CCSP · Domain 2
Cloud Data Security
About 20% of the exam
The cloud data lifecycle
- Create
- Store
- Use
- Share
- Archive
- Destroy
- Create
- classify, label, encrypt at birth
- Store
- encrypt at rest, access controls, backups
- Use
- DLP, IRM, logging, least privilege
- Share
- riskiest phase, leaves your boundary
- Archive
- long retention, format preservation, key custody
- Destroy
- crypto-shredding, verified, documented
Classify in Create so every later phase knows how hard to protect it; the phases are not always sequential
Storage by service model
- IaaS volume
- block storage attached to VMs
- IaaS object
- flat namespace, metadata, API access
- PaaS structured
- databases, tables, queries
- PaaS unstructured
- big data, files, blobs
- SaaS
- content and file storage, information management
- Ephemeral
- dies with the instance
- Long-term
- cold tiers, slow, cheap, immutable
- CDN
- cached copies at the edge
Discovery and classification
- Discover by metadata, labels, content analysis
- Content-aware tools use patterns and learning
- Classify by sensitivity, value, regulation
- Labels must persist through copy and export
- Owner classifies, custodian protects
- False negatives leave data under-protected
- Structured data: schema; unstructured: scan
- Data mapping shows where it lives and flows
Where encryption sits
- In transit
- TLS 1.2 or 1.3, VPN, mTLS
- At rest, provider
- storage or volume encryption
- At rest, database
- transparent, column, application level
- Client-side
- encrypted before upload, provider blind
- In use
- confidential computing, homomorphic
- Application-level
- portable across providers
- Object storage
- server-side with customer keys
Provider cannot read what you encrypted before it arrived, even under legal compulsion
Key management
- Provider-managed
- easiest, provider can access
- Customer-managed (CMK)
- customer controls policy and rotation
- BYOK
- customer generates, imports to provider KMS
- HYOK
- keys never leave customer premises
- HSM
- tamper-resistant hardware, FIPS 140
- Envelope encryption
- KEK wraps many DEKs
- Rotation
- keep old keys to decrypt history
- Escrow
- trusted third party holds recovery copy
Keys and data stored apart, under separate control; the key owner is the data owner
Obfuscation techniques
Tokenization
- Random token replaces the value
- No mathematical link to the original
- Vault maps token back to data
- Shrinks PCI DSS scope
- Format-preserving keeps field shape
Masking
- Static: masked copy for test environments
- Dynamic: masked on the fly by role
- Substitution, shuffling, nulling, truncation
- Referential integrity is the hard part
- Realistic but fictitious values
Anonymization
- Remove direct and indirect identifiers
- Pseudonymization is reversible, still personal data
- K-anonymity hides in a crowd
- Differential privacy adds calibrated noise
- Epsilon trades utility against privacy
Data loss prevention
- Discover, monitor, enforce: three components
- Data at rest, in motion, in use
- Policies built on classification labels
- Block, quarantine, encrypt, alert, log
- CASB extends DLP into SaaS
- Encryption blinds inline DLP inspection
- Tune to cut false positives
IRM and DRM
- Protection travels with the file
- Rights: view, print, copy, forward, expire
- Persistent, dynamic, revocable after sharing
- Needs agent or compatible viewer
- Ties to identity and access management
- Auditing of every open and attempt
- Consumer DRM protects media; IRM protects documents
Retention, deletion, archiving
- Retention policy sets period, format, location
- Longest applicable regulation wins
- Legal hold suspends deletion
- Overwriting and degaussing are unavailable in cloud
- Crypto-shredding: destroy the key, data is gone
- Archive: readable formats, keys kept alive
- Deletion certificates from the provider
You cannot physically destroy a disk you do not own; cryptographic erasure is the cloud answer
Data events and auditability
- Log who, what, when, where, how
- Storage access logs, API audit trails
- Correlate identity with data events
- Centralize into SIEM, protect log integrity
- Chain of custody for evidence logs
- Retention of logs is regulated too
- Standardize timestamps on UTC
Location and sovereignty
- Data residency
- where data physically sits
- Data sovereignty
- laws of the storing country apply
- Data localization
- law forces data to stay home
- Replication risk
- copies land in new jurisdictions
- Region controls
- pin storage to approved regions
- Provider access
- subpoenas reach provider-held keys
Cross-region replication is a compliance decision before it is an availability decision
Threats to cloud data
- Public buckets from misconfigured ACLs
- Tenant leakage in shared databases
- Deduplication side channels reveal content
- Data remanence on reused storage
- Deterministic encryption leaks equal values
- Keys logged in application output
- Snapshot and backup copies forgotten
- Insider at provider with key access
Rapid recall: protection choices
- Provider must never read
- client-side, customer keys
- Analytics on encrypted
- homomorphic or searchable encryption
- Card numbers, keep format
- tokenization or FPE
- Test data
- static masking
- Research release
- k-anonymity, differential privacy
- Cannot be altered
- immutable WORM object storage
- SSD deletion
- cryptographic erasure
- Protect after sharing
- IRM, rights travel with the file
Reference strip: lifecycle, storage, crypto, controls
Lifecycle
- Create: classify and label
- Store: encrypt, control, back up
- Use: DLP, IRM, monitor
- Share: the riskiest phase
- Archive then destroy by policy
Storage types
- Block, object, file, ephemeral
- Hot, cool, cold tiers
- Databases and big data in PaaS
- Content storage in SaaS
Key words
- KMS, HSM, KEK, DEK
- BYOK imports, HYOK holds
- Rotation, versioning, escrow
- FIPS 140 validated modules
Obfuscation
- Tokenization, no math link
- Masking, static or dynamic
- Pseudonymous is still personal
- Differential privacy, epsilon budget
Controls
- DLP: discover, monitor, enforce
- IRM: rights travel with file
- CASB for SaaS visibility
- Immutable storage, legal hold
- Crypto-shredding to destroy
Quick exam traps
- Trap: Pseudonymized data is no longer personal data
- Trap: Provider-managed encryption stops the provider reading your data
- Trap: Tokens can be reversed mathematically like ciphertext
- Trap: Degaussing is the recommended way to destroy cloud data
- Trap: Rotating a key means the old key can be deleted immediately
- Trap: Data residency and data sovereignty mean the same thing
- Trap: Store is the riskiest phase of the lifecycle
- Trap: Object storage offers the lowest latency for databases
cybercertprep.com · original revision sheet written from the public body of knowledge