Showing posts from June, 2021

Data Security Lifecycle 2.0

The Cloud Security Alliance Guidance explains the Data Security Lifecycle which mentions the various phases data undergoes in the cloud. This lifecycle was adopted from a blog article on Securosis. Rich Mogull, Analyst & CEO, stated that he was not happy with his work since it seemed rushed and did not sufficiently address the cloud aspects. They have released the Data Security Lifecycle 2.0 and this blog post is an attempt to present it in simple terms. Before we delve into the nuances of the improved version of the life cycle, a sneak peek into the old one would help us appreciate the changes. The V1.0 is depicted below.  The lifecycle has a total of six phases - Create, Store, Use, Share, Archive, and Destroy. While the depiction in a circular step-by-step manner may seem that one phase follows the other, it is not so. Creating and storing may happen simultaneously and archive may not happen if the information is not required to be stored for long-term purposes. In essence, the

Crypto-Shredding is NOT panacea for The right to be forgotten (RTBF)

A recent survey by Trend Micro revealed alarming results. When asked for feedback on companies’ approaches to cloud data destruction, 25% of the population responded with “What’s that?” as the response. Another 31% said their cloud provider handles cloud data destruction, but they are not aware as to what happens in that case. Given the growth of cloud computing, it's imperative for security professionals to understand the details of data destruction in the cloud. This is required from a contractual point of view and a regulatory point of view. Crypto shredding is the concept of destroying data through the destruction of the cryptographic keys protecting the data. Without the decryption keys, the encrypted data is unusable — like a safe without the combination. From a cloud perspective, there are multiple tenants that a cloud provider serves. From a cloud customer perspective, the data is stored in physical locations where they cannot visit, let alone perform any data destructions