Chapter 4 - Cloud Data security Flashcards
How should data that is created remotely be secured when uploading it to the cloud?
Use a cepytosystem listed on FIPS 140-2 to encrypt before uploading.
Good key management should be in place
Should be uploaded via IPSec VPN
How should data remotely created in the cloud be secured?
Should be encrypted upon creation
How should data for use in the cloud be secured?
Modification permissions, audits and logging, limited modification permissions according to function
For csp data on virtualized host must be secured so that other virt hosts can not read or detect the virtualized host
Cap should implement administrative and personnel controls
How to secure cloud data in share phase?
Name export restrictions
Name Import restrictions
Encrypted files and communications, drm solutions, sharing restrictions according to jurisdiction
Security team must be aware of import and export controls for all locations the data might be shared
Export: ITAR, EAR
Import: cryptography restrictions in different countries, wassenaar agreement
Which other factors beside encryption and proper key management should be considered while archiving data?
Location : disasters and law, how far is it away?
Format: ssd? Tape? Is it portable and needs additional security? Maybe outmoded in future?
Staff: own personnel at location? Proper personnel control by csp?
Procedure: how to recover when needed? How is it Ported there on regular basis?
Which types of cloud storages exist?
volume storage:
- file storage : hierarchical and often used for cloud and big data
- Block storage: Blank storage with high administrative effort but higher performance. Often used for data of multiple types and kinds
- mostly associated with IaaS
Object Storage:
- object Stored with metadata with significant level of description
- description enhances data policy enforcement, indexing capabilities and centralization of data management functions
- mostly associated with IaaS
Databases:
-mostly used in PaaS and SaaS
Content Delivery Network (CDN):
- copy of frequently requested data near locations with high use demand to reduce distance and improve bandwidth and delivery quality (e.g. streaming)
Which key management aspects must be considered?
- Level of Protection of the key itself
- At least as high as data itself
- determines by sensitivity of data
- key recovery
- mechanisms to recover keys . Usually by a group of people with only a portion of keys
- key distribution
- Should never be distributed in clear
- often passed out of band
- key Revocation
- key escrow
- copy of keys held by trusted third party
- outsourcing key management
- key should not be stored with data. Better somewhere outside of cloud provider
- storing in own organization is ok but expensive(attenuates benefit of cost reduction)
- ## using a casb. They can handle iam and key management services. Cost of casb should be much lower than storing it in organization
What are masking, anonymization, obfuscation and tokenization techniques?
Randomization (exchange letters and numbers but keep same length and characteristics)
Hashing (unrecoverable but loss of information of original data)
Shuffling (shuffle data from data sets)
Masking ( XXXX-123 … like Credit Card Numbers)
Nulls (replace with nulls)
What is the difference between static and dynamic obscuring configuration?
Static: A copy the original data is created and obscured
Dynamic: data is obscured as it is called
What is anonymization?
adding another layer of sensitivity so that fields can be marked and anonymized as a combination may lead to PII (eg age, height, street and number)
How does tokenization work?
Two databases: actual data and token dB
User calls application server which calls token server. User is authenticated and if he has he right permission the token server takes the correct token and maps it to the relating data. Data is then presented to the user
Token server must have strong authentication protocols
What is a SIEM?
Security Information and Event Management
Goals:
- centralize collection of logs: easier to administrate but requires additional layers of security control
- enhances analysis capabilities: automate log analysis. Automation can not recognize low and slow attacks
- Dashbording
- Automated Response: automated alert and response capabilities
What is egress monitoring (dlp) and what are the goals?
Log and control flow of unwanted, malicious or destructive outgoing traffic
- Additional security: one last mechanism to prevent unwanted release or malicious disclosure
- Policy Enforcement: Users can be alerted by the DLP when they are attempting to perform action that violates organizations policies
- Enhanced Monitoring: one more log stream
- Regulatory Compliance: Specific types of data can be identified and dissemination of data can be controlled accordingly
