Exploits & Vulnerabilities
Cloud Data Destruction: Is Your Old Data Still There?
We recently ran a poll on LinkedIn to get feedback on companies’ approaches to cloud data destruction. As of mid-August we had received 149 votes with the following results.
Save to Folio
We recently ran a poll on Linked In to get feedback on companies’ approaches to cloud data destruction. As of mid-August we had received 149 votes with the following results.
Over a fourth responded with “What’s that?” So let’s start with a brief explanation of cloud data destruction. In the cloud, your data is often moved to make the best use of resources. Cloud volumes are mobile. Snapshots are taken frequently, backups are made regularly, and information is shared across multiple data centers for cost savings and availability. The data might be moved by the data owner, or in cases of the public cloud, might be moved by the service provider to optimize the use of resources within their multi-tenant environment.
When data is moved, all data in the previous location should be destroyed. If any data remnants remain, this can create security issues and possibly allow unauthorized access to residual data. If companies move their data in a private cloud, they have access to the underlying infrastructure and more control over how they destroy data in the previous locations. But even in private clouds, the dynamic nature of new resource allocation can make it difficult to know exactly where your data is located at any particular moment.
With public clouds, companies have even less control. Service providers may move or replicate data for better resource allocation, redundancy, and accessibility. Service providers can often provide better cost savings to their customers due to economies of scale. But to optimize resources they might move data unbeknownst to the data owner.
So how do companies ensure their data is destroyed from previous storage locations? In the polling responses, 31% said their cloud provider handles cloud data destruction, 33% said they encrypt their data, and 10% said they demagnetize the disks. For those that turn to their cloud providers, companies should not assume that cloud data is adequately destroyed. It’s important to review the service provider contract and ensure that it includes information on how data is destroyed and that these methods meet the organization’s requirements. And in the case of residual data, who would be responsible if the information is accessed? Odds are this risk falls on the data owner, not the service provider.
For demagnetizing disks, this assumes that the data owner has access to the disks and can degauss, or erase, the magnetic storage media making previous data unrecoverable. This access is generally not available with public cloud environments. And this approach is not appropriate for all types of storage media.
This leaves encryption as the final option addressed in the poll. A third of those surveyed take this approach, slightly leading the poll responses. Encryption is applied to data stored in the cloud. It doesn’t help destroy data. But when data is encrypted, even if residual remnants are accessed in previous storage locations, the data is unreadable. Companies using encryption do not need to worry about service provider data destruction practices and this approach can be helpful in private cloud environments as well with computing resources expanding and becoming more dynamic. Encryption also solves other data access concerns, preventing unauthorized sources from reading and using cloud data.
Trend Micro recommends encryption as a protection against unsuccessful data destruction methods. It gives data access control to the data owner regardless of the type of cloud—private, public, or hybrid. With this piece of mind, companies can leverage the types of clouds that best meet their resource needs without worrying about data access issues. At this year’s VMworld, Trend Micro will be discussing our Trend Micro SecureCloud solution and how it works in virtual data centers and private, public, and hybrid clouds as well as how it helps address compliance concerns in these environments. Visit us at booth #1123.