How to Secure Sensitive Data in Cloud Environments

The outsourced nature of the cloud and the inherent loss of control that goes along with that means that sensitive data must be carefully monitored to ensure it is always protected. But how do you monitor a database server when the underlying hardware moves every day or even over the course of the day—often without your knowledge? To further complicate things, how do you ensure that your cloud computing vendor's database administrators and system administrators aren't abusing their privileges by inappropriately copying or viewing confidential records?

These are just some of the obstacles that an enterprise must overcome when deploying a secure database platform in a cloud computing environment. These obstacles alone may prevent some organizations from moving from their on-premises approach. What follows are three of the most critical architectural issues you'll need to resolve as you transfer applications with sensitive data to the more flexible computing model of the cloud.

Issue No. 1: Monitoring a constantly changing environment

Virtualization and cloud computing lend greater flexibility and efficiency by giving you the ability to move servers and add or remove resources as needed in order to maximize the use of your systems and reduce expense. This often means that the database servers housing your sensitive data are constantly being provisioned and deprovisioned, with each of these instances representing a potential target for hackers.

The dynamic nature of a cloud infrastructure makes monitoring data access much more difficult and, if the information in those applications is subject to regulations such as the Payment Card Industry Data Security Standard (PCI DSS) or the Health Insurance Portability and Accountability Act (HIPAA), you need to be able to demonstrate that it’s secure.

When considering solutions to monitor activity on these dynamic database servers, the key is to find a methodology that is easily deployed on new database servers without management involvement. That almost certainly requires a distributed model where each instance in the cloud has a sensor or agent running locally. This software must have the ability to be provisioned automatically along with the database software—without requiring intrusive system management.

In a multitenancy environment, it will not always be possible to reboot whenever you need to install, upgrade or update the agents and the cloud vendor may put limitations on installation of software requiring certain privileges. The right architecture will allow you to see exactly where your databases are hosted at any point in time. It will allow you to centrally log all activity and flag suspicious events across all servers wherever they reside.

Next: Working in a WAN >>

>>> More Cloud Computing Articles          >>> More By Slavik Markovich