Data Security
Data is the asset
Think in lifecycle terms: create, store, use, share, archive, destroy. Control it with classification, inventory (including unknown or shadow data stores), ownership, and handling rules. Encryption applies in transit, at rest, and increasingly in use through confidential computing enclaves. The crux is key management: provider-managed keys, customer-managed keys (bring your own or hold your own), and external key stores or hardware modules. The more you hold the key, the more control and the more operational burden you accept.
Cloud-specific problems
Data dispersion and logical co-mingling with other tenants, residency and sovereignty obligations, default replication across regions, backup and snapshot copies, and orphaned data after deletion. Deleting a pointer, an object reference, or a virtual machine does not necessarily delete the underlying data. Understand retention windows and crypto-shredding, where destroying the key renders data unreadable.
Tooling
Data loss prevention, cloud access security brokers for sanctioned and unsanctioned SaaS visibility, tokenization and format-preserving encryption, database activity monitoring, and access analytics that show who actually touched the data.
Traps
- Encryption without control of the key is weaker protection than it appears.
- Deleting an object in a SaaS application may leave copies in version history, trash, or backups.
- Data classification is the customer's duty in every service model.
- The claim that a provider cannot access your data holds only if keys and access paths truly support it.
Rule of thumb
Ask three questions of any data store: who holds the key, who can be granted access, and where do the copies live?