Data security in the cloud: Data encryption, access control and choosing a cloud provider in compliance with GDPR

EXECUTIVE SUMMARY FOR EXECUTIVES

Implementing a comprehensive data security strategy in the cloud requires:

• A clear understanding of the shared responsibility model (supplier vs customer)
• Implement a multi-layered approach to security (encryption, access control, MFA)
• Selecting a supplier that meets the requirements of GDPR and Polish sector regulations
• Prepare incident response procedures and business continuity plans
• Regular audits, testing and training of employees

Proposed implementation roadmap:

1. Data classification and risk assessment (1 month)
2. Supplier selection and contract preparation (1-2 months)
3. Development of security architecture (1 month)
4. Implementation of access control and encryption (1-2 months)
5. Security testing and incident response (2 weeks)
6. Data migration with regular validation (2-3 months)
7. Employee training and documentation of compliance (continuous activity)

What is cloud data security?

Cloud data security is a comprehensive strategy for protecting information in cloud environments, based on a shared responsibility model. The provider is responsible for the infrastructure, and the customer is responsible for the data, applications and their configuration.

Depending on the service model (IaaS, PaaS, SaaS), the line of responsibility shifts – in IaaS the customer is responsible for operating systems, applications and data, in PaaS for applications and data, and in SaaS mainly for access management and configuration.

Effective protection requires a balance between confidentiality, integrity and availability of data, taking into account Polish regulatory requirements. For the financial sector, the FSA’s guidelines (the 2020 Communiqué and Recommendation D) are key, for medical entities – the CSIOZ requirements, and for all organizations processing personal data – the DPA’s GDPR guidelines.

For IT/security: Review the FSC’s cloud computing documents, especially vendor evaluation guidelines, and NIST 800-53 and ISO 27017/27018 standards for cloud security controls.

What are the biggest threats to data stored in the cloud?

Cloud environments face specific security risks that differ from traditional on-premise environments. The most serious risks are:

1. Configuration errors – improperly secured buckets, databases without authentication or redundant permissions. In Poland in 2023, this problem affected several public sector entities.
2. Attacks on APIs and identity management – Attempts to take over privileged accounts, especially those of cloud administrators, through credential stuffing, phishing attacks or the use of misdesigned APIs.
3. Insider threats – According to CERT.PL, unauthorized employee actions are a significant factor in security incidents, especially in organizations without procedures for monitoring administrator activity.
4. Incomplete visibility and control – difficulty in monitoring data flow and detecting anomalies, especially in multi-cloud environments, increasing the risk of unauthorized access and data leakage.

For business decision makers: Make sure your organization has a clear division of responsibility for cloud security, with a defined budget for regular configuration validation and training.

Next steps: Conduct a security gap analysis of your current cloud environment using assessment tools compatible with CIS Benchmarks for your cloud provider.

The most serious threats to cloud data – in the Polish context

Configuration errors – The most common cause of violations resulting in notifications to the DPA

Identity attacks – Takeover of privileged accounts, especially through phishing and weak passwords

Segmentation problems – Insufficient separation of production and test/development environments

Unclear liability model – Lack of awareness of which safeguards lie with the customer

How does encryption protect data in the cloud?

Encryption is the last line of defense, protecting data even when other security features are compromised. It acts like a digital safe, transforming data into an unreadable format without a decryption key.

In a cloud environment, it is crucial to implement encryption at three levels:

• Data at rest (storage, databases)
• Data in motion (transmission over networks)
• Data in use (in-memory processing)

Polish organizations, as recommended by the Polish Data Protection Authority, should pay special attention to control over encryption keys. BYOK (Bring Your Own Key) or HYOK (Hold Your Own Key) models provide a higher level of security, as the cloud provider does not have full access to unencrypted data. This is particularly important for entities in the public and financial sectors.

For IT/security: Verify implementation of TLS 1.3 for data transmission and use of AES-256 for data at rest. Consider implementing application-level encryption for the most sensitive data.

Next steps: Consult with your cloud provider about the available encryption key management options and evaluate the feasibility of implementing BYOK/HYOK in your organization.

What encryption standards are recommended for cloud services?

Choosing the right encryption algorithms is crucial for effective data protection. For stored data, AES (Advanced Encryption Standard) with a 256-bit key is recommended. In Polish public institutions, according to the KRI (National Interoperability Framework), it is required to use algorithms that comply with the minimum requirements for ICT systems.

