We are surrounded by data, whether in our personal or professional lives with digital elements that are constantly being captured about us. This leads to exponentially increasing volumes of data whether from Internet-connected devices, video, cell records, customer transactions, healthcare and government records.
Today, there is a growing awareness and sensitivity from end users, government agencies and lawmakers of how all of this data might be used and in the coming years this concern is only set to heighten.
Organizations leveraging cloud services to store this data may need to take a closer look at the lifespan of the data they collect and how it is expired and destroyed. Today’s organizations need to understand that cloud as a model causes data to multiply further. The dynamic nature of resource allocation and maximizing availability in a hybrid or public cloud means resources are replicated and backed up across multiple data centers. When an organization contacts the cloud provider to expire or expunge data they may only be severing their client connection to the data. Organizations often don’t allow for the fact that backup instances or traces of data may still linger and could be a source for unauthorized access.
1. Tag all sources of mission-critical data: It starts with strong preventative measures: If data is classified digitally to a scheme that is intuitive to your cloud provider and your organization it will be easier to track through its lifecycle and then expire and destroy.
2. Take time to assign entitlements and access rights: Ensure that access rights or entitlements for sensitive or mission-critical data are limited to only those who have a legitimate need for access.
3. Apply encryption based on context: When data is encrypted, it is only readable to those with access to the encryption keys. It is the most certain way to limit unauthorized access to data in the cloud. By encrypting organizations can be better assured of the confidentiality of their data and potentially be less concerned with their cloud providers’ data destruction methods.
4. Perform data wipes: Many Government and industry standards require data storage wipes to ensure that hardware is safe for reuse. There are different types of software and hardware that even allow for remote erasure. The benefit is to enable a provider or enterprise to repurpose the media for reuse.
5. Physically destroy data and media: In the cases of highly classified information organizations can use strong magnets to destroy data or even shred physical media. This ensures that the data on the destroyed media can never be recovered. Physical destruction methods are the last resort and only feasible in a private cloud environment.
By Evelyn de Souza
