While cloud infrastructure can save time and money, organisations must be vigilant about keeping private data secure, especially if they use human resources management systems in the cloud. Because HR systems use and store such sensitive information, they can provide a fertile hunting ground for malicious attackers.
This is becoming a more serious issue as almost half (40 per cent) of companies now use HR software delivered ‘as-a-service’ via the cloud instead of traditional software.1 The benefits include faster deployments than traditional hosting methods, access anytime from anywhere, and continual software updates.
Workforce management technology can free up enormous amounts of time and money from human resources departments. When it’s delivered as a cloud-based service, it can also reduce organisational overheads relating to hosting and IT maintenance, so it can save a business even more time and money.
However, once data about your company and workforce is in the cloud, it’s important to take steps to ensure it’s secure. If a breach were to publicly expose such data, it could result in hefty fines in addition to negative public scrutiny and security issues.
We recommend companies implement three layers of security to safeguard sensitive workforce data in the cloud:
1. Physical safeguards
The first layer of security is physical. This includes considerations such as where data is stored and how it’s protected from intrusion, natural disasters, and climate-related risks.
It also includes strict access protocols to the data centre where their cloud-deployed infrastructure resides. Furthermore, it’s important to have robust backup and redundancy safeguards in place to avoid data loss.
2. Technical safeguards
Technical solutions can help protect companies from cyber attacks, network fidelity issues, connectivity issues, and downtime, among many other unforeseen failures or threats.
These safeguards can include firewall, monitoring, and threat detection platforms, while stringent network access control systems can help prevent unauthorised access to cloud-based systems and data. Additionally, data encryption is an important tool in keeping data secure while being sent to or from the server, and third-party penetration testing can help keep an eye out for unknown vulnerabilities.
Backup and redundancy mechanisms are vital. If a server fails, backups let the company get systems back online without losing data, while redundancy can help keep cloud-based applications and systems operational if an outage occurs.
3. Administrative safeguards
Administrative safeguards include background checks, testing, limited access permissions, and extensive training. These measures, among others, can help keep data safe, along with security staff, a regular backup regime, and separate database schemas for internal and external data access.
1 2014 HR Service Delivery and Technology Survey Results; Towers Watson; June, 2014.