Let's continue looking at cloud data security for the CCSP
with this area on cloud data protection.
In order to protect data, we need to know how it's
stored and how it's processed.
The key to data protection is access control, making sure that only authorized
people can perform authorized functions against that data.
We can say here that an entity could be a person or a process that is
trying to perform some type of action against that data.
The idea of access control should also be based on temporal, and
that means time‑based types of isolation as well.
For example,
a person might only be able to get access to data during normal
business hours and not outside of those hours.
It also should be based on attributes,
how the data is actually stored and what that data represents.
For example,
a person might have access to it while they're in the role of
administrator, but not while they're in the role of a normal user.
There are many different threats to data.
Data could be subject to threats while in storage or,
of course, while in transmission.
In both cases, a lot of this comes down to unauthorized disclosure, a
person being able to access or read data they shouldn't have been able
to see. In storage, for example, gaining access to something that they
should not have had in transmission to something like a
man‑in‑the‑middle attack who's able to see data being transmitted from
one location to another.
One of the risks, of course, with both of these is the fact that the data could
be altered or, of course, even deleted or lost altogether.
So when we look at data protection,
we need to protect it while we transmit it through
things like virtual private networks, say, for example,
transport layer security or internet protocol security,
IPSec, or in wireless through the use of things like
WPA3. When we protect data and storage,
we do this, first of all, by making sure that we've got more than one copy, the
replication of data so that even in the case of a hardware failure, we still
have another copy we could retrieve the data from.
We protect the stored data by encrypting it and
making sure that unauthorized people,
even if they gained access to the hardware, would not be
able to have any intelligible data.
One of the things that's important with this is something we'll look
at in a few moments, and that is who has the key.
In a number of different cases,
it could be that the cloud service provider has the encryption keys,
especially with transmission or in Software as a Service.
But when we're dealing with Platform as a Service
or Infrastructure as a Service,
it could well be the cloud consumer is the only person with the key. An
important way to protect data is through hashing,
making sure we protect the integrity of the data, and a hash would very
easily pick up if there are any alterations to the data, even minor
modifications of even just a bit, for example. In the end, this all comes
down to what we mentioned, access control, making sure only authorized
people can do authorized functions.
We also have the technologies of data loss or sometimes
known as data leakage prevention.
The idea of data loss or data leakage prevention is to protect
data from leaking out of an organization.
For example, somebody is going to send out an email, and it blocks that because
it recognizes there's possibly sensitive data in that email.
But one of the other parts of DLP that's not as well known is protecting from
internal disclosure as well, making sure that information is not available to
people within the organization that don't have a need to know. The idea of
picking up data that should be protected from improper loss or leakage is by
putting labels on the data to indicate this is top secret information and
therefore shouldn't be traversing an open network, looking for keywords or even
strings that could indicate, well, that sure looks like a credit card number,
for example.
So a lot of our DLP systems will pick up in cases where data
may be leaked out either accidentally or intentionally by a
person and block that from happening.
We have something else known as DRM, digital rights
management, or IRM, information rights management.
This is about protecting data that does go outside of the organization.
DLP tries to stop it from leaking out, but DRM says we have
cases where we have to send our data out, but we want to
protect it even though it is going out.
We see, for example, that if I'm working on a contract for an organization, it
could well be that they share sensitive information with me that I need to use
to do my job, but they have a DRM protected.
That means that it's encrypted.
They have a log of every time I looked at that data. They can
automatically expire so I'm not able to get access to that data after a
certain date, and there are restrictions on what I can do with that
data, for example, I can't print it out,
I can't forward it. Now, this does not prevent somebody from
taking a picture with their phone of what's on their screen, but
it's one more layer of protection.
And the idea, of course, with DRM and IRM is to hopefully provide some level
of protection for the data that I have to share with an outside third party
and prevent them from unauthorized actions such as copying and storing that
data after it's expired, for example.