru, and allow users to manage their own encryption keys without allowing access to Google itself. Such a service requires everyone to take great care in protecting those keys to properly protect access to whichever key management system you choose to integrate into Google Workspace. Account administrators can learn more about how to enable client-side encryption on Google Workspace’s support page.
If your parliament is currently using or interested in Microsoft 365 for cloud data storage and sharing, it offers a slightly more complex but well established option for managing your own encryption keys known as Microsoft 365 Double Key Encryption. This security option requires Microsoft 365 E5, but allows you to keep control of any sensitive or private parliamentary data and limit access even to Microsoft itself.
Tresorit is another option that is simpler to implement if your parliament is concerned about allowing a third-party to access your internal information. Tresorit provides end-to-end encryption for cloud storage and file sharing, and offers a range of data residency options.
