GDPR, CLOUD AND THE SHARED RESPONSIBILITY MODEL

The GDPR (General Data Protection Regulation) provides organizations that process data through cloud services with some unique challenges and opportunities.

The GDPR aims primarily to give control back to citizens and residents over their personal data, and it will begin to take effect on 25 May 2018.

Before talking about the GDPR obligations, let us talk a little bit about the cloud shared responsibility model:

‍

‍

The cloud service provider is responsible for the physical protection (and data center locations) and over the infrastructure layers (beside the operating system in IaaS model).

The customer is the data owner, and as such, he is responsible for access permissions and auditing. On IaaS and PaaS models, the customer is also responsible for the application layer in terms of access controls, hardening and configuration, encryption, etc.

This model is important to understand, because the GDPR has specific requirements that the cloud service provider is not responsible for, and any organization storing/processing private data, needs to be aware of and prepare accordingly in-order to be compliant with the GDPR.

‍

Main GDPR requirements related to cloud services:

‍

• Know the location where cloud applications are processing or storing data.

Perform an inventory of all your organization cloud services and compare them with the cloud service provider’s official web sites, regarding compliance with the GDPR. For example:

Microsoft – https://goo.gl/v7YVMj

AWS – https://goo.gl/SGuVTY

Google – https://goo.gl/hqnnGR

IBM – https://goo.gl/pJA75Y

Oracle – https://goo.gl/43xu2E

Salesforce – https://goo.gl/vDcRT1

‍

Use discovery tools, to locate where sensitive (GDPR related personal data) is located on your cloud services. For example:

Microsoft Azure Data Catalog – https://goo.gl/qu7g4J

‍

• Protect personal data:

Use strong authentication (Multi-factor authentication). For example:

Microsoft – https://goo.gl/7oEHyt

AWS – https://goo.gl/4PjD9W

Google – https://goo.gl/KnzcN4

‍

Monitor security incidents. For example:

Microsoft – https://goo.gl/rPv2ju

AWS – https://goo.gl/46TXsX

‍

Encrypt data at rest. For example:

Microsoft:  https://goo.gl/BQSF9p

AWS – https://goo.gl/vkFBnj

Google – https://goo.gl/6QF9Gf

Oracle – https://goo.gl/ixNeQs

Salesforce – https://goo.gl/XTQvYA

‍

Control who has access to your data in the cloud. For example:

Microsoft – https://goo.gl/jTKfcU

Oracle – https://goo.gl/RGErBo

‍

• Data processing agreement (DPA):

Sign a data processing agreement with the cloud service providers, to make sure they properly protect personal data and they commit not to move data outside the EU. For example:

Microsoft – https://goo.gl/tJVQG1

AWS – https://goo.gl/b53Vui

Google – https://goo.gl/JzRqgA

Salesforce – https://goo.gl/yR94Aw

‍

Check the compliance of the cloud service provider against known security standards. For example:

Microsoft – https://goo.gl/qVNUwB

AWS – https://goo.gl/vCUjhP

Google – https://goo.gl/2463Sk

Salesforce – https://goo.gl/9y2ZJY

IBM – https://goo.gl/cL19qW

‍

Eyal Estrin is a Cloud Security Architect.

He is the owner of the blog Security 24/7.

He has more than 20 years of experience in the IT and information security field.

Follow him at @eyalestrin

‍