Data breaches occur all too often. Tighter controls are imminent and will help protect Personally Identifiable Information. However, every person or business that posts or stores anything on a Cloud Platform MUST take full responsibility for that data. This includes understanding the security of the Cloud Service.
This blog is NOT a full and complete list of all security measures that could be implemented but I would like to highlight some of the measures that should be considered.
Risk Awareness
We all have data that is pretty much of very little value to anyone else. That picture of your new born baby might have massive sentimental value to you but is probably not going to be worth much in the hands of a criminal. We also have data that we intend to be publicly available: Your CV, for example, or a company’s marketing brochure.
Some data that will be stored in the Cloud could cripple or destroy a business if it were to be compromised. Every piece of data has a value to you and a value to others. The costs of securing data should be carefully weighed against those values.
Your CSP
Whilst a very large company investing millions in a Cloud Service might well want to spend money determining how secure a CSP’s datacentres are, for the most of us that is overkill. Cloud Service Provider’s (CSP’s) base their business case on providing a secure solution. For the most part, we can safely assume that data stored with a major player in the Cloud will be significantly more secure than storing it ourselves. (Yes, even if you keep it under your pillow … or your dog’s pillow)
They will however expect you to do your part!
ENCRYPTION
Hopefully an obvious one but if you don’t intend your data to be publicly available then you should definitely encrypt it! However you have a number of options.
- Encrypt on premise and manage your own keys.
- Encrypt in transit using your own or a CSP managed key.
- Encrypt at rest using your own or a CSP managed key.
For the vast majority of us, trusting the keys provided by the CSP will be sufficient. If you are storing government secrets you may wish to manage your own keys.
Account Security
From when your account is first set up you should be sure that your access to your account cannot be compromised. If you allow someone else access to your account everything else becomes irrelevant. In many companies though access needs to be shared. There are a number of tools we can use such as Multi-Factor Authentication that we can utilize to help us implement Least Privilege Access.
Least Privilege Access
It is essential that any Cloud Strategy simplifies the process for devolving access and responsibility for data. Practices that have been important in traditional computing environments for many years are even more crucial as we move to the Cloud. This includes appointing a data owner for every bit of data and managing the full life cycle of that data. Least privilege, as the name suggests, means that we only give the minimum amount of access to data that a person needs to accomplish the specific task in hand. Some CSPs allow a person (an identity) to assume a number of roles which allow differing levels of access.
Firewall Controls
All major CSPs offer a competent firewall service that can be trusted. This should be utilized to implement Least Privileged Access to the public. This would indicate that where a service has a public front end, the data behind that service is held in a place that is fire-walled off from the front end.
CI / CD
The perfect security solution lies in making security part of your release process. The most forward thinking companies have a process of Continual Improvement and Continuous Deployment. One of my favourite lines is that Etsy ask their new programmers to deploy to live on day one. It is possible to completely automate the processes that secure our data and our infrastructure in the Cloud. This is complex but will be valuable when done well. One day all code will be released this way (I hope 😉 )
