Data Security in Cloud Computing

Businesses of all sizes are moving to the cloud to take advantage of the greater data availability, significant cost savings and data redundancy that cloud computing provides compared to a traditional data center-based physical infrastructure. Moving to the cloud can also reduce shadow IT and get data stores out from storage closets and underneath desks so they can be governed and protected in compliance with regulations and best practices. In fact, we have determined that 95 percent of business leaders are currently using sophisticated cloud services for their companies.

However, choosing the right cloud service and implementing your own security protections come with a number of challenges for our customers. More cloud platforms have entered the market in recent years, so it’s important to ensure that the service they choose supports data integrity, confidentiality and availability.

Here are our key factors to consider about data security in cloud computing when transitioning to the cloud or updating your cloud storage plan.

Problems that organizations face in the cloud

Public cloud computing is by its nature a shared environment — your virtual machines (VMs) are sharing infrastructure, hardware and software with other cloud tenants. You have no idea of the identity or even the number of customers with whom you share your environment. Therefore, you should closely research your cloud provider to check whether all applicable security cloud computing mechanisms are implemented and working as designed.

Private clouds offer much of the same convenience and scalability as public clouds, but they do not require you to share cloud infrastructure with other customers. Probably the most high-profile private cloud in existence is the one used by the Central Intelligence Agency (CIA). The fact that an organization such as the CIA found a private cloud sufficient for their extremely sensitive requirements indicates that data security in cloud computing has matured to the point that a properly configured private cloud can meet the needs of almost any organization.

If your organization plans to store sensitive data, such as personally identifiable information (PII), protected health information (PHI) or credit card data, in a cloud environment, it’s critical to consider how you will mitigate these security risks and keep your data safe.

How to preserve data integrity in the cloud

A crucial component of cloud data security is data integrity — preventing unauthorized modification or deletion, and ensuring that data remains as it was when originally uploaded. The top risks for cloud data integrity include:

• Human errors
• Insider threats
• Malicious intruders
• Compromised hardware
• Transfer errors
• Configuration errors
  

There are a variety of methodologies that help ensure data integrity in cloud storage, including provable data possession (PDP) and high-availability and integrity layer (HAIL). Many cloud security management solutions constantly compare the current state of cloud data to the last known good data state and notify admins of any mismatch.

Access control and the least privilege model are also important to ensuring data integrity. Virtual storage solutions pose risk due to file sharing among untrusted tenants. Therefore, it is important to implement a strict data access control before migrating sensitive data to the cloud. Another important best practice is regular activity monitoring of user activity, failed access attempts, modifications to files, and unusual attempts to gain access to sensitive company data.

How to ensure data confidentiality in the cloud

Ensuring data confidentiality is critical for both maintaining trust in your company and meeting compliance requirements. The high-profile breaches constantly in the news highlight the steep cost of data security issues. In particular, national and international guidelines such as the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the General Data Protection Regulation (GDPR) require organizations to ensure the security and privacy of different types of sensitive information, and can impose including stiff fines for compliance failures.

The biggest threat to data confidentiality is the potential for unauthorized access to sensitive data. There are two approaches for dealing with this risk, which can be used individually or together:

• Discover and categorize your data. To ensure that sensitive data is stored only in protected locations and is accessible only by authorized users, you need to know which of your data is sensitive and where it resides. Knowing exactly what data needs protection will help you set priorities and apply different security controls based on classification results.
  
• Data Classification for Compliance: Looking at the Nuances
  
• Use data masking. This strategy involves protecting sensitive data by hiding it with characters or other data. Data can be hidden in its original location or in real time when requested by a user or application.
  

One of the most common and secure data masking techniques is encryption, which makes it impossible for unauthorized parties to view or understand stored or shared data. Encryption can be asymmetric, which requires one public key and one private key, or symmetric, which uses just one private key for both encryption and decryption. Proper encryption key management is critical; in particular, you need to create policies that ensure only trusted people have access to them. Cloud encryption solutions are available to help prevent prying eyes accessing your protected data.

How to ensure data availability in the cloud

One of the biggest benefits of switching to the cloud is that information is accessible from anywhere that has an internet connection. Moreover, cloud services can help you avoid failures and outages associated with onsite devices and servers. Additionally, the data redundancy that cloud computing provides gives you peace of mind that your data is backed up, and helps prevent data loss.

However, it’s important that you fully vet how well your cloud service provider ensures availability for its customers. Set up a service level agreement (SLA) that guarantees the level of availability you need.

Key takeaways

When considering how to strengthen your data security in cloud computing, be sure to:

• Implement the least privilege model.
• Audit activity across your environment.
• Categorize your sensitive data.
• Use data masking techniques such as encryption.
• Make sure your cloud provider offers an SLA that meets your availability requirements.
  

These best practices are based on our expertise and years of experience and can help you ensure data integrity, confidentiality and availability in the cloud.