Tag Archive for: cloud security

Posts

Shield Your Data From Shadow IT

/in , , ,

Spot Unapproved Software To Protect Sensitive Files

Written by Bill Seybolt, Senior Cloud Advisor, Cumulus Global

If someone on your team has ever signed up for a free web app to convert a PDF or used a personal file-sharing account to send a large file, you have experienced Shadow IT.

Key Takeaways

  • ✓ Unapproved cloud tools create hidden security and data exposure risks
  • ✓ Staff members adopt workarounds to solve immediate operational roadblocks
  • ✓ Centralizing account access restores complete IT visibility
  • ✓ Practical cloud governance keeps data safe without slowing daily work

Shadow IT includes the use of software, web services, or digital tools for work without explicit approval. Without visibility, hidden security gaps develop quickly. Sensitive files sit on external platforms without basic safety controls, and primary account protections like Multi-Factor Authentication (MFA) get bypassed.

Shadow IT use happens in all types of organizations, from small businesses and local governments to K-12 school districts and non-profits. Employees rarely adopt these unapproved cloud services out of bad intent. They’re usually just trying to solve a problem or keep work moving. Unfortunately, their intentions don’t matter when it comes to security risks.

Closing these cloud security gaps does not mean you need to lock down every device or take measures that would inhibit innovation. Instead, you can take a more proactive approach that keeps your data safe and your team working smoothly.

3 Core Sources of Shadow IT

Managing Shadow IT begins with an understanding where risks live. For small and midsize organizations, cloud security risks usually cluster in three core areas.

1. Visibility Gaps

You can’t protect software you don’t know about. When staff members adopt web tools without IT oversight, those applications sit outside your standard monitoring setup. If a security incident happens on an unmanaged platform, your team might stay unaware until sensitive files get compromised.

2. Access Control Exposures

When employees create web accounts with personal email addresses or basic passwords, standard safeguards like MFA are often skipped. After an employee leaves your organization, standard offboarding processes miss those hidden accounts entirely.

3. Data Overexposure

Unmanaged cloud platforms often lack strong access controls, which means employees might upload sensitive data, such as customer records, student files, or financial reports, into consumer apps. These services often grant broad public sharing permissions by default or store information without encryption.

Why Employees Turn to Shadow IT

Employees commonly turn to unmanaged tools for a few reasons:

  • Need for speed: Tight project deadlines push people to find instant tools rather than navigating a traditional request process
  • Feature gaps: Approved software might miss specific features that staff members need for specialized daily tasks
  • Lack of awareness: Team members often do not realize that simple or free web tools carry real data security risks

Educating your team about cyber risks and giving them a simple software request process removes the friction that leads to workarounds.

Close the Gaps: A Practical 4-Step Strategy

Addressing unmanaged software requires a balanced approach that protects your data while keeping daily work moving. Rather than setting up strict rules that slow everyone down, you can use a four-step plan to manage these risks effectively.

Step 1: Discover and Audit Your Cloud Tools

Start by checking your current environment. Modern identity management tools let you track single sign-on activity, evaluate network traffic, and spot unapproved apps. Finding out why employees chose specific software helps you decide if those features should be added to your approved platforms.

Step 2: Centralize Access with Single Sign-On

Require standard corporate logins across all business tools. Using your Google Workspace or Microsoft 365 credentials ensures MFA guards every entry point. Automated onboarding and offboarding workflows can then handle account access whenever roles change.

Step 3: Set up Data Protection Policies

Review file-sharing settings across your existing cloud drives and collaboration tools. Ensure least-privilege access rules are active so users only access files necessary for their immediate work. Establish a straightforward software request process so employees can easily submit new tools for security and budget review before adoption.

Step 4: Educate Your Team and Offer Approved Alternatives

Technology controls are most effective when supported by a strong security culture. Provide regular, practical training that explains how unapproved apps put company data at risk. When employees understand the risks and have straightforward access to powerful, approved tools, the incentive to use unmanaged workarounds diminishes significantly.

