Let's take a look at the important areas we covered in the
second domain of the CCSP, cloud data security.
The exam content outline for cloud data security includes these
topic areas, describing cloud data concepts,
design and implement cloud data storage architecture,
design and apply data security technologies and strategies, implement data
discovery, and plan and implement data classification. It also includes
design and implement information rights management,
IRM, plan and implement data retention, deletion, and archiving policies,
design and implement auditability, traceability,
accountability of data events.
All of these topics are testable, and the exam candidate
should be familiar with each one of them.
Some of the key points we covered in this course include
data is one of the organization's most important assets for
nearly every organization today.
It is critical for business operations.
The core principle behind data security and therefore data protection is to
establish data ownership. And data must be protected throughout the entire
data lifecycle. When we deal with a cloud,
this becomes even more complex than just dealing with it ourselves.
The goals of data security include ensuring the
appropriate protection of data. That means not too much,
but certainly not too little, either.
We protect data at all times during the data lifecycle. We establish that
ownership, which brings in accountability. In all of this, we set up a level of
accountability and responsibility that can protect the organization, both to
ensure that its data is available when needed,
but also to protect it from some type of liability or
breach of government regulations.
The concepts behind cloud data security really cycle
around the areas of access control.
Same as they do when we don't deal with the cloud, but access control
becomes more complex when we're dealing with a third party. We protect
data quite often through data hiding.
For example, we can use tools like tokenization, encryption, and obfuscation.
We also protect our data through information rights management and data
loss, or sometimes called data leakage, prevention.
We have to be careful, especially when we aggregate large amounts of data
together. That can lead to things like inference and the risk of exposure of
sensitive information through data aggregation.
Some of the threats to data and security really circle around these
areas of ensuring the data is available when needed, that we handle it
correctly according to the classification and rules set out by the
data owner, and we preserve the integrity of our data and the way we
process the data as well.
Some of the key points to remember, contracts and
service‑level agreements are key.
They are required to mandate and show that we've done due care in
ensuring the protection of our data. Even though we may host our data
on a cloud service provider and the cloud service provider will handle
both the processing and storage of our data, as well as some of the
network communications,
the ownership and the responsibility for the protection of the
data remains with the cloud consumer. Data must be protected
at all times and in all forms.
The next steps. Now that you've done this domain,
do the self‑assessment questions.
Think about why one answer may be better than another,
and review the references, important terminology, and exam
essentials that are provided in the study guide,
then proceed to the next course, Cloud Platform and Infrastructure Security.