何謂資料安全

For security in the cloud, data security’s role encompasses securing an organization's data at rest in the cloud, as well as data that traverses the organization’s networks. Data security refers to the best practices and technologies that aim to achieve data confidentiality and data integrity. Several technologies are deployed to ensure data confidentiality and data integrity, such as encryption, that allows only authorized parties to access data, and data signatures, that ensures tamper-free data from trusted third parties. Another notable technology is tunneling, which creates a secure connection between two points using encapsulation and encryption to thwart any listening intermediary parties.

For data at rest within the cloud, organizations rely on strong storage security typically built into cloud providers. Leading cloud services providers, Google, Dropbox, Amazon, Microsoft, all provide dedicated data storage and so cloud consumers, in these cases, there is no need to worry about implementing security storage controls. But when providing cloud services, companies will need to understand and implement strong storage controls to ensure the security of their users’ data. As well, protected back-ups are another important concern. Back-ups are duplicates of live data for the express purpose of quickly recovering systems from disasters, whether that be from cyber-attack, or technical difficulty. These back-ups will contain highly valuable and sensitive working data and should be protected like any live data.

The following data security control mechanisms are commonly used cooperatively to bolster security, though for specific cases one or none may be deployed. Controls like encryption are extremely common, becoming the de facto security measures deployed over the internet. Other controls can provide enhanced layers of security that trade off protection for performance, for example, tunneling can obscure source and destination IP addresses and secure connections between two endpoints, but there is additional network overhead that can degrade performance.

Data Encryption

Initial data security measures bring to mind data encryption. Encryption is the technique of locking data so that it is unreadable to anyone who does not have the decryption key. There are several methods for encrypting data, like obfuscation which uses a defined pattern to cover sensitive data. Substitution, shuffling, and patterned removal are all obfuscation techniques, yet however complex, these methods can still be reversed engineered. Ciphers are preferred encryption methods using advanced algorithms to turn plaintext into ciphertext. Data must be encrypted at two levels, stored data, and data in transit.

Encryption at rest encompasses data stored on any sized storage media (USBs, DVDs, hard drives, etc.) or on storage in the cloud, since the cloud is essentially banks of data servers. Encrypting data at rest can be implemented at multiple levels: storage, file systems, operation systems, databases, or the file and folder level. Storage encryption can be done using self-encrypting hard drives. Storage controller software can encrypt file systems, to aid in access control. More granularly encryption happens at the levels of files and folders, and databases. Proprietary operating systems, such as Microsoft and Apple, provide built-in encryption software for their file systems, that encrypt files, groups of files, and folders for protection. Even more granular, databases can encrypt singular rows and columns within their data schemas, flagging them as confidential and preventing data exposure, examples include banks accounts, social security numbers, personally identifiable information, etc.

Public Key Infrastructure (PKI)

Public key infrastructure (PKI) creates a hierarchical bank of trusted security certificates that are issued to various entities, users, applications, or other computing devices. These certificates are used to encrypt and decrypt data, as well as provide digital identification to sign and verify the entity's integrity.

PKI entails coordinating certificate management, key management, digital signatures, and secrets management. Certificate management encompasses a company’s processes around issuing, renewing, storing, authenticating, and when needed, revoking digital certificates. A key management system (KMS) is software that helps to securely document each key for safe management. Digital signatures are used in PKI to create nonrepudiation—that is undeniable signature validity and authentication. Secrets in the cloud, including anything akin to API keys, passcodes, access credentials, etc., must be managed, fortunately major cloud vendors offer their own secrets management systems.

Data Encryption Protocols

Several encryption protocols exist that secure and authenticate data. IPSec and SSL/TLS are two backbone security protocols used in the cloud. Internet Protocol Security (IPSec) is an application agnostic way of securing IP traffic through encryption and digital signatures. IPSec is flexible and can be implemented using several methods (PKI certificates, symmetric keys, etc.) because it secures communications between hosts. Incidentally, it can also be used as an encryption or tunneling protocol. Secure Socket Layer (SSL), and its successor Transport Layer Security (TLS), are application specific, and are used to secure communications between configured applications.

Tunneling Protocols

Tunneling is a technique used to secure communications and obfuscate its routing between devices so that over public networks intermediary devices cannot read or determine source and destination information. In effect, tunneling creates an undercover tunnel between two points over public networks, allowing secure data sharing as if they were connected locally. Tunneling achieves this effect through encryption and encapsulation. Encryption secures the payload data and its destination, which is then encapsulated in another “envelope” with an address to a proxy server. The message is decapsulated at the next server and then sent on to the final destination. If packages are intercepted, then the final address cannot be read. In practice, tunneling can be set up to bounce traffic around several servers and completely erase any traces of routing.

Tunneling is not without its downsides though, the encapsulating and decapsulating method consumes more network bandwidth resulting in lower performance.

Ciphers

Ciphers are the encryption algorithms used in encryption protocols. They can be symmetric, using the same key, or asymmetric, using paired public and private keys, and can be geared towards block ciphering or stream ciphering. As the name suggests, block ciphers encrypt chunks of data of known size. While stream ciphers can convert plaintext into ciphertext as a stream of unknown length, and is faster than block ciphers when the data length is unknown. Block ciphers still have use though, for example, Advanced Encryption Standard (AES) is the government standard encryption block cipher. Block ciphers can work within other security frameworks to build stream ciphers creating further layers of security.

Storage Security

Cloud storage security, from the point of view of the cloud consumer, is an included feature, and to them these controls are out of their realm of responsibility. But the fact remains, storage security is more than a technology but overlaps contractual agreements and regulatory requirements too.

To help comply with these obligations, and safely partition and secure cloud resources, companies can use granular storage controls, thereby limiting access to storage area networks (SAN) by using logical unit numbers (LUN) masking to segment them, and then use zoning to subsequently limit access to those LUNs. Further using technologies, like digital rights management (DRM) and information rights management (IRM), can limit usage of digital assets and bandwidth of enterprise systems for specific information.

Protected Backups

Protected backups are a consideration of disaster recovery. Backups are copies of live system data, actively maintained in the case that system disaster calls for a rollback, or restoration. These copies should be afforded the same data security considerations as their live counterparts, encrypted, password protected, and if possible key physically sealed for authorized access only.

Data security software aims to keep data secure using various measures, like encryption and sophisticated access management.

• Secure Sensitive Data — The first data threat to mind is usually hackers. Cloud storage, when properly secure, is just as effective, if not more scalable than on-premise security. Good data security tools can create the encryption and initial layers of protection against malicious actors.
• Prevent Data Loss — Data security also lends support to the fidelity of data, though more data protection tends to manage more of these roles.
• Ensure Data Compliance — Lastly, sophisticated data security will make data compliance a monitoring priority. Special industries, like finances, or healthcare, already have their own specific stringent compliance regulations.

Encryption, public key infrastructure, and data storage security are some of the common foundational data security technologies that build even more specialized data security tools and other related software packages. Some of these packages include:

• General data security software provides access controls to encrypted and secured data, with tools for performing security tests.
• Mobile data security software extends data security functionality for mobile circumstances.
• Identity management software helps to track users, their permissions, and other vital information.
• Encryption tools work with public key infrastructures to conceal and secure data from unauthorized entities.
• Cloud security software packages are designed to integrate and simplify data security in the cloud.