8 results ·
● Live web index
listicle
P
paloaltonetworks.com
article
https://www.paloaltonetworks.com/cyberpedia/data-security-best-practices
To secure sensitive cloud data, use encryption, enforce access control policies, isolate workloads, and monitor for misuse. It’s also important to limit exposure in non-production environments and integrate security into your architecture from the start. [...] Classification should influence how data is stored, encrypted, shared, and deleted. And it's not about compliance labels. It's about operational control.
Example:
An organization classifies customer financial data as “restricted.” As a result, data loss prevention (DLP) rules block users from emailing it externally, and cloud storage systems reject uploads to non-approved destinations. These controls activate based on the label—not just the file type. [...] Example:
Securely overwriting decommissioned disk sectors or wiping cloud snapshots ensures that data isn't recoverable later. It's one of the few ways to guarantee that sensitive information stays gone.
## 8. Harden systems to prevent indirect data compromise
M
microsoft.com
article
https://www.microsoft.com/en-us/security/blog/2023/07/05/11-best-practices-fo…
Ensure that your employees are aware of the security risks associated with storing data in cloud services and are trained on best practices for securing data. This includes regular security awareness training and policies for reporting suspicious activity.
## 11. Implement principles of Zero Trust
Zero Trust is a security strategy. It is not a product or a service, but an approach in designing and implementing the following set of security principles: [...] Choosing a reputable cloud service provider is the first step toward securing data. The provider should offer secure data storage, encryption, and access controls. Look for providers that are compliant with relevant security standards and regulations, such as ISO 27001, HIPAA, and PCI DSS. Microsoft Cloud has several certifications making it a trusted choice for customers. For an exhaustive list of the compliance offerings, refer to compliance offerings for Microsoft 365, Azure, and other [...] ## Topics
In today’s digital age, cloud computing has become an essential part of businesses, enabling them to store and access their data from anywhere. However, with convenience comes the risk of data breaches and cyberattacks. Therefore, it is crucial to implement best practices to secure data in cloud services.
## 1. Choose a reliable cloud service provider
A
aikido.dev
article
https://www.aikido.dev/blog/cloud-security-best-practices
Whether in storage or in transit, you should encrypt your cloud data. At rest, use strong, modern encryption algorithms like AES-256 or TDE (Transparent Data Encryption). This ensures that even if an attacker gains access to the underlying storage, the data remains unreadable without the necessary encryption keys. [...] Encrypt all storage volumes, databases, and object storage (e.g., AWS S3 SSE, Azure Storage Service Encryption, GCP CMEK).
Enforce TLS 1.2+ for all API endpoints and inter-service traffic.
Implement mTLS for internal microservices to prevent impersonation.
Centralize key handling with a managed KMS (AWS KMS, Azure Key Vault, GCP KMS, HashiCorp Vault).
Automate key rotation and monitor for unauthorized key usage. [...] Cloud data encryption hinges on a strong Key Management System (KMS). Your KMS should be a secure, centralized service for generating, storing, managing, and rotating encryption keys.
Best practices to adopt:
W
wiz.io
article
https://www.wiz.io/academy/data-security/data-security-best-practices
Data security is the practice of safeguarding sensitive data and intellectual property from unauthorized access, tampering, and breaches—across storage, transit, and processing. In modern environments, that work happens almost entirely in the cloud, where data sprawls across providers, regions, and third-party services without a single perimeter to defend. [...] Encryption renders data unreadable to anyone without the correct keys, whether an external attacker or an insider with unauthorized access. This protection applies in two contexts:
At rest: Data stored in databases, object storage, or file systems. Use AES-256 or equivalent algorithms.
In transit: Data moving between services or to end users. Enforce TLS 1.2 or higher for all connections. [...] Misconfigurations cause more data breaches than sophisticated attacks. A single publicly accessible storage bucket, an overly permissive IAM policy, or an unauthenticated database endpoint can expose sensitive data without any attacker action required.
Regularly scan for misconfigured storage and resources like public access controls, weak encryption settings, and exposed services.
