P
Poorvy Sharma
Guest
It is a Gold Standard for customers to know that their Data is in safe hands, but at the same time promise of cloud computing was internet without borders, frictionless, global channel where data flowed seamlessly. This article is based on the experience with working for Cloud Platforms that provide services around the globe. The article focuses to explain that when clients sign the Standard Contractual Clauses with the cloud platform providers, it does not automatically guarantee the data will not cross borders even when the data is stored locally in their region. This is because the Cloud Platforms are dynamic in nature as they take automated backups, integrate with other systems to automate processes. To ensure data privacy it is necessary to use hardware security solutions in the server to ensure no data leaks as well as no entry from back door to the servers. There have been many cases reported for cross border data transfers.
For Technical Architects of a Cloud platform, Data safeguarding is one of the key challenges of their day-to-day work. With the increase in the number of cases of identity thefts, every region’s government has to implement regulatory framework to safeguard their citizen’s data.
It is very important to understand the difference between Data residency and genuine digital sovereignty. While Data residency is more about the geography where data will be stored or where the castle of data will be built, genuine digital sovereignty speaks more about who has the key to that castle!
Before we analyze how modern architectures adapt, we must first distinctly understand the two terms that are frequently confused as inter related:
Data Residency: It specifies the physical, geographic location where data will be stored or at rest, processed or backed up. Achieving residency is the first challenge of deciding the physical infrastructure as data residency is a geographic constraint. The physical infrastructure challenge is resolved by building or leasing localized data centers. [1, 2, 3]
Data Sovereignty: In simple terms this is a jurisdictional constraint. It dictates that an organization’s data, metadata, custom code and operational workflows remain governed exclusively by laws of the country data resides in. The data is insulated from foreign extraterritorial access laws (for example the US CLOUD ACT) [1,2,3,4]
Data residency may ensure safety when data is at rest, but what happens to data in transit? This question is answered by understanding the below layers that constitute towards true digital sovereignty, further the pyramid image explains the significance of each layer [a][c] :
1. Data Residency – The physical location of the data center where data will reside. This makes the base of the pyramid
2. Access control (Operational Sovereignty): It means administrative and support activities must be done by trust worthy personnel in the country of Data residency
3. Encryption control (Technical Sovereignty): This means that the client holds the key to the encrypted data and hence the service provider cannot fiddle with something they cannot see!
4. Legal control of Data (Data Sovereignty): If the software company is headquartered in U.S but stores data in South Africa (that means Data residency is local to South Africa but cloud company is headquartered in U.S) then by lay U.S government can ask provider to hand over the data.
Below are few of the major challenges with achieving Digital sovereignty:
Every innovation is always posed with challenges as detailed and explained in depth in this article [1]
1. Complex regulations – The regulations change by region
2. Innovations in Technology – We are in the era of AI which changes the equation
3. Frequently changing Customer expectations – Data privacy is the major concern for all customers
4. Threats to Data security – Hackers are also becoming creative so it is necessary to upkeep the data protection measures
The market has systematically shifted from centralized public cloud nodes towards highly distributed, isolated and multi-tenant architectures designed for local control. To meet this demand leading global hyperscalers have adopted following engineering strategies [1]:
Is it possible to achieve Data Sovereignty just by signing contracts alone? Simple answer to this question is ‘No’; it has to be enforced using hardware and implementing encryption. Most of the platforms have now deployed the models “bring your own key” and “hold your own key”. These models ensure that the cloud vendor, even if they are compelled by the government to surrender the data, encryption makes it unreadable. All this is good when data is at rest and not in the middle of processing, so how do we protect data when it is being processed? Confidential Computing is the answer to this dilemma. The heart of Confidential Computing is the hardware enclave (CPU chip) also technically called the Trusted Execution Environment, this helps separate the data from cloud and decrypts the data for processing within the enclave, so the cloud service provider still does not see any real data. So, in simple statement data at rest is secured using encryption, data in transit is safeguarded by network protocols like HTTPS, TLS etc. and then data during processing is protected by hardware enclave.
To safeguard data in tough situations like war or disconnection due to hardware or network failures, a local version of the cloud can be created to decouple it from global network. Let us understand it with an example: There is a bank headquartered in New York and has a branch in Spain and Norway. If the bank’s main office in NY suddenly experiences network failure, then its branch in Spain and Norway must still be able to operate and service its customers. Decoupling is how this is achieved.
Innovation is happening around the globe, so enterprises are inclined to partner up with software providers internationally, but to safeguard data they are also partnering with local providers to stay compliant to local data protection governance.
It is the responsibility of an enterprise to stay compliant with data protection and should not be considered as a company against cloud implementation. With the fast-growing technology and the era of AI, it is imperative that protecting data should be every country’s top priority. Enterprises need to adapt digital infrastructure to stay ahead in the race while protecting the data. The real challenge is to build a cloud strategy in which innovation, data sovereignty, and trust coexist by design. The real world threats call for well defined data governance strategy, a clear understanding of regulatory obligations, and an architecture that incorporates security, privacy and compliance from the outset. In the age of AI, organizations who build responsible innovation on the foundation of data protection will lead the race!
