How to Secure Sensitive Data in Cloud Environments

Issue No. 3: Who has privileged access to your data?

One of the most difficult elements to monitor in any database implementation is the activity of privileged users. DBAs and system administrators have many options at their disposal to access and copy sensitive information, often in undetected ways (or in ways that can be easily covered up). In cloud computing environments, there are unknown personnel at unknown sites with these access privileges. Add to this the fact that you cannot possibly conduct the same level of background checks on third parties as you do for your own staff, and it's easy to see why protecting against inside threats can be difficult.

One way to resolve this is through separation of duties, ensuring that the activities of privileged third parties are monitored by your own staff, and that the pieces of the solution on the cloud side of the network cannot be defeated without raising alerts. You'll also need the ability to closely monitor individual data assets (for example, a credit card table), regardless of the method used to access it.

Sophisticated users with privileges can create new views, insert stored procedures into a database or generate triggers that compromise information without the SQL command looking suspicious. Look for a system that knows when the data is being accessed in violation of the policy, without relying solely on query analytics.

Look carefully before you leap

The complexity of monitoring databases in a cloud architecture may lead some to conclude that it is simply not worth changing from dedicated systems or perhaps just not yet. However, most enterprises will likely determine that it is simply a matter of time before they deploy applications with sensitive data on one of these models. Leading organizations have already begun to do so, and the tools are now catching up with the customer requirements driven by the issues raised here.

If your business would benefit from deploying databases in the cloud, security should not prevent you from moving forward. Just make sure your security methodologies adequately address these special cases.

Slavik Markovich is co-founder and CTO of Sentrigo. Slavik has over 13 years of experience in infrastructure, security and software development. Previously, Slavik was vice president of R&D and chief architect at DB@net, a leading IT architecture consultancy, and led projects for clients such as Orange, Comverse, Actimize and Oracle. In addition, Slavik held positions at several IT consulting companies. Slavik is a renowned authority on Oracle and Java/JavaEE technologies, and has contributed to open-source projects such as Spring Framework Toplink integration (later incorporated by Oracle). He is a regular speaker at industry conferences. He holds a BS degree in Computer Science. He can be reached at info@sentrigo.com.