C
cloudsecurityalliance.org
article
https://cloudsecurityalliance.org/blog/2024/10/25/unpacking-the-cloud-securit…
The cloud storage document briefly covers the commonly available types of cloud storage: file/folder (smb/nfs/etc), object (like AWS Simple Storage Service [S3]), and block (mostly used by compute resources or other services provided by the CSP). A common theme is encryption and access control. The document mentions both encryption in-transit and at-rest, with recommendations for TLS 1.2 or higher on data in-transit and using a KMS for data at-rest. And again, the document highlights access [...] Amazon Web Services Foundations: Ensure that S3 Buckets are configured with 'Block public access (bucket settings)').
For additional Azure and Google Cloud Platform examples with regards to data encryption and security, see the recommendations below:
Microsoft Azure Foundations: Ensure Storage for Critical Data are Encrypted with Customer Managed Keys).
Google Cloud Platform Foundations: Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible). [...] Considering this is data storage, an extra layer of security with data access is also recommended: some form of data loss prevention (DLP). DLP systems are often used in on-premises data centers. DLP systems are commonly used in healthcare, even though they’re not necessarily required for compliance with the Health Insurance Portability and Accountability Act (HIPAA). Other industries with heavy use of personal health information (PHI) and personally identifiable information (PII) also use DLP
T
tierpoint.com
article
https://www.tierpoint.com/blog/cybersecurity/cloud-storage-security
Cloud storage security includes technologies and practices businesses use to protect their data in cloud storage solutions. This can consist of safeguards against theft, deletion, unauthorized access, or file corruption.
## Why is it So Important? [...] Data should be encrypted at rest and in transit, which means it should be scrambled when moving between points, as well as when it is in cloud storage so that it cannot be read without a decryption key.
Encryption keys used on the data should also be stored with a key management system to prevent unauthorized access.
### Backup Data & Implement Disaster Recovery [...] Boosting your cloud storage security posture starts with a solid plan incorporating solutions with advanced security features, such as ransomware protection with immutability or Dedicated Storage as a Service powered by Pure Storage. Need help creating a plan? TierPoint’s IT security consulting services can help you create a strategy and execute it to protect your data both in the cloud and in transit. Contact us to learn more.
Matt Pacheco
D
docs.cloud.google.com
article
https://docs.cloud.google.com/storage/docs/best-practices
The Cloud Storage access control system includes the ability to
specify that objects are publicly readable. Make sure you intend for any
objects you write with this permission to be public. Once "published", data on
the Internet can be copied to many places, so it's effectively impossible to
regain read control over an object written with this permission. [...] If you need to make content available securely to users who don't have user
accounts, we recommend you use signed URLs. For example, with signed URLs
you can provide a link to an object, and your application's customers don't
need to authenticate with Cloud Storage to access the object. When you
create a signed URL you control the type (read, write, delete) and duration of
access.
## Data uploads [...] Avoiding use of sensitive information as part of bucket or object
names. For example, instead of naming your bucket
`mysecretproject-prodbucket`, name it `somemeaninglesscodename-prod`. In
some applications, you may want to keep sensitive metadata in
custom Cloud Storage headers such as `x-goog-meta`, rather than encoding
the metadata in object names.
`mysecretproject-prodbucket`
`somemeaninglesscodename-prod`
`x-goog-meta`
C
cisa.gov
official
https://www.cisa.gov/resources-tools/training/get-most-out-cloud-storage-and-…
### Do
Use a cloud provider that offers end-to-end encryption for data moving between your device and the cloud, and encryption for data stored on cloud infrastructure.
Use a cloud provider in a country whose legal regime confers protections for privacy and security of personal data.
Use a strong password and MFA to protect your cloud account.
Store a local copy of your data.
Routinely update your device and software.
### Do Not [...] Keep updated copies of critical data on devices you physically control, such as your computer or an external hard drive, to reduce the risk of permanent data loss.
Protect your account with a strong password and use MFA.
Be vigilant against phishing attempts to trick you into clicking on a link and entering your cloud account credentials.
Keep your device and software updated to reduce the chances that a threat actor can access your cloud account through malware installed on your device. [...] ## The Bottom Line
Cloud services, such as Microsoft OneDrive, iCloud, and Google Drive, enable real-time collaboration and allow you to back up your data. To reduce cybersecurity risks associated with cloud storage:
1. Ensure that your cloud provider encrypts your data and is headquartered in a country with privacy and security laws to help protect your data.
2. Protect your account with a strong password and multifactor authentication (MFA). Be wary of phishing attempts.
## The Problem