What are the best practices for data protection in the cloud?

The EDM Council published the Cloud Data Management Capability (CDMC) framework. The framework describes an Information Sensitivity Classification process which identified a complete set of controls that may need to be applied to your data. Once the controls have been identified the framework goes on to identify requirements for automating the execution of the required controls. Automation leads to being able to execute data management at scale over an ever increasing demand by companies for bringing data under governance.

Understanding what data you want to move to the cloud and having defined metadata which includes how data is classified is a first step for ensuring data governance in the cloud best practices. Having defined metadata which includes classifications can ensure the right controls, policies, and procedures are established especially as more data gets moved to the cloud. Metadata also helps to define accountabilities to ensure integrity which will be needed for managing access controls and other governance policies.

Its key to work with the cloud provider to understand where the data will reside physically and the implications of cross-border movements. This helps assess the risks that data will be exposed to, the specific data management practices that need to be applied per jurisdiction and thus design appropriate policies. This also helps to assess if there are restrictions on data movement. All this can be codified in the catalog against the assets that are in the cloud so that regional requirements can be initiated when needed, but also to track and restrict unwanted activity, if it does occur. This is not necessarily an easy task but is needed to manage risk of breaches and non-compliance.

Encryption at a data store level should be a common practice. Transparent Data Encryption (TDE) is a common feature on most cloud PaaS data store services. For highly sensitive data you get additionally field level encrpyt data in addition to TDE. Field level encryption can be format preserving allowing use for training data science models without disclosing the data content. In addition to TDE and field level encyrption you can but access controls i most cloud data planes which can providexadditional protection for very sensitive data. All these controls come with complexity when you want to access and consume the data...

Many users of the cloud think data is automatically protected when files are uploaded. However, when a link is provided that link can be intercepted if it is sent through email, where anyone can access the documents or data if access controls aren't put in place. Access controls must be defined and created in the cloud solution being used. Access must also be managed, reviewed, and removed according to the data governance policies.

Educating users is one of the biggest challenges, but most critical. Users may be internal to your organization, or external. Having clearly defined policies in addition to ongoing communication and training is key. Security is everyone's responsibility but the data governance organization can help provide the needed support.

All the CDMC framework describes executing control of your data in the cloud, there's nothing you need about these controls to the cloud environment. The fact that the cloud environment is itself a controlled environment makes executing these controls easier. But almost no company has their data only in the cloud or a single cloud they still have data on premises. The requirements for automation apply in all of these environments.

Cataloging is key. This helps track what data is in the cloud, what is sensitive within it and thus implement appropriate data management, security and compliance activities. This can be automated for data migrated or generated in cloud. It is also important to establish ownership and accountability for data. The same rigor and governance that is applied to data on-prem is needed in cloud as well. But this is not all about risk mitigation. The ultimate purpose is to use the data while protecting it. So focusing on maintaining quality and integrity is equally important.