Cloud Data Security
The lifecycle
CCSP organizes data security around the lifecycle: create, store, use, share, archive, destroy. Every control you propose should name the lifecycle stage it protects and the data state it addresses (at rest, in transit, in use).
Classification and discovery
You cannot protect what you cannot find. Data discovery and cataloging - including shadow data in object stores, snapshots, and analytics copies - precedes classification. Classification (public, internal, confidential, restricted) drives handling rules. The data owner sets classification and rules; the custodian applies them. In cloud contracts the customer generally remains the controller and data owner even when the provider stores the bits, a favorite exam distinction.
Protecting data
- Encryption: at rest (volume, object, database), in transit (TLS), and in use (confidential computing, secure enclaves).
- Key management: KMS, HSM, envelope encryption with a data key wrapped by a master key, and custody models (provider-managed, BYOK, HYOK). Whoever holds the key holds effective control.
- De-identification: masking (often format-preserving, sometimes reversible), tokenization (substitutes a token via a vault, not mathematically reversible), pseudonymization (reversible with additional data), anonymization (irreversible).
- Destruction: crypto-shredding destroys keys rather than rewriting media.
Worked example
You must share a customer dataset with an analytics vendor while retaining the ability to re-identify individuals later. Anonymization fails because it is irreversible. Tokenization with a vault you control preserves re-identification while the vendor never sees real values. If the vendor must compute on values without seeing them, consider confidential computing.
Traps: confusing tokenization with encryption; forgetting that snapshots and backups are copies of data that must be protected and eventually destroyed.