CertMike Explains Securing Stored Data in the Cloud

Key Takeaways

Hi there, I'm Mike Chapel and in this CM Mike Explains video, we're going to talk about securing stored data in the cloud. Think about how much sensitive information we place in cloud storage. Everything from personal documents to entire enterprise databases. It's crucial that we make sure the data stays safe and only accessible to the right people. In this video, we're going to cover three key strategies to secure stored cloud data: encryption, access control, and crypto shredding. Whether you're brushing up for a certification exam or you just want to build a strong foundation in cloud security, these are essential techniques for you to understand. Let's get started with encryption. Encryption is like putting your data in a secure vault. It transforms readable data called plain text into unreadable gibberish using an encryption key. Only someone with the matching decryption key can reverse that process and access the original information. That means that even if a bad actor gets access to your cloud storage, they can't do much with your encrypted data unless they also get their hands on the decryption key. Most cloud services encrypt data at rest by default using strong standardized algorithms. That's great because it helps protect your information even if something goes wrong. For instance, if someone physically steals a storage device from a cloud data center, the data is still unreadable thanks to encryption. But encryption is only as good as the way that you manage your keys. In many cases, the cloud provider manages the keys for you. That does make things simpler for you as the customer, but it limits the amount of protection that you have. A malicious insider at the cloud provider could theoretically gain access to your data. A more secure approach is to control your own keys. This requires that you set up key management systems and get more involved in the day-to-day details of your cloud storage environments, but it provides you with added security, ensuring that nobody at the cloud provider is ever able to gain access to your data. Next, let's talk about access control. Even if your data is encrypted, it still does need to be accessed regularly by systems and users. And that's where access control comes in. Access control systems are the policies and mechanisms that determine who can access your cloud data and what actions they're allowed to perform. The first step in this process is authentication. Verifying a user or systems identity. At the most basic level, we use passwords to authenticate ourselves to systems. But when you're working with sensitive data, you want to require the use of multiffactor authentication to add another layer of protection. Once users are authenticated, authorization is the next step in that access control process. Authorization determines what each user is allowed to do. This might involve giving one user readonly access to one storage bucket while another user has full access to manage backups across all of your buckets. Role-based access control or arbback is the most commonly used access control model in cloud systems. In the Arbback model, users are grouped into roles like system administrator, developer, or accountant. Each role then has predefined permissions. An accountant might have permission to make entries in the accounting system that a developer isn't allowed to do, while the accountant wouldn't be allowed to modify code repositories like the software developer can. The use of ARVAC simplifies management and supports the principle of least privilege, which means giving users only the minimum access they need to do their job. Before we get into our final technique, I want to take a quick moment to invite you to visit my website at certmike.com. On that site, you'll find free study plans put together to help you earn your next certification. These plans pull together study guides, video lessons, and practice tests to keep you focused and organized. If you're enjoying this Mike Explains video, please hit the like button and subscribe to this channel. That helps others discover the content to make sure that you don't miss future videos. Now let's move on to our third technique, crypto shredding. Cryptoshredding is a powerful method for securely deleting cloud data. The idea is pretty simple. If your data is encrypted and you delete the decryption key, that data becomes unreadable permanently. Even though the actual files might still exist on storage systems or backups, they're no longer accessible without the decryption key. This technique is especially useful in cloud environments where your data might be replicated across multiple servers or regions. Instead of worrying about wiping every copy, you can focus on securely destroying the keys. Let's say that your company needs to delete a customer's personal data to comply with a privacy regulation. If that data was encrypted from the start, crypto shredding lets you retire it by deleting the associated keys. As long as no backups of the keys exist, the data then becomes useless. And one thing to keep in mind, key management plays a critical role here. If you have old backups that contain your decryption keys, the data isn't truly gone. But when you implement it correctly, crypto shredding is an efficient and effective way to securely dispose of sensitive data. Let's do a quick recap. Encryption protects your data by making it unreadable without the correct key. Access control ensures that only authorized users can get to your data. and crypto shredding gives you a secure, fast way to delete cloud data by rendering it unreadable through key destruction. These three techniques work together to give you a layered approach to cloud data security. If you found this video helpful, please give it a like and subscribe to the channel for more cyber security content. And be sure to check out certmike.com for free study plans and resources to help you on your certification journey. [Music]