Cloud Data Lifecycle

---

• Data in the cloud has many of the same security requirements as data on-prem
  • but implementation particulars will change in each stage

Data Lifecycle

1. Create
2. Store
3. Use
4. Share
5. Archive
6. Destroy

Create

• Data can be created in various places
  • cloud, on-prem, remote location, other cloud
• threats to data in create phase vary based on where it is created and how it is transferred to cloud
  • Data created remotely
    • data created by the user should be encrypted before uploading to the cloud
    • select strong encryption
    • practice good key management
    • ensure network traffic is secure with TLS
  • Data created in the cloud
    • encrypt upon creation
    • practice good key management

Store

• store phase occurs immediately after creation
• critical security controls include:
  • provisioning access rights to storage locations
  • ensure storage location is properly secured
  • protect data with encryption

Use

• some cloud apps use a web interface, others an API
• must understand specific uses and data flows to secure data
  • each data transfer needs to be secured
  • each location needs to be secured
  • platforms that connect to the cloud need to be secured
  • security training for users
  • rights and role management
  • use logging and audit trails
• cloud providers need to secure their environments as well

Share

• similar security controls as in prior phases
  • encrypted files and communication
  • information rights management
  • tagging and permission models
• create sharing restrictions based on jurisdiction and legal requirements
  • export controls
  • import controls
• implement egress monitoring

Export and Import Restrictions

• Export restrictions
  • International Traffic in Arms Regulations (ITAR)
    • US State Department prohibitions on defense-related exports
    • can include cryptography systems
  • Export Administration Regulations (EAR)
    • US Department of Commerce prohibitions on dual-use items
      • technologies that could be used for both commercial and military purposes
• Import restrictions
  • Cryptography
    • many countries have restrictions on importing cryptosystems or material that has been encrypted
  • The Wassenaar Arrangement
    • group of 41 member countries have agreed to mutually inform each other about conventional military shipments to nonmember countries
    • not a treaty, so not legally binding
    • may require organization to notify gov to stay in compliance

Archive

• long-term storage phase
• use encryption
  • consider the long-term resistance of chosen cryptography
  • key management
• physical security of data in long-term cloud storage is important
• when choosing storage location, consider:
  • location
    • where is the data being stored by the cloud provider?
      • are multiple cloud providers involved?
    • what environmental factors will pose risks in that location?
    • what jurisdictional aspects might bear consideration?
      • local, national
    • will it be feasible to access data during contingency operations
      • e.g., natural disasters
    • is it far enough away to be safe from events that impact the production environment?
    • is it replicated in multiple locations or in multiple clouds?
      • does the replication create additional concerns
  • format
    • is the data being stored on some physical medium in an offline mode or is it online and replicated?
    • is the media highly portable and in need of additional security controls against theft?
    • will the medium be affected by environmental factors?
    • how long do you expect to retain this data?
    • Will it be in a format still accessible by production hardware when you need it?
• Staffing
  • consider the staffing of the cloud provider
  • some types of regulated data may require that foreign nationals not have access to data
  • ensure cloud provider is performing personnel security checks
    • background checks
    • ongoing monitoring
• Procedure
  • how is data recovered when needed?
  • how is data ported to the archive on a regular basis?
  • how often are you doing full backups?
• Archive phase activities are largely driven by whether you are doing backups in the cloud

Destroy

• crypto-shredding is the only feasible means of secure deletion in the cloud
• destroy encryption keys at end of data lifecycle
• some cloud providers manage the entire data lifecycle
  • consider data requirements during contracts