Sharing Relational Data In The Cloud

Sharing relational data in the cloud is by far the easiest activity to secure. Why? Because relational databases are architected to share data. They form a central repository that is designed to serve data when requested by authorized parties. And they provide the infrastructure to support multiple applications, application clusters, and mirrored data sets. SaaS, PaaS, or IaaS -- it does not matter because the general model is consistent. (And remember, I am following the Cloud Security Alliance guidance for the data security life cycle and applying those principles to databases).

Because databases are designed to share data, most of the controls you want to use are built in: access control gate user access; authorization mapping with groups and roles, along with views, compartmentalize data. Labeling further limits data accessibility. Masking obfuscates information presented to users you don't fully trust. Encryption of network traffic keeps data private. All of these are features you are already familiar with and part of the database. These controls are extended by the applications that access the data, including application-layer encryption, multiple database repositories, or schemas, to divide content, and application logic to enhance fined grained control. It's really nothing different than what you need to do in your current environment.

There are only a couple of new threats we are worried about that are new to the cloud environment: how you share information through the application, and sharing information through the infrastructure.

In the first scenario, it's important to remember your data is being stored in a multi-tenant environment. There have been several documented cases where access controls and session management features have failed, exposing user accounts arbitrarily to new users (Facebook, for example). Also remember that your cloud provider has administrators who have access to the infrastructure for problem solving and general maintenance of the systems. It's possible to leverage those credentials to view your data. It's wise to use your own external access control systems -- or those embedded within the database -- to avoid any cascade of failure. Two-factor authentication -- using tokens or certificates -- helps address this issue as well.

If sharing data means more that just opening your databases to queries, such as providing archives or mirroring database servers, you'll need to verify the means of conveyance is secure. How they move and store data behind the scenes is most likely not the same as how you do it in-house, so find out the details. For example, if your vendor is providing data mirroring, how is that performed? You'll need to speak with them to verify the security controls because the data is moved and stored. Or, if you are exporting and reimporting archives at different locations, ensure that the archives are encrypted prior to being written to storage. In many ways this is similar to data usage, which was discussed in the last post.

Finally, the guidance recommends activity monitoring and data loss prevention technologies for general data security. I recommend database activity monitoring because it is specifically designed for monitoring database queries and auditing database transactions. It's effective at identifying malicious queries or hijacked credentials. What I don't recommend for databases is data loss prevention; while mentioned in the guidance, this technology is much better-suited for control of the endpoint and filtering network traffic looking for sensitive information. That's great for a generic filter, but with databases we already know we have sensitive information -- we want to verify how data is being shared, and that requires analysis of the individual statements.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.

Quick reference: Part 1 Intro, Part 2 Cloud Database Models, Part 3 Data Security Lifecycle, Part 4 Create, Part 5 Store, Part 6 Usage.