For Technical Architects of a Cloud platform, Data safeguarding is one of the key challenges of their day-to-day work. With the increase in the number of cases of identity thefts, every region’s government has to implement regulatory framework to safeguard their citizen’s data.
It is very important to understand the difference between Data residency and genuine digital sovereignty. While Data residency is more about the geography where data will be stored or where the castle of data will be built, genuine digital sovereignty speaks more about who has the key to that castle!
Deconstructing the Stack: Residency vs. Sovereignty
Before we analyze how modern architectures adapt, we must first distinctly understand the two terms that are frequently confused as inter related:
Data Residency: It specifies the physical, geographic location where data will be stored or at rest, processed or backed up. Achieving residency is the first challenge of deciding the physical infrastructure as data residency is a geographic constraint. The physical infrastructure challenge is resolved by building or leasing localized data centers. [1, 2, 3]
Data Sovereignty: In simple terms this is a jurisdictional constraint. It dictates that an organization’s data, metadata, custom code and operational workflows remain governed exclusively by laws of the country data resides in. The data is insulated from foreign extraterritorial access laws (for example the US CLOUD ACT) [1,2,3,4]
Data residency may ensure safety when data is at rest, but what happens to data in transit? This question is answered by understanding the below layers that constitute towards true digital sovereignty, further the pyramid image explains the significance of each layer [a][c] :
1. Data Residency – The physical location of the data center where data will reside. This makes the base of the pyramid
2. Access control (Operational Sovereignty): It means administrative and support activities must be done by trust worthy personnel in the country of Data residency
3. Encryption control (Technical Sovereignty): This means that the client holds the key to the encrypted data and hence the service provider cannot fiddle with something they cannot see!
4. Legal control of Data (Data Sovereignty): If the software company is headquartered in U.S but stores data in South Africa (that means Data residency is local to South Africa but cloud company is headquartered in U.S) then by lay U.S government can ask provider to hand over the data.
Below are few of the major challenges with achieving Digital sovereignty:
Every innovation is always posed with challenges as detailed and explained in depth in this article [1]
1. Complex regulations – The regulations change by region
2. Innovations in Technology – We are in the era of AI which changes the equation
3. Frequently changing Customer expectations – Data privacy is the major concern for all customers
4. Threats to Data security – Hackers are also becoming creative so it is necessary to upkeep the data protection measures
How the Cloud Platforms Architect to achieve Localization?
The market has systematically shifted from centralized public cloud nodes towards highly distributed, isolated and multi-tenant architectures designed for local control. To meet this demand leading global hyperscalers have adopted following engineering strategies [1]:
1. Technical Isolation:
Is it possible to achieve Data Sovereignty just by signing contracts alone? Simple answer to this question is ‘No’; it has to be enforced using hardware and implementing encryption. Most of the platforms have now deployed the models “bring your own key” and “hold your own key”. These models ensure that the cloud vendor, even if they are compelled by the government to surrender the data, encryption makes it unreadable. All this is good when data is at rest and not in the middle of processing, so how do we protect data when it is being processed? Confidential Computing is the answer to this dilemma. The heart of Confidential Computing is the hardware enclave (CPU chip) also technically called the Trusted Execution Environment, this helps separate the data from cloud and decrypts the data for processing within the enclave, so the cloud service provider still does not see any real data. So, in simple statement data at rest is secured using encryption, data in transit is safeguarded by network protocols like HTTPS, TLS etc. and then data during processing is protected by hardware enclave.
2. Decoupling and de-risking global infrastructure:
To safeguard data in tough situations like war or disconnection due to hardware or network failures, a local version of the cloud can be created to decouple it from global network. Let us understand it with an example: There is a bank headquartered in New York and has a branch in Spain and Norway. If the bank’s main office in NY suddenly experiences network failure, then its branch in Spain and Norway must still be able to operate and service its customers. Decoupling is how this is achieved.
3. Balancing global and local partnerships:
Innovation is happening around the globe, so enterprises are inclined to partner up with software providers internationally, but to safeguard data they are also partnering with local providers to stay compliant to local data protection governance.
Conclusion
It is the responsibility of an enterprise to stay compliant with data protection and should not be considered as a company against cloud implementation. With the fast-growing technology and the era of AI, it is imperative that protecting data should be every country’s top priority. Enterprises need to adapt digital infrastructure to stay ahead in the race while protecting the data. The real challenge is to build a cloud strategy in which innovation, data sovereignty, and trust coexist by design. The real world threats call for well defined data governance strategy, a clear understanding of regulatory obligations, and an architecture that incorporates security, privacy and compliance from the outset. In the age of AI, organizations who build responsible innovation on the foundation of data protection will lead the race!