For data in transmission, it is essential to use TLS 1.3 or at least TLS 1.2 with secure cipher suites. Older, vulnerable versions of SSL/TLS protocols should be disabled. For VPNs, IPsec or OpenVPN protocols with strong encryption algorithms are recommended.

Key management should comply with standards such as KMIP (Key Management Interoperability Protocol). For Polish regulated entities (finance, energy, public administration), it is necessary to take into account additional sector requirements and reporting to relevant regulators.

For IT/security: Configure the rotation of encryption keys according to the organization’s security policy (typically every 90 days for data keys and annually for master keys). Prepare a plan to respond to a possible breakage of the cryptographic algorithms used.

Next steps: Verify the current encryption implementation for compliance with NIST SP 800-57 recommendations and KRI requirements (for public institutions).

How to effectively manage data access control in the cloud?

Cloud access management requires precise implementation of the principle of least privilege, which minimizes the potential area of attack. Polish regulators, including UODO and KNF, emphasize granular access control and accurate privilege records.

Key elements of effective access control:

• Segmentation of resources – separation of environments (dev/test/prod) and data with different sensitivities
• Roles and powers – precisely defined based on job responsibilities
• Temporary access – granting privileges only for the duration of tasks (just-in-time access)
• Regular entitlement reviews – in compliance with ISO 27001 and KSC Act requirements for key service operators

For Polish organizations, it is important to take into account the requirements of the National Cyber Security System Act and sectoral regulations that may impose additional obligations to control access to data processed in the cloud.

For business decision makers: Introduce a formal approval process for granting access to critical resources that takes into account business and security considerations.

Next steps: Conduct a review of the current privilege structure, identify and eliminate redundant privileges, especially for technical and service accounts.

Effective access control in the Polish regulatory environment

Documentation of permissions – Keep an up-to-date record of all users and their permissions

Cyclic reviews – Conduct formal entitlement reviews every 3 months

Multi-level authentication – Enter approval of access to critical data by at least two people

Activity monitoring – Record and analyze the activities of privileged users

Why is multi-factor authentication crucial to cloud security?

Multi-Factor Authentication (MFA) effectively blocks 99% of automated attacks on accounts. It is a fundamental security feature that significantly improves security compared to traditional passwords.

MFA requires at least two independent authentication components from different categories:

• Something the user knows (password, PIN)
• Something the user has (token, smartphone app)
• Something the user is (biometrics)

In Poland, according to UODO and KNF guidelines, MFA is required for access to systems that process personal data in the cloud and for financial systems. It is recommended to avoid SMS as a second component (SIM swapping vulnerability) in favor of authentication applications or hardware tokens.

Implementing MFA should be a priority for privileged cloud administrator accounts, developers with access to production environments, and business users with access to sensitive data.

For IT/security: Start the implementation with administrator accounts, then developer accounts, and finally all users. Consider using the FIDO2/WebAuthn standard for enhanced security.

Next steps: Develop a migration plan from less secure forms of MFA (SMS) to more advanced forms (applications, hardware tokens) for all critical systems.

What criteria should be considered when choosing a cloud service provider?

Choosing the right cloud provider is a strategic decision, especially important in the context of Polish regulatory requirements. Key criteria include:

1. Security mechanisms – availability of encryption, access control, monitoring and protection against threats, taking into account specific industry requirements.
2. Certifications and compliance with standards – ISO 27001, ISO 27017/27018 (cloud), SOC 2, industry certifications (e.g. PCI DSS). For Polish public entities, compliance with KRI and the KSC Act is important.
3. Location of processing – availability of data centers in Poland or the EU. According to the guidelines of the DPA and the FSA, many categories of data require processing only within the EEA.
4. SLAs and support – guaranteed levels of service availability, incident response times, availability of technical support in Polish.
5. Compliance with Polish regulations – for the financial sector compliance with the KNF communiqué, for the health sector with CSIOZ requirements, for public entities with the KSC and KRI law.

For business decision makers: Consider total cost of ownership (TCO), including hidden costs associated with data transfer, backup storage and security management.

Next steps: Prepare a detailed list of security and compliance requirements specific to your industry and conduct a structured process to evaluate potential suppliers.

How to check whether a cloud provider meets the requirements of RODO?

Verifying a vendor’s compliance with RODO requires a comprehensive analysis of documentation, practices and technical mechanisms. Key