Securing Cloud Data

"Cloud computing, when IT software and services are delivered over the web and through a browser, is a paradigm shift, similar to taking your jewelry out of your sock drawer and placing it in the bank," wrote Feiganbaum on Google’s blog.

While these comments drew an avalanche of criticism, citing a glitch in Google Docs and Presentations that inadvertently shared private data with people who the owner of the data had previously collaborated with on another project.

Like securing data on your own network, data in the cloud can be secure because good security is good security, no matter where it exists.

Data Protection

Protecting your data in the cloud is done by implementing:

• Access control lists to define the permissions attached to the data objects
• Storage encryption to protect against unauthorized access at the data center (especially by malicious IT staff)
• Transport level encryption to protect data when it is transmitted
• Firewalls to include web application firewalls to protect against outside attacks launched against the data center
• Hardening of the servers to protect against known, and unknown, vulnerabilities in the operating system and software
• Physical security to protect against unauthorized physical access to data

If data was stored on a corporate network, management would want to know what security controls are in place, to what extent are these controls implemented, and what plans are in place to deal with an attack. Likewise, these questions should be answered sufficiently by cloud providers.

Additionally, it needs to be made clear as to what the provider is responsible for as far as security is concerned, and what the owner of the data is responsible for. According to a report titled Security Guidance for Critical Areas of Focus in Cloud Computing V2.1, (http://www.cloudsecurityalliance.org/csaguide.pdf) "The key takeaway for security architecture is that the lower down the stack the cloud service provider stops, the more security capabilities and management consumers are responsible for implementing and managing themselves." Knowing who is responsible for what can prevent unnecessary finger pointing in the future.

Accessibility

While data theft (confidentiality) and data tampering (integrity) often take the forefront of the security discussion when it comes to the cloud, the accessibility of data should not be overlooked. Consumers need to question what the cloud provider has in place to protect against threats like Distributed Denial of Service attacks that can prevent access to stored data. Another consideration this how backup and recovery is handled by provider to deal with disaster recovery.

When Eran Feiganbaum compared cloud security to bank security, it was based in the theory that like a bank, a cloud provider has the resources to put security measures in place for protection that cannot be achieved at home, or on the corporate network. Like storing valuables in a bank, the owner of the data needs to take responsibility and check out the thickness of the vault, the reputation of the security guards, and the placement of the cameras.

Related Articles:

Senior bureaucrats lax on BlackBerry security
The Price of Ignoring SQL Injection Vulnerabilities
110,000 Credit Card Numbers Stolen in Tour Company Web Server Hack