Let's take a look at the cloud data lifecycle.
This was defined by the Cloud Security Alliance as a way to ensure
we understand that data must be protected all the way through the
lifecycle from creation until deletion.
The lifecycle is defined as create, store,
use, share, archive, and then delete. During the create
phase is when we first receive the data.
Maybe, for example, it came in from a customer or a
business partner or another system.
This is the point at which we already begin to set up the ownership and
classification of the data. As the data is received, then it is correctly
labeled, and, of course, it could be that we even want to make sure the receipt
of the data is done in a secure manner, for example, by using encryption. The
store step happens usually together with create. We receive the data, and we
enter it into our system, we store it.
It is important then that we follow the data handling procedures that
were associated with the classification of the data.
So right away, we begin to label it and indicate how that data
must be protected within the organization.
The next step of the data lifecycle is when we actually use the data. We
must protect data while it's in use, and this, for example, means we
train our users into when you access data,
what can you do with that?
Who can you share it with, for example? And sometimes, we will, of
course, practice things like obfuscation or data hiding.
We won't show users parts of the data they shouldn't see, whether or not
we do that through obfuscation or maybe through something like a database
view that hides some of the columns of data from the users that don't
need to see what's in that column.
One of the ways we do date hiding, of course, is through encryption.
We can encrypt data so that it's not visible to those
who are not authorized to see it.
We could mask it so that even if a person was shoulder surfing,
looking over the shoulder of a user,
they would not be able to see what the password was that was being entered.
Or we can use things, of course, like screen filters that can make it
difficult for someone to read the data on somebody else's screen.
We use obfuscation to try to hide the data by putting in other
ways to then mask the data so it's not visible.
We often do this, of course, with things like passwords and so on as well.
One of the things we'll often do is remove any personal
identifiable information that's associated with the data, so we
can make sure the data remains anonymous.
But when we do this, we still have to be careful of things like data
aggregation where a person could combine many data sources together and
learn something that we thought was hidden, or, of course, we have to make
sure that our base is large enough that it's not going to be possible for a
person to deanonymize the data. That, of course, is always a risk. You fill
out that confidential employee survey, for example. And the problem is that
when it asks some of the demographic questions, gender, age, department,
well then you actually know exactly whose answers those are because
they're the only person of that age in that department, for
example. One of the ways we, of course, protect data from
unauthorized disclosure is through things like data loss or data
leakage prevention, DLP, systems.
We can also protect data that goes outside of the
organization using things like digital rights management or
information rights management as well.
During the share phase, this is where we're sharing the data
with maybe a third party with another system.
And, of course, we have the problem here that the cloud is very much
a globally accessible repository of information.
So therefore, we have to make sure only authorized users are able
to perform authorized functions to that data.
We can do this in part through things like multi‑factor authentication,
MFA, to make sure it truly is that legitimate user who is trying to access
the data over the cloud provider's network.
We enforce those age‑old access control concepts of things like least
privilege and need to know. Need to know usually comes first.
Do you even need to know what that information is?
If not, don't show it to them.
The next thing is least privilege that says and if you do need
to know, what can you do? Can you update it?
Can you read only?
Can you change it or modify it?
So we bring in these ideas of least privilege to try to make sure
that authorized people, need to know, don't perform unauthorized
functions through least privilege.
One of the things we always have to watch for is that we're dealing with
a global environment, and cloud service providers often operate in many
different countries, and we have to be careful of the laws that pertain
to things like intellectual property and to such things as where can my
data then be hosted?
The jurisdiction for things like data storage and access.
This also becomes an issue with countries that have laws regarding cryptography.
It could be that I'm not allowed to use certain forms of cryptographic
algorithms in certain countries, and I have to be careful if my systems are
employing those types of cryptographic algorithms.
The next step in the data lifecycle is archive.
This is where we quite often will put our data into long‑term storage.
Maybe we put it on a storage medium such as optical disks, tape.
There's a lot of ways we can store data for long term because
flash memory and solid state drives are not really that good
and reliable for long‑term storage.
It's quite often better to use something such as an optical disk.
But even something like that has to be properly stored and maintained.
We have to have the right hardware that will be able to read that tape maybe
five years from now when we have to recover data off of it.
We also have to look at what type of format the data is in.
Do I have the correct file structures that are going to be able to be
readable five years from now? And, of course, do we have the encryption
keys and the algorithms still available that we used when we took that
backup or that archive five years ago? It's also important to ensure the
protection of our archive data so it's not going to be lost due to fire,
earthquake, storms.
We have proper physical security in place to protect us from anything from
a natural disaster, of course, to something like high heat or humidity in
the place where we're restoring our data.
One of the concepts, of course, with that is geographic
separation so that my data that is being stored off site is far
enough away not to be affected by maybe the same disaster that
could affect my primary data center.
The final step in the data lifecycle is really the delete or destroy.
We see both terms used here. And one of the things that is often
done here is the use of secure destruction of data.
Now, one of the things they mean when they say secure is mean as defensible.
Could you stand up and say with certainty that that data was destroyed?
Is it defensible, or is it, well, I think it was? We had a contract in
place, but I'm not sure if they followed up on it.
So part of this is that should we say here that quite often the
term auditors use is professional skepticism.
Yes, you said it was destroyed, but I'm not the trusting type of person.
So could you show me how you actually destroyed that hardware that that data
was on, for example? One of the important things with this is we have to
keep data as long as it's required to be kept by law or as long as, of
course, the business would need it. And therefore, we should have policies
that clearly state what the retention period of our data is, as well as then
the process that will be used to destroy that data at the end of the
retention period.
In the end, data must be protected consistently,
appropriately throughout the entire data lifecycle.
Now that doesn't say the classification can't change. Data that was
originally classified may actually have a lower level classification
by the time it reaches end of life.
The determination of the correct handling procedures is the
responsibility of the data owner, and it is important here to assure
that we are compliant with regulations, and that data will be available
to support business operations as required.