Data Residency (or Data Sovereignty) pertains to where data is being stored from a geographical standpoint. With cloud services, this can mean a location outside the country of origin. The concept of data residency infers that data storage is subject to the laws in the country within which it is held.

With GDPR now formally passed into law, StratoKey has released a comprehensive GDPR compliance guide. This guide focuses on how organisations can utlise StratoKey to meet GDPR requirements when using cloud and SaaS applications.

StratoKey has published a guide on Cloud Access Security Broker (CASB) features, functions and architectures. This guide is designed to dispel some of the myths about CASB vendors and covers the advantages and disadvantages of differing CASB offerings.

A CASB (Cloud Access Security Broker) is a gateway that sits between users and an end cloud application such as Salesforce, Office365 or any other cloud deployed application. The purpose of a CASB is to control the security of both users and data stored in the cloud. This is achieved by encrypting content before it reaches the cloud, monitoring user access and in some instances automated firewall-like rules to thwart attacks.

According to the Australian Attorney-General's Department website, a proposed Bill will require Government agencies and businesses subject to the Privacy Act 1988 (Privacy Act) to notify the national privacy regulator and affected individuals following a serious data breach.

The Health Insurance Portability and Accountability Act - or HIPAA for short - regulates the storage and processing of protected health information (PHI) which is designed to ensure the security of any personally identifiable information that healthcare organizations store on patients - both in hard copy and electronically (e-PHI).

Gartner coined the term Cloud Access Security Brokers (or CASB) a few years ago now, and placed it atop of their security technology trends of 2014. As defined by Gartner, CASB solutions are on-premises, or cloud-based security policy enforcement points, placed between consumers and cloud service providers that offer monitoring and control across multiple cloud services.

In the first section of this two part post on implementing cloud data protection, we looked at identifying an appropriate cloud data protection solution, encrypting application data and how to lock end applications to the cloud data protection gateway. In this second part, we are looking at moving to the next level of cloud protection, threat identification, countermeasures and mitigation.

With federal data breach notification laws now in effect across the US, and similar laws in place in most European countries, organizations who suffer a cyber-attack are legally required to report the breach, opening the door to negative publicity and a whole raft of associated costs.

It was disheartening to read that a Financial Services Regulator's guidelines around data sovereignty lead to the termination of a Salesforce deployment by a large bank. This mandate at least in part resulted in the bank abandoning their $10 million Salesforce investment. The reason this is a disheartening result is because there are cloud data protection solutions that can alleviate much of the security concern that exists with cloud applications.