Cloud data security solutions

Cloud data protection

The well-established shared responsibility model for cloud security says that you are responsible for securing your data in Infrastructure, Platform and Software-as a Service (IaaS, PaaS and SaaS) environments. It’s a multi-cloud world, and Thales can help achieve full cloud data security.

The CipherTrust data security platform, Luna General Purpose and payShield Payment HSMs, cloud based security services with Data Protection on Demand, Thales High Speed Encryption (HSE) network encryptors, SureDrop and Thales's SafeNet Trusted Access enables nearly any cloud environment to be a trusted and compliant environment by solving the critical challenges of data governance, control and ownership.

Understanding the problem

The shared responsibility model for cloud security exists because in spite of the convenience, cost-savings, and even centralisations of IT expertise in the cloud, data breaches in and from the cloud are real. But why do breaches in the cloud happen? The answers can be found in several, preventable ways:

• Human error can still occur, perhaps exacerbated by self-service and varying security controls across different IaaS/PaaS and SaaS providers. Multi-cloud means learning new policies and cloud and identity-security solutions.
• Vulnerabilities happen in software, hardware and firmware, whether on-premises or in the cloud. A breach of customer data from a cloud data store in 2019 was caused, in part, by a bug identified in 2015 and not patched in the cloud¹.
• Insiders include both cloud infrastructure administrators plus your administrators with elevated privileges in the cloud. In IaaS, OS root users have too much visibility, with admin credentials targeted and compromised – sometimes the same passwords used in the cloud as on-premises. And with certain types of encryption, privileged users can see data in the clear for all users.
• Even with encryption, there remains the risk of poor practices for encryption keys, which truly require enhanced control and separation between encrypted data in the cloud and the keys.

These factors were confirmed in analyst research: an IDC study found that 61% of cloud data breach victims indicated that the breach was the result of a cloud or cloud infrastructure related vulnerability or misconfiguration².

¹Krebs on Security, August 2019
²IDC, Market Analysis Perspective: Worldwide Data Security, 2019, doc #US44772819, September 2019

Thales helps you secure your cloud data

Cloud data protection can appear challenging at first, especially given the factors denoted above. Thales can help break security silos with a suite of integrated security solutions.

Centralised cloud authentication and access management

SafeNet Trusted Access ensures that only validated and authorised users can access sensitive data and apps in the cloud. Read about how we prevent data breaches and help organisations comply with regulations to secure access to cloud properties across IaaS, PaaS and SaaS.

Access comes in many forms

Address a broad range of use cases by selecting from a broad range of authentication methods. Select authenticators based on your specific risks, risk appetite and regulatory need. You can rely on hardware authenticators that are tamper-proof and clone-proof, manufactured in an environment in which the full development and manufacturing chain is tightly controlled. You also have the option of software authenticators to differentiate the types of users, applications and use cases to achieve differentiated risk management that you need for complex security needs.

Discover, protect and control

The CipherTrust data security platform enables you to discover sensitive data in the cloud, protect it with encryption and tokenisation, and control all encryption keys associated with data protection.

Go cloud-native with security

You can rearchitect your applications for the cloud while providing both data encryption and secure key management using CipherTrust Application Data Protection, a component of the data security platform. With C, C#, Java and REST bindings to Crypto Service Providers (CSPs) located where you deem appropriate, PaaS data can remain secure.

Ensure you can trust your apps and data by securing the keys

Thales Hardware Security Modules (HSMs) provide uncompromised trust across cloud, on-premises and hybrid environments. HSMs safeguard digital identities, applications and sensitive key materials that are used to protect important collaboration tools, document sharing and online transactions. Meet your business and compliance needs securely and efficiently, as Thales HSMs provide a high assurance, FIPS certified root of trust for any use case, any application, any industry, delivered as-a-service in the cloud or on-premises and across hybrid environments Leverage Thales HSMs - Thales Luna General Purpose HSMs or Thales Luna Cloud HSM services from Data Protection on Demand (DPoD) and payShield Payment HSMs to ensure security.

Secure data as it transits the cloud

Today’s network encryption devices must handle intensive encryption algorithms, operate across a diverse range of cloud architectures and connectivity and be future proof against emerging threats. With Thales High Speed Encryption (HSE) network encryptors, companies can secure data in motion across network traffic between data centres, headquarters to backup and disaster recovery sites, in the cloud or on-premises.

Secure file sharing without compromise

Store, share and sync all your files in the cloud, or on premises, securely with SureDrop®.