Best Practices for Cloud Data Protection and Key Management

Abstract

Cloud has fundamentally transformed digital and cybersecurity landscape. Enterprises continue to move their data and applications to the cloud so they can utilize and pay for only needed resources, thereby avoiding large upfront investment. Some also believe that in addition to its promise of demand elasticity, the cloud also offers security of data. We analyze this security aspect in this paper. Protection of data stored in the cloud is intertwined with the generation, management and lifecycle of cryptographic keys that encrypt this data. We list various options available for protection of data, along with their relative strengths and weaknesses. These options are explained with examples from three main cloud service providers; Google, Azure and AWS. We highlight the importance of separation of duty and how cryptographic keys can and should be managed by trusted third parties. This not only increases security but can also facilitate regulatory compliance. While describing security best practices for protecting sensitive data in the public cloud, the paper also explains concepts such as BYOK, HYOK, key brokering and Root of Trust. It describes the level of data protection that can be achieved by using cloud native encryption and key management service, and how security can be enhanced by allowing customers to take direct responsibility for and control over their keys.