Domain 11 - Data Security & Encryption

Question 1

What are the three major categories of data security controls?

Answer 1

1. Controlling what data goes into the cloud - driven by policies.
2. Protecting and managing data in the cloud - encryption, access control, architecture, monitor/log
3. Enforcing information lifecycle management security - data location/residency, compliance, backup and BCP.

Question 2

What are the cloud data storage types?

Answer 2

1. Object store - access through APIs (e.g. S3)
2. Volume store - virtual hard drive (e.g. EBS)
3. Database -RDBMS, No SQL
4. Application/Platform -e.g. CDN

Question 3

What tools are available to control what data goes into cloud?

Answer 3

1. Governance through policies which establish which data goes to cloud and which does not
2. Use of DLP tools, DAM, CASB, URL Filtering, Proxies
3. Secure data transfers to the cloud - e.g. using TLS connections

DLP tools are challenged by encrypted connections.

Question 4

How do you use access controls to secure data in the cloud?

Answer 4

1. Management plane: secure user access
2. Controls for sharing data with public and partners
3. Application level controls

Fine grained access controls (entitlement matrix)
Frequently validate that controls meet your requirements

Question 5

What are various ways of protecting data at rest?

Answer 5

1. Encryption
2. Tokenization
3. Masking
4. Bit Splitting
5. Data Dispersion
6. Randomizing/Scrambling

Question 6

What are IaaS Encryption Options?

Answer 6

1. Volume encryption - keys controlled either by the instance or externally
2. Object/File Storage - a) client side encryption b) server-side or c) encryption operations done by a proxy.

Question 7

What are PaaS Encryption Options?

Answer 7

1. Application level encryption
2. DB level - TDE or field level
3. Other: e.g. leveraging underlying IaaS encryption options.

Question 8

What are SaaS encryption options?

Answer 8

1. Provider managed
2. Proxy - data passes through an encryption proxy (e.g. CASB) before sent to the SaaS.

Question 9

What are key management options available to customers?

Answer 9

1. Use on-prem HSM to manage keys and provide to the cloud via secure channel as needed
2. Virtual HSMs based in the cloud
3. Cloud provider service (for key management -e.g. KMS)
4. Hybrid: Use on-prem HSM, but deliver application specific keys to a virtual appliance in the cloud.

Question 10

What is an example of leveraging data architectures to improve security?

Answer 10

Run application components in different virtual networks (e.g. VPCs)
Bridge them by using the provider’s network -e.g. message queue (e.g. SQS)
For an attacker to succeed, they’d have to breach both the customer and the providers virtual networks.