-
10/2/13 11:22 AMBlog - Beyond Encryption: The 5 Pillars of Cloud
Data Security - Infosecurity
Page 1 of
3http://www.infosecurity-magazine.com/blog/2013/9/3/beyond-encryption-the-5-pillars-of-cloud-data-security/990.aspx
Beyond Encryption: The 5 Pillars of Cloud Data SecurityBy Kamal
Shah
Given the recent influx of cybersecurity attacks and the hubbub
about the NationalSecurity Agencys PRISM program, there is lot of
talk about the importance of en-cryption to protect corporate data
in the cloud. (PRISM is a clandestine data miningoperation
authorized by the US government in which data stored or passing
over theinternet can be collected without the owners knowledge or
consent.)
While its true that encryption helps to keep data private,
encryption is just 1 of 5 ca-pabilities needed to completely secure
corporate data in the cloud. Allow me to usean analogy in the
physical world to explain what I mean.
Banks are an ideal example of the use of layers of security to
protect important assets.A bank branch has a vault in which it
stores cash and other valuables. Having a vaultis essential, but on
its own its not enough to fully protect the riches within.
The bank also has policies to guide who can access the vault;
what identificationmethods are required to verify that an employee
or customer has the right to accessthe vault; the hours when the
vault can be legitimately accessed; and so on.
The bank also needs surveillance cameras so that in event of a
breach, the authoritiescan play back the recording to understand
exactly what happened, and when. Sta-tioned near the vault, the
bank has a security guard for additional protection againstthreats
and to deter thieves. And finally, the bank employs armored vans to
movecash around from the bank to stores, to off-premise ATMs, and
to other banks.
Similarly, when we talk about protecting corporate data in the
cloud, you need morethan just a point encryption solution; you need
comprehensive approach to clouddata security.
Lets start with encryption a technology that has been around for
decades but isnow more important than ever as threats from all
angles are increasing. The encryp-tion solution you use on your
data needs to be standards-based and it must supportboth structured
and unstructured data. For structured data, the encryption
technolo-gy must not break any application functionality (such as
searching or sorting). Thislatter requirement is quite important;
if you cant search on data in comments field in
-
10/2/13 11:22 AMBlog - Beyond Encryption: The 5 Pillars of Cloud
Data Security - Infosecurity
Page 2 of
3http://www.infosecurity-magazine.com/blog/2013/9/3/beyond-encryption-the-5-pillars-of-cloud-data-security/990.aspx
Salesforce.com because it is obscured through encryption, youve
defeated the valueof using the application.
So, encryption is 1 of 5 critical security capabilities. What
are the other four?
You need contextual access control so you can ensure secure
access to the data basedon who the users are, what devices they are
using, and what geographic locationsthey are in.
You need application auditing so you can identify who has
accessed which data andalert based on anomalous use. This is
critical because most SaaS applications dontprovide an audit trail
of read operations to understand what exactly happenedwhen an
incident occurred.
You need data loss prevention to make sure that PII and PHI data
is not moving to orthrough the cloud in the clear in violation of
PCI, HIPAA and HITECH regulations.
And finally, you need the ability to easily but consistently
enforce these policies forcloud-to-cloud use cases.
This last need is an up-and-coming requirement that companies
are just beginning torealize, but it will grow more important as
companies use more cloud-based applica-tions. Let me give you an
example.
Lets say a company uses Jive for business social and Box for
cloud storage of docu-ments posted in Jive. When Jason, an employee
in my Sales department, posts a blogpost on a competitor with a
detailed attachment, Jive automatically stores the docu-ment in
Box. In this cloud-to-cloud scenario, I need to make sure that my
security,compliance and governance policies are consistently
enforced across both Jive andBox.
Encryption as a means of data security is a good start, but not
sufficient. Make sureyou bolster it with the other critical
security capabilities for a more complete clouddata security
strategy. To learn more check out our Beyond Encryption
Slideshare.
Kamal Shah is the VP of Products and Marketing at Skyhigh
Networks.
Comment on this blog
-
10/2/13 11:22 AMBlog - Beyond Encryption: The 5 Pillars of Cloud
Data Security - Infosecurity
Page 3 of
3http://www.infosecurity-magazine.com/blog/2013/9/3/beyond-encryption-the-5-pillars-of-cloud-data-security/990.aspx
You must be registered and logged in to leave a comment about
this blog.
