Previously, we looked at cloud data security for the CCSP from the
perspective of cloud data security concepts.
Now, we'll take a look at some of the technologies we use
to ensure security of data in the cloud.
The idea, of course, is that data is stored and
processed in the cloud in different ways.
We have ephemeral storage such as data that's stored just
temporarily, say, in a virtual machine. And once that machine has
been powered down, that data should be lost.
We have raw storage and, of course, vast amounts of rather
inefficient storage, in some cases, where we can keep data that, in
many cases, needs a lot of cleaning up and so on.
But often, of course, this is used in very large files such
as even photos, for example, as well.
We have long‑term storage where data is being stored both for archiving,
but also, of course, for production use over an extended
period of time. There's a couple of different data storage
types that have commonly been used, volume storage and object storage.
When we look at, for example, block storage,
we can look, for example, at things like files and file folders.
These are traditionally then stored in blocks on specified hardware.
Quite often, we would map this out in the mainframe days on tracks and sectors
that would be available for a program that was going to run.
The problem with this was that if we had a sector that wasn't being fully used,
that was a waste of resources. It was rather expensive,
poor scalability, and jobs would even fail if not enough tracks,
for example,
have been allocated for a job. Very often, block storage was
accessed through applications and operating systems.
When we looked at file storage, we often stored data in files in some
type of hierarchical structure such as a directory.
These, again, could be accessed through the application and operating system,
but we ended up with larger and larger directories that became a little bit
cumbersome and sometimes hard to organize. Some of you,
your email inbox probably looks like that, in a lot of cases. But these, of
course, are also good for transactional activity, for example,
when I need to load something into a database, for example. The idea of
object storage is to store data as objects, including the metadata that
describes what that object actually is.
This works well in the cloud.
We could store these in containers and access them through HTTP‑based
RESTful APIs, for example. It's a type of flat storage.
It's not stored in a tree or directory, and the metadata is what makes it
easily searchable we could say. One of the advantages of this is we could
easily detect any type of integrity problems.
It's easy to replicate or copy the various objects or to check to
make sure that they have not been improperly altered using things
like check values and hash values.
The benefits of using object storage is that now our data objects can be
accessed from anywhere in the world and, in many cases, by a lot of
different types of devices. We're not limited to one type of end user
device, for example, or one type of application.
They can easily be accessed from different types of operating systems and so
on. Because these can be easily replicated, it's very good for things like load
balancing and even hardware abstraction as well.
That allows us to be able to ensure that a person is able to get
access from hopefully a remote edge device without having to
retrieve data from all the way around the world.
The other thing is that this allows for faster search and retrieval using
things like the metadata. We could say, in many cases, the storage systems
operate just like a valet in a car parking lot that the valet can put the
cars where it's best to optimize the data.
It's very scalable,
less expensive, and therefore this works really well
with our content delivery networks, our videos,
images, blogs, and so on.
The idea of metadata, of course, is data that describes
data. Kind of a funny term in one way.
But the advantage of this is that it is the descriptor, say,
of that object or that data that can be searched.
So we could find all data that fits into, say, a certain category. We
see here a picture of an evening in Kuwait, and we can see the metadata
there that names what this JPEG is called,
its resolution, the date the picture was taken.
But also, we have something that indicates what is the actual hash values.
So if that data or that picture was in any way altered,
that hash value would also change, and we'd know that that
was not the original or unaltered document.