Security in the Public Cloud
Security in the public cloud is similar to security in a third-party hosted private cloud, with a few important exceptions. Most notably, the public-cloud provider is largely responsible for security of its customers’ data and applications. Any organization looking to cede responsibility of its security to a third-party provider had better make sure that the provider has the proper security practices in place at all appropriate layers of the cloud infrastructure — and maintains those layers correctly over time. This is particularly true if the data to be hosted in the cloud is sensitive, which it often is.
Among cloud computing security threats, data breaches cause the most concern. The most targeted types of information include sensitive personally identifiable information (PII), financial information and proprietary intellectual property. Medical records are also of particular concern in the cloud. Consider what sensitive information an organization might have that malicious parties might want to gain access to. Now consider that in a public-cloud architecture, the enterprise is handing over the sensitive information to another party to safeguard.
Some find that prospect so risky that they refuse to place their sensitive data into a public-cloud architecture. If the cloud provider fails to safeguard the data properly, a major data breach could result, possibly leading to repercussions for the cloud provider, but most certainly leading to severe consequences for the organization whose data has been compromised.
The Financial Risks of the Cloud
Imagine not only the damage to the organization’s reputation, but also the financial repercussions of handling the breach of thousands or millions of customer or employee records. The Ponemon Institute’s 2013 Cost of Data Breach Study: Global Analysis estimates the average cost of a U.S. data breach at more than $5 million — based on an average breach size of less than 30,000 records. Fortunately, the enterprise typically doesn’t need to give up complete control of the security of their public-cloud data and applications. The most often recommended security measure in these situations is to follow sound cryptographic key management practices, including retaining control of all encryption/decryption keys.
Encryption is of utmost importance in protecting the confidentiality of sensitive data. If the cloud provider has access to an organization’s data encryption/decryption keys, then the risk of an inadvertent or intentional breach of the sensitive data protected by those keys is significantly higher. Indeed, encrypted data cannot be recovered if it is stolen without the keys to decrypt it, and, thus, a full breach can be avoided.
Organizations seeking to deploy sensitive data to public clouds — or to any clouds — should follow best practices in terms of encryption use. Access to sensitive data should be designed to be as granular as possible. For example, the enterprise should encrypt individual database records or sensitive fields within database records instead of encrypting the entire database as a single entity. This allows individual database records to be decrypted as needed, instead of decrypting the entire database and keeping it in a fully decrypted state while using it.
It’s important to also maintain visibility into the security of cloud-hosted data and applications. Because traditional operating system–based security controls may not be feasible, for a variety of reasons, organizations may need to rely on application-based security controls. For example, administrators may need to configure applications and databases to do extensive logging of all access to and manipulation of sensitive data. This can take the place of relying on operating system auditing controls.
Want to learn more? Check out CDW’s white paper, “Peace of Mind Security in Public and Private Clouds.”
