Cloud Data Security Flashcards
Name all 6 steps in the Cloud Data Lifecyle
- Create
- Store
- Use
- Share
- Archive
- Destroy
Cloud Data Lifecycle: Describe: Create
Data creation may occur in a multitude of locations. Data may be created in the cloud environment, it can be created on premises or at a remote location, or it can be created in another cloud.
The threats to data in the Create phase vary based on where it is created and how it will be transferred to the cloud for storage.
Data Created within the Cloud Data created within the cloud should also be encrypted upon creation.
This helps to protect against both attackers who might gain access to the environment and the staff who work for the cloud service provider itself, gaining access to it in unencrypted form.
As with data created remotely, key management remains a critical part of securing the data - if the keys can be obtained by malicious actors, encryption is not a useful protection!
Cloud Data Lifecycle - Create: What should you do if data is created remotely?
Data created by the user should be encrypted before uploading to the cloud in order to protect against attacks like packet capture and on-path attacks as well as inside r threats at the cloud data center.
That means selecting strong encryption methods and implementing good key management practices, which we will cover later in this chapter.
Of course it is also desirable to ensure that the network traffic itself is secured - most often using Transport Layer Security (TLS) through an HTTPS connection.
Cloud Data Lifecycle: Describe: Use
As you review the data lifecycle diagram, you may be wondering why there is a Store and an Archive phase - they can sound pretty similar. The Store phase is what occurs immediately after creation and describes what happens to data when it is created.
Here, critical security controls include provisioning access rights to the storage locations, ensuring that the storage locations are properly secured, and continuing to protect data through encryption at rest where it is needed or required.
Cloud Data Lifecycle: Describe: Share
Although global collaboration and massive scale to many locations are both powerful capabilities afforded by the cloud, they come with risks.
If users, systems, and data can be anywhere on the planet, so can threats.
Many of the same security controls implemented in prior phases will be useful when defending the storage phase:
- encrypted files and communications
- using information rights management (IRM) solutions
- and the use of tagging and permissions models
all remain key controls.
Cloud Data Lifecycle: Share:
Do you need sharing restrictions?
Yes!
We also have to craft sharing restrictions based on jurisdiction and legal requirements. Organizations may need to limit or prevent data being sent to certain locations in accordance with regulatory requirements or contractual obligations.
These restrictions can take the form of either export controls or import controls, so the security professional must be familiar with both for all regions where the organization’s data might be shared.
Name 2 Export restrictions?
- International Traffic in Arms Regulation, or ITA (United States)
- Export Administration Regulations, or EAR (United States)
What is the International Traffic in Arms Regulation, or ITA (United States)?
International Traffic in Arms Regulation, or ITA (United States): State Department prohibitions on defense-related exports; can include cryptography systems.
What is the Export Administration Regulations, or EAR (United States)?
Export Administration Regulations, or EAR (United States): Department of Commerce prohibitions on dual-use items (technologies that could be used for both commercial and military purposes).
Name 2 Import Restrictions.
- Cryptography (Various)
- The Wassenaar Arrangement
Describe Cryptographic import restrictions.
Many countries have restrictions on importing cryptosystems or material that has been encrypted.
When doing business in or with a nation that has crypto restrictions, it is the security professional’s responsibility to know and understand these local mandates.
What is the Wassenaar Arrangement?
A group of 41 member countries have agreed to mutually inform each other about conventional military shipments to nonmember countries.
Not a treaty, and therefore not legally binding, but may require your organization to notify your government in order to stay in compliance.
Cloud Data Lifecycle: Describe: Archive
This is the phase for long-term storage, and thus you will have to consider data security over a longer time frame when planning security controls for the data.
Cryptography remains an essential consideration, but the strength of the cryptosystem and its resistance to long-term attacks and future attacks are both considerations.
Key management is still extremely important since mismanaged keys can lead to exposure or to total loss of the data, no matter how strong your encryption is.
What of the utmost importance in regards to key management and storage?
Key management is still extremely important since mismanaged keys can lead to exposure or to total loss of the data, no matter how strong your encryption is.
If the keys are improperly stored (especially if they are stored alongside the data), there is an increased risk of loss, and modern attackers are aware of and look for keys as part of their attacks.
How could elliptical cure cryptography (ECC) benefit the Archive - data lifecycle
One aspect of cryptography to be aware of is elliptical curve cryptography (ECC).
ECC uses algebraic elliptical curves that result in much smaller keys that can provide the same level of security as the much larger ones used in traditional key cryptography.
