Cloud Storage Security (Google Drive, iCloud, OneDrive)

Cloud storage services (Google Drive, iCloud, OneDrive) make your files accessible from anywhere, but configuring security correctly is critical. This guide explains the basic steps to secure your cloud storage.

Encryption: cloud services encrypt your data 'at rest' — meaning data stored on servers is encrypted. However, the encryption keys are typically under the control of the service provider. This means the provider can theoretically access your data. For stronger protection, use client-side encryption.

Two-factor authentication (2FA): always enable 2FA for your cloud account. Instead of SMS-based 2FA, use app-based (TOTP) or hardware key (YubiKey). SMS is vulnerable to SIM swap attacks. Apps like Google Authenticator or Authy are more secure.

Sharing settings: be careful when sharing your files. Avoid the 'Anyone with the link' option — this allows anyone who finds the link to access the file. Instead, share with specific email addresses and grant 'view' rather than 'edit' permission. Regularly review your shared files.

Zero-knowledge principle: some cloud services (Tresorit, Proton Drive) offer zero-knowledge encryption — meaning the encryption keys are only with you and not even the provider can read your data. This is the highest level of privacy. QMOBILE, with its BASEL-based approach, recommends zero-knowledge services.

Google Drive security: update account recovery options, use Google's 'Security Checkup' tool, and regularly audit third-party app access. For Google Workspace users, client-side encryption (CSE) is available — this provides additional protection for enterprise data.

iCloud security: enable 'Advanced Data Protection' — this provides end-to-end encryption for most iCloud data. Ensure iCloud backups are encrypted. Apple stores the keys by default, but with Advanced Data Protection, the keys are only on your devices.

OneDrive security: use the Microsoft 365 Personal Vault feature — this provides an area for sensitive files that requires additional authentication. Personal Vault is protected by 2FA and automatically locks after a certain period. Regularly check OneDrive activity logs.

Practical steps: encrypt sensitive files locally before uploading to the cloud (with tools like VeraCrypt, Cryptomator). Make your cloud account password unique and strong using a password manager. Revoke old shares and remove unused third-party app access. These steps significantly increase the security of your cloud data.