[Related: “Why Crooks Trust the Cloud More Than CIOs Do”]

The only logical conclusion that has to be drawn is that something different needs to be done to protect sensitive data assets. These days, a breach has to be assumed to be an anticipated corporate event, and the fallout needs to be mitigated when it happens; a breach is practically unpreventable. The solution boils down to requiring a different approach to protection: data-centric security.

The Evernote breach also shows another side effect of breaches to cloud systems. Reportedly,  the programsaffected by the breach included Evernote, Skitch, Penultimate, Evernote Food, Evernote Hello, Evernote Web Clipper, Evernote Clearly, and Evernote Peek. That’s quite a lot of programs.

In this case, the convenience of single sign on to a range of applications to make it convenient for users also means an attacker can steal data from multiple systems in parallel -- very conveniently.

Consider this -- if this was an enterprise scenario where one cloud application compromise could lead to several others connected to it being accessed in this vein, then the attack would spread like wildfire. What was previously a potentially limited, yet possibly quite impactful enterprise breach, could now be a major system-wide compromise with far more consequential outcomes -- potentially huge and rapid theft of unprotected data. 

In 2013 we will see more breaches of this type -- the more sinister “wildfire,” cloud-specific breaches. Cloud application adopters that have assumed that the cloud infrastructure or firewall is sufficient to protect data are likely in for a few surprises and may need to rethink their data security strategy very quickly. The good news, however, is that the risks can be mitigated -- and easily. IaaS, PaaS and SaaS data can be protected using standards-based, provable secure data-centric security methods that can literally snap into a cloud and enterprise ecosystems without friction. The best part is that the same solutions can also protect enterprise assets, any structured and unstructured data, in mission critical on-premise systems too: the mainframe, enterprise applications, databases and data warehouses. So by enabling a data-centric security strategy that can address the full spectrum of where data can go,  including the cloud, organizations can take themselves off the radar of attackers looking for low-hanging fruit -- the weak links -- and enable their business to embrace the full utility that cloud promises without increasing risk.

Mark Bower is vice president of product management at Voltage.