Data Protection in the Cloud: Challenges and Best Practices

Whether you run your workloads in the public cloud, a private cloud, a hybrid infrastructure or a multicloud with several cloud providers – you need to comply with data regulations and ensure the security of your data.

Non-compliance with data regulations and a subsequent breach can lead to monetary losses and damage to brand authority. To achieve data protection in the cloud, you can implement various techniques, such as encryption, access control, and endpoint security, and monitoring.

In this article, you will learn:

• What is cloud data protection
• Why companies need cloud data protection
• Data protection challenges in the cloud
• Cloud data protection best practices
• Data Protection with Cloudian HyperStore

Note: This article is part of a series on Data Protection.

What Is Cloud Data Protection?

Cloud data protection is a set of practices that aim to secure data in a cloud environment. These practices apply to data regardless of where it is stored or how it is managed, whether internally or by third-parties. Cloud data protection practices have become key aspects of data security as companies increase the amount of data stored in the cloud.

If you’re interested in data protection, you can learn more in our guide: Continuous Data Protection.

Why Companies Need Cloud Data Protection

Many companies collect and store significant amounts of information, including sensitive data. Most of this data touches the cloud at some point, either during collection or in storage.

Part of the reason for the growth of cloud-based data storage is that organizations are increasingly operating via web portals or are using software as a service (SaaS) offerings. Both of these require cloud access. Additionally, many companies are choosing to store data in the cloud even for internal use.

As companies adopt cloud services, data protection becomes more complex:

• Companies may not know where all applications and data are stored.
• Third-party hosting limits visibility into data access and sharing.
• Shared security responsibilities may be misunderstood or misapplied.
• If companies are using multiple cloud providers or hybrid infrastructures, security may be inconsistent.
• Data may be subject to data protection regulations like the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or the USA Health Insurance Portability and Accountability Act (HIPAA).

Data Protection Challenges in the Cloud

When setting up data protection in the cloud, your organization is likely to face several of the following challenges:

• Integrity—systems need to be designed to ensure that only authorized access is granted. Configurations should also ensure that permissions to modify or delete data are restricted to appropriate users.
• Locality—data regulations are applied by the physical location of data, where it is collected, and where it is used. In a distributed system, this can be difficult to determine and control. Systems should be designed in a way that clearly defines where data is located at all times.
• Confidentiality—data needs to be secured according to its confidentiality level. This requires properly restricting permissions and applying encryptions to restrict readability. Likewise, admin credentials and encryption keys need to be protected to ensure that these restrictions are maintained.
• Storage—cloud infrastructure is entirely controlled by the vendor. This means that companies must rely on vendors to ensure that physical infrastructures, networks, and data centers are secure.

Cloud Data Security Best Practices

To ensure that the protections you create are effective, consider including the following best practices.

Evaluate built-in security

Any cloud vendor you choose should have strong internal controls in place and should offer robust tools to help you secure data. Look for vendors that offer service level agreements that ensure systems are properly protected.

Additionally, make sure to verify what policies vendors have in place to meet compliance regulations. If vendors are not certified, you may not be able to meet compliance standards.

Utilize file-level encryption

Most cloud providers offer some measure of both in-transit and at-rest encryption. You should enable both of these. You should also consider adding additional file-level encryption. The easiest way to do this is by encrypting data before you transfer it to cloud storage.

If you are not able to encrypt at the file-level, see if you can “shard” your data. Sharding stores parts of data or applications in different locations. This can make it more difficult for attackers to reassemble your data even if they do gain access to it.

Learn more about data protection in our article: Data Encryption: An Introduction.

Restrict access with strong credentials

You should be implementing both strong credential policies and strict access permissions. Strict permissions ensure that users and applications are only able to access the data they need. Strong credential policies ensure that attackers are not able to abuse permissions granted to those users and applications.

Periodically audit your permissions and set password lifecycles. You want to make sure that all credentials in your system are actively being used. You also want to ensure that passwords are sufficiently difficult to guess and that users aren’t reusing passwords.

Secure end-user devices

Endpoints are one of the most vulnerable parts of your system, particularly if endpoints are user-controlled. For example, smartphones connected to your network as part of a bring your own device (BYOD) policy. These devices can be a liability because security teams typically don’t have full control over security measures, such as updates or encryption.

To prevent these devices from being abused, you should implement an endpoint protection solution. These solutions help you monitor and restrict traffic on your network perimeter and can help you restrict how data exits or enters your systems.

Data Protection with Cloudian HyperStore

Data protection in the cloud can be a challenging endeavor, especially when it comes to distributed and complex infrastructures like multicloud and hybrid clouds. If you are using more than one cloud vendor or multiple cloud services, you’re going to need to work harder to secure your data.

Data protection become much easier when you move data on-premises. Cloudian provides on-premise storage appliances that are easy to deploy and use, let you store Petabyte-scale data at low cost, and access it instantly. Cloudian supports high-speed backup and restore with parallel data transfer (18TB per hour writes with 16 nodes).

Cloudian HyperStore provides durability and availability for your data. You can use HyperStore as a device for fast and reliable data storage. HyperStore can backup and archive your data, providing you with highly available versions to restore in times of need.

In HyperStore, storage occurs within the firewall, you can configure geo boundaries for data access, and define policies for data sync between user devices. HyperStore gives you the power of cloud-like file sharing and scalability in an on-premise device.

Learn more about data protection with Cloudian.