A Quick Checklist for Cloud Governance

  • ✓ Audit user permissions across all shared drives and repositories
  • ✓ Require enterprise single sign-on and MFA for third-party tools
  • ✓ Automate account offboarding to prevent leftover access from inactive users
  • ✓ Create a simple software request process for staff members
  • ✓ Run routine security reviews to track changing software usage over time

Secure Your Cloud Environment With Cumulus Global

Cloud technology should make work easier, not create hidden security risks. At Cumulus Global, we help small and midsize businesses, local governments, and K-12 schools build secure, productive, and affordable cloud environments.

Through our Managed Cloud Services and Security CPR® framework, we co-manage your IT services, streamline access controls, and give you clear visibility over your software tools so you can eliminate security gaps without slowing down your team.

How We Help

  • Cloud, Security, and AI Assessments: We evaluate your cloud infrastructure to uncover hidden SaaS apps, permission gaps, and exposed data.
  • SaaSOps & Identity Governance: We centralize access management, automate onboarding/offboarding, and ensure consistent policy enforcement.
  • Security CPR® Managed Security: We set up layered protection, active monitoring, and quick response capabilities aligned with your operational needs.

If you are ready to close your security gaps and simplify your IT management, connect with our team of cloud advisors today to discuss practical, right-sized security solutions for your organization.

Ready to Take the Next Step?

Our Cloud Advisors can help.

Schedule a conversation

Bill Seybolt

Senior Cloud Advisor, Cumulus Global

Bill helps small and midsize organizations adopt practical cloud solutions that fit their priorities and budgets. He works directly with leaders and teams to evaluate workflows, identify goals, and map out clear rollout plans. Having helped over 200 organizations successfully adopt cloud solutions, he turns complex IT decisions into clear, measurable business gains.

Secure Gemini AI in Google Workspace

/in , , ,

Three Ways to Protect Company Files When Your Team Uses Gemini AI

Written by Allen Falcon, Co-Founder & CEO, Cumulus Global

Artificial intelligence offers incredible potential for productivity. AI also creates new security challenges.

Follow these three steps to protect and secure information when using Gemini AI in Google Workspace.

Key Takeaways

    • ✓Gemini AI sees what your Workspace settings allow
    • ✓Cleaning up shared files prevents sensitive data leaks
    • ✓Automated onboarding and offboarding keeps permissions accurate
    • ✓Decommissioning inactive accounts closes security gaps and cuts costs

Leaking sensitive, proprietary, or confidential data via AI is easy. An employee may put confidential financial data into a public AI tool, a private AI model, like Gemini AI, might read files that were overshared within your organization, or you may accidentally externally share sensitive information embedded in an internal model.

Gemini AI relies on your existing Google Workspace permissions. If a document is shared too broadly, the AI engine will make that information visible to unauthorized users.

Fortunately, you can secure your sensitive files and establish clear guardrails with a few strategic updates.

Step 1 of 3

Audit Your File Sharing Settings

Unintended file sharing happens quietly in nearly all organizations. Over time, link sharing and external permissions create hidden security risks.

Pay close attention to these common sharing pitfalls that can inadvertently surface confidential data to AI tools:

    • Exposure via Links: “Anyone with the link” settings can expose internal documents to external search engines and public AI crawlers.
    • Sharing to your Domain: Giving permission to your entire domain gives everybody, and every attached service, access to the information.
    • Lingering Access: External sharing permissions granted to contractors often remain active long after their work is complete.
    • Group Over-Sharing: Public Google Groups may inadvertently grant broad access to internal shared drives.

Use an automated tool to scan file, folder, and shared drive permissions against defined policies and compliance guidelines. Put systems in place to monitor and mitigate risks in real-time.

Step 2 of 3

Streamline User Onboarding and Offboarding

Manual IT administration is prone to human error and inefficiency. When employees join or leave, updating access controls requires careful detail.

Establishing automated lifecycle policies helps maintain strict access boundaries at every stage of employment.

    • Automate Onboarding: Add new hires to the correct Google Groups, shared folders, and chat spaces using policy-based automation.
    • Secure Transfers: Transfer file ownership directly to managers or secure shared drives as part of your offboarding workflow.
    • Cleanup Calendars: Remove former staff from internal meetings without disrupting active client appointments.
    • Manage Contacts: Ensure mobile address books remain accurate by clearing out former employees and transferring key business contacts.

