Cloud Data Security 

The goal of the Cloud Data Security domain is to inform you of the types of controls necessary to administer various levels of availability, integrity, and confidentiality (AIC) to secure data in the cloud.

You will gain knowledge on topics of data discovery and classification techniques; digital rights management; privacy of data; data retention, deletion, and archiving; data event logging, chain of custody and nonrepudiation; and the strategic use of security information and event management.

Domain Objectives

After completing this domain, you will be able to do the following: 

1. Describe the cloud data lifecycle based on the Cloud Security Alliance (CSA) guidance

2. Describe the design and implementation of cloud data storage architectures about storage types, threats, and available technologies

3. Identify the necessary data security strategies for securing cloud data

4. Define the implementation processes for data discovery and classification technologies

5. Identify the relevant jurisdictional data protection as they relate to personally identifiable information

6. Define digital rights management (DRM) about objectives and the available tools

7. Identify the required data policies specific to retention, deletion, and archiving

8. Describe various data events and know how to design and implement processes for auditability, traceability, and accountability

Introduction

Data security is a core element of cloud security (Figure 2.1). Cloud service providers (CSPs) often share the responsibility for security with the customer.

Roles such as the chief information security officer (CISO), chief security officer (CSO), chief technology officer (CTO), enterprise architect, and network administrator may all play a part in providing elements of a security solution for the enterprise.

The data security lifecycle, as introduced by the Securosis Blog and then incorporated into the CSA guidance, enables the organization to map the different phases in the data lifecycle against the required controls that are relevant to each phase.1

The lifecycle contains the following steps:

1. Map the different lifecycle phases.

2. Integrate the different data locations and access types.

3. Map into functions, actors, and controls.

The data lifecycle guidance provides a framework to map relevant use cases for data access while assisting in the development of appropriate controls within each lifecycle stage.

The lifecycle model serves as a reference and framework to provide a standardized approach for data lifecycle and data security.

Not all implementations or situations align fully or comprehensively