[Autogenerated] Hi,
this is Kevin Henry and welcome to the cloud data security course for
the certified cloud security professional examination.
This is the second domain of the sea CSP exam outline the first domain,
cloud concepts, architecture and design was worth 17% of exam questions.
This domain is the most important worth 20% of the examination.
We divided this course into two main sections Cloud data security
concepts and cloud data security technologies.
This is the first one we'll look at here.
Cloud data security concepts.
When we take a look at cloud data security,
we realize that data is an asset of the organization.
It is in most cases essential for business operations and therefore we
often measure data according to its criticality,
criticality or availability means how important it is for the business to
actually operate or be able to perform its business functions.
We need to protect data according to its criticality and that is
first of all done through identifying what data we even have and
where that data is actually located.
We need to know what data do we use,
what data do we need and maybe even what data should we not be
keeping because we don't really need to have it.
It's important that we look at data in all forms that is electronic data,
but also the protection of paper and even verbal communications,
video as well.
The important thing is when we want to protect data,
we have to designate the person who is accountable for that.
That is establishing ownership of the data.
Data ownership is often required today by law.
There are a number of countries that have laws that specify that a
individual must be designated as the actual data owner.
That person must be a senior manager,
a person that has budgetary authority and is able to accept
liability on behalf of the entire organization.
Now a large organization quite often could have one or more data owners.
There could be owners of financial data,
but somebody else could be looking after the ownership
of a research or other types of data.
The role of the data owner is to ensure that the data is protected.
But the important term here is the appropriate level of
protection so that the data is not over protected but
certainly not left vulnerable either.
It's important that data is protected consistently as
it moves through the organization.
This is one of the reasons why we quite often can have data that moves
from one department to another one system to another.
And even in different formats at one point it was on paper and
then it was scanned in to be electronic.
The data must be protected the same on all of those systems
in all of those departments and of course in all of those
formats when we look at the cloud,
we can often see that the person who actually looks after the data is
often the data controller or also the data processor,
they are the person that has control of the data within
the cloud service providers environment.
Now, this is not to say that they truly are the data owner,
but they are the owner of the data while it's on the cloud.
But the consumer that has engaged the services of the cloud provider still
remains ultimately accountable for the protection of the data.
This brings him the idea of liability.
The idea is that by establishing accountability, the data owner is accountable.
They also then become liable for the protection of the data,
setting out the way the data should be protected appropriately and
then taking steps to ensure that it is protected according to the
mandates and the directions they have given.
These are the two terms of due care and due diligence.
Due care is to make sure that the policies are in place to
protect the data and due diligence is to follow up and make sure
that those policies are being followed.
Even if our data is processed by a third party,
such as a cloud service provider,
we need to ensure that we have mandated the appropriate
levels of protection for that data, even though it's on the premise,
a say, a cloud provider,
this becomes even more complex when one cloud provider engages
the services of other subcontractors as well.
So this need to protect data can actually go several
layers deep within an organization.
Some examples of data protection laws that are out there.
The general data protection regulations in the european union
Sarbanes Oxley dealing with financial data especially the United
States though many other organizations and countries also have
their own versions of socks as well.
There's the Gramm Leach Bliley Act, also dealing with financial data,
the United States and dealing with healthcare information HIPAA Many
countries have data protection laws quite often.
These are centered around privacy and it is important that
when we are looking at protecting data,
we have to be sure that we are compliant with the laws of the countries
that are involved whether or not where the data is being hosted processed
or where the data actually comes from as well.
Some of the other roles and responsibilities related to the
protection of data include the custodian.
The custodian is a person who has custody or has the
possession of a piece of data at a point in time.
For example, a user within an organization can look up a customer record.
The user does not own the data, but they have temporary custody of it.
And as such,
they need to make sure that they're only handling that data according
to the policies and procedures that are mandated.
This includes of course,
even things like system administrators that do backups of data
that they neither used nor even our owners of but they still are
the custodian of that data and must make sure that it's properly
protected in the cloud.
We have the data processor,
the person who's processing the data on behalf of a cloud consumer
and they must also protect data appropriately.
You also have the person whose data it is.
We could call them the subject if I am a customer of an
organization and I entrust them with my personal data,
I am still the subject and therefore I have certain requirements
and obligations to make sure that the data that I provide them is
only provided with knowledge with appropriate and in some cases
even I can request that they declare it's me what data they have on
me as well as a user.
A user is using the data and must make sure that they follow the handling
procedures according to the classification of the data as well.
Administrators are a special group.
They very often have elevated privileges.
They can do anything,
they can see anything and in some cases they're not the
highest paid people in the organization either,
but they have elevated privileges.
And it's really important that we inform them of what the appropriate
actions that they can take with relation to data.
They are therefore trusted staff.
And this of course includes the people that work for the cloud service provider.
The people that work for the cloud service provider must be informed
of what they can see and they can't take a look at.
So they don't step over the boundaries of what would be unauthorized disclosure.
It also includes service operation staff who maybe even work in a
different country but are providing help desk services.
Do they misuse some of that access?
They have We also have for most organizations,
internal administrators, everything from network to system two.
Database administrators and all of these have elevated access and elevated
privilege and they must know what is appropriate that they can do with
relation to that data when I give a person access,
I also give them a level of accountability for what they do with that access.
So we need to work with system administrators,
network administrators, database administrators.
So they all know what are the appropriate actions
they can take with relation to data.
In most cases they would be data custodians.
An important graph here is this example of security responsibilities.
We see that when we deal with the cloud,
we have a differentiation of who has responsibility for what we
could see though at the top line that data governance and rights
management is always retained by the customer regardless of the
deployment model of software,
platform infrastructure or even on premises as a service.
The idea of course is that the cloud consumer or customer
must ensure the protection of the data.
It is only when we get down to areas of identity and
directory infrastructure applications,
we start to see either shared responsibilities or eventually
that the operating system for example,
in a software as a service model is solely the
responsibility of the cloud provider.
The key points review data is perhaps the most
important asset of many organizations.
So before we jump headlong into something,
we should say, should we trust our most important assets to somebody else?
And obviously in today's world we do in many cases,
but when we recognize data as our most important asset,
then we must also recognize what precautions we should
take to protect that data appropriately.