Automate these steps to ensure your access controls are up-to-date and Gemini AI only displays sensitive files to authorized team members.

Step 3 of 3

Manage Inactive Accounts and Licenses

Inactive accounts waste budget and create unnecessary entry points for bad actors. Staff members who left months ago should not remain in your user directory.

Put automated management rules in place to ensure that former accounts are properly monitored and decommissioned:

    • Suspension Rules: Establish automated account suspension policies to keep your user directory secure and up-to-date.
    • Inactivity Alerts: Utilize alerts to track and address accounts with no login activity over a 30-day period.
    • License Management: Minimize software expenses and satisfy legal data retention requirements by transitioning offboarded employees to archive licenses.
    • Data Preservation: Safely eliminate paid licenses by transferring essential data into alternate cloud storage options.

Manage user lifecycles to reduce your monthly costs while protecting your company data.

Take the Next Step for Workspace Security

Securing your workspace does not require a complete operational overhaul. Targeted, automated changes create a foundation for strong data governance and reduce operational overhead and risks.

As demonstrated in our recent 3T@3 Series session, automated solutions like Patronum give you the capability to actively monitor and manage permissions and access, streamline your onboarding and offboarding processes, and secure your Google Workspace environment.

Contact us or schedule time to connect with a Cloud Advisor at Cumulus Global to arrange your workspace security review and to explore your options.

Ready to Take the Next Step?

Whether you’re beginning your cloud migration or looking to improve an existing environment, our Cloud Advisors can help.

Schedule a conversation

Allen Falcon

Co-Founder & CEO, Cumulus Global

Allen Falcon co-founded Cumulus Global in 2006 to help small businesses implement enterprise-grade cloud, security, and compliance solutions. Under his leadership, Cumulus Global has grown into a managed cloud services provider supporting more than 1,000 organizations throughout North America.

Best Ways to Protect Your Google Apps Account from Being Hacked

/in ,

We have seen an alarming increase in the number of Google Apps accounts that have been “hacked” across both our business and education customers. Securing your Google Apps account is crucial to protect your sensitive information and prevent unauthorized access.

Google Apps platform security is NOT the issue.  ALL of the hacked accounts are due to compromised user identities.

In every case we have encountered, the users have used their Google Apps email address and password with another service that has had a breach, or has had malware on their computer that provided username and password keystrokes to the hackers.

In both types of incidents, hackers then log in as the user and cause mayhem.

Essential Steps to Make Your Google Apps Account More Secure From Hackers:

1) Educate your users that they are not to use their Google Apps password for any other account not explicitly authorized. Users should also not use their Google Apps email address as the username for personal accounts with other services. It’s also critical to understand the risks of using third-party apps.

2) Check Your Systems for malware and make sure your endpoint protection is up to the task. If not, we recommend Webroot Endpoint Protection and Web Security Services (the link is to our edu site, but the service is available to business and government customers as well).

3)  Implement Two-Factor Authentication (2FA).  In business environments, users should be using 2FA to secure their accounts.  Implementation can be involved if you have other services linked to Google Apps, as you will need to generate service-specific passwords.

4) Use Strong Passwords: Create a strong, unique password for your Google account. Avoid using easily guessable information and include a combination of upper and lower case letters, numbers, and special characters.

5) Review Account Activity: Periodically review the recent activity on your account. Google provides a “Last account activity” feature that allows you to check for any suspicious login attempts.

6) Check Account Permissions: Regularly review the apps and services that have access to your Google account. Remove access for any applications or devices that you no longer use or trust.

7) Beware of Phishing Attempts: Be cautious of phishing emails or websites that attempt to steal your login credentials. Always verify the authenticity of emails and URLs before entering your Google account information.

In education environments, 2FA is not practical for all users, as students and many faculty members may not have mobile devices available to access the Authenticator.  For schools, we recommend any user with partial or full administrative privileges have 2FA active.

FAQs About Keeping Your Google Account Safe from Hackers

Activating 2FA is covered by our support agreements.

For customers and others without support agreements, mention this blog post and we will discount our hourly support fee by 10%; W

We will discount Webroot deployment fees by 50%.  

Both offers expire on December 31, 2014.

Please contact our Service Desk for 2FA assistance; contact Sales regarding Webroot.