Why is cloud data privacy important?

Technology is an expensive and complicated line item for most businesses. In addition to paying for the hardware, firms must also pay for staffing and integration. Tedious decision-making regarding vendor and scaling can also drain employee time and energy.

What are Cloud Service Providers?

Today, “the cloud” saves us from these technological expenses and efforts. Cloud service providers (CSPs) offer flexible and affordable software, platforms, infrastructure, and storage across all industries. This data storage outsourcing includes all hardware and staffing needs, as well as comprehensive troubleshooting and automatic resource scaling. CSP partnerships allow firms to regain valuable time, energy, and capital. In addition, CSPs provide a high degree of standardization, self-service functionality, and automation while only charging for what their customers need.

Initially, IT executives were reluctant to partner with CSPs because they did not want to turn control of their data over to strangers. However, in the past few years, this sentiment has changed.  Cloud services are now the fastest-growing segment of IT spending, with the industry valued at $312B in 2019 and year-over-year growth of over 15 percent.

According to this article from Deloitte, the various types of cloud services include:

• Private cloud: Services which provide scalability and self-service on proprietary architecture.
• Infrastructure as a service: On-demand and scalable compute, storage, and networking hosted by a provider.
• Platform as a service: Bundle of tools for application development hosted by a provider.
• Software as a service: Applications hosted by a provider and used by customers over the internet.
• Personal cloud: Provider-hosted services which may include storage, media streaming, or collaboration, accessible through personal accounts.

Cloud Security Issues

For corporations, cloud computing naturally comes with concerns regarding data protection and privacy. New privacy regulations, evolving cybersecurity threats, and recent data breaches resulting in privacy class action lawsuits have only intensified these concerns.

One of the major security concerns of the cloud is compliance with international data laws. These laws often concern privacy and protection of citizens’ personal information.

Cloud computing involves the distribution of data across servers located all around the world. Company data may be processed (ex. collected, preserved, organized, stored, used, etc.) in countries with restrictive data privacy and protection laws.

It is not always clear which country’s data laws apply to any given situation. For example, a Mexican citizen working in Canada whose mobile device communications are stored by a cloud computing service provider in Brazil would trigger certain provisions within all three countries.

So Whose Responsibility is Data Compliance?

Although organizations may be legally held responsible for data handling, those that rely on multiple cloud service providers may have little or no control over the movement of their data. What’s more, most organizations are not even aware of how their data is stored, as cloud service providers are often reluctant to fully disclose security measures.

To offset this, some CSPs are instituting shared responsibility. Shared responsibility means a cloud security provider is accountable for security of the cloud, while businesses are accountable for the data they put in it.

However, even with this distinction, responsibility can still remain unclear. For example, in an infrastructure-as-a-service arrangement, businesses are accountable for the guest operating system, uploading and managing applications and firewalls and data, organizing assets, and granting access permissions.

In contrast, in a platform-as-a-service arrangement, the CSP is in charge of the operating system, including all maintenance. In turn, businesses take care of launching, regulating, and securing applications, as well as managing data, assets, and permissions.

This confusion causes accountability issues in which each party feels it is the other’s duty to comply with data laws, and ultimately no compliance actions are taken.

Encryption Concerns

Because the shared responsibility model puts cloud customers in charge of their data’s security, the demand for data encryption has been on the rise. In response to this demand, CSPs have launched numerous encryption tools.

Unfortunately, these tools are hardly ideal for many businesses. For example, CSPs use an encryption key for each stored data element, and these data elements can number in the millions. Having that many keys can become confusing.

Additionally, businesses never have total autonomy over data which was encrypted by a CSP. This is because the CSP controls encryption keys. In response to these concerns, CSPs have started initiatives such as “bring your own key.”  However, even with that approach, the master encryption keys, which override the firm’s keys, are always managed by the CSP.

Another security risk is that data encrypted by one provider must be decrypted, and therefore exposed to security risks, to be used by another provider or by on-premises systems.  In addition, encryption services are regional. The keys used to encrypt data in one region may not be provided to decrypt the data if it’s moved to another region.

Recent Advances in Cloud Security

Although these privacy concerns persist, when it comes to securing infrastructure, cloud providers do a better job than most firms could on their own. In fact, it is much more likely that a customer, not a CSP, will cause a security issue in the cloud.

CSPs are great safety partners because they can afford to hire professional technology talent and house optimal security technologies for their networks. They often provide a full suite of security tools. This includes the latest anti-malware software, intrusion protection systems, application firewalls, network monitoring, and event analysis solutions. These tools are powered by machine learning as well as artificial intelligence.

CSPs are also more effective at combating distributed denial-of-service attacks than most firms. This is especially important as DDoS attacks increased by 242% in first quarter of 2020, and by 542% over the previous quarter.

3 Steps to Solving CSP Privacy Concerns

There is no one solution to the security concerns when partnering with a CSP, but here are three important steps you can take to protect your data in the cloud.

1) Understand and comply with various jurisdictional privacy laws.

To do this make sure you not only understand the applicable laws for the relevant countries, but also that you constantly monitor what kind of data you are putting into the cloud. Sensitive, critical, or regulated information requires additional security and may need to be segregated. As always, personal information is often governed by data protection laws and regulations.

2) Understand where your data is stored and who has access to it

Understand how your cloud provider will protect your data.

Ask your CSP:

• Where your servers are located
• How your data is transferred
• What policies there are for intrusion detection, reporting, and security audits
• Who has access to your data
• What categories of employees and subcontractors at the cloud provider access your data
• What their logging capabilities are

Logging provides an audit trail that can show who accessed what information when.

You also need to make sure your cloud provider talks you through every step of the data oversight process. This is important because data privacy laws require quick notification of a data breach and a record of the steps taken to address it.

3) Explore different encryption technologies and tools. There is a wide variety of encryption tools to secure files, databases, and applications.

Encryption systems hide or obscure data by creating key-based algorithms, using either a shared key or a public/private key pair. When possible, try to keep the management of these keys under your firm’s control rather than the CSP’s. Your choice of encryption must align with end-user performance and your CSP. Encryption devices may cause slowdowns due to insufficient processing power.

Alternatively, you can consider tokenization, a process that involves substituting specific token fields for anonymous data tokens. This model is commonly used with applications such as CRMs (e.g. Salesforce or Dynamix) as well as other business applications (e.g. credit card data or workforce-management information).

The Future of Cloud Security

Traditional cloud data security issues including denial of service, shared technology vulnerabilities, cloud service provider data loss, and system vulnerabilities are becoming less important. Instead, companies are becoming more concerned with control plane weaknesses and metastructure failures, as well as limited cloud service visibility. Identity management is becoming a prevalent concern. Managing who has access to data is imperative for securing it.

Through identity and access management (IAM) software, access to data for specific users can be initiated, captured, and recorded. IAM systems ensure data access is granted following company policies. Security officers can confirm all users are accurately authenticated, authorized, and audited. In addition, the perspectives of firms toward data are developing. Companies understand securing data at the technological level is insufficient, and they are seeking a holistic approach to security and privacy. In order to protect information throughout the entire lifecycle, from the moment it’s captured to the day it’s destroyed, companies rely on training. A well-structured security training provides developers with the skills and best practices needed to secure your product. Interested in our training opportunities? Click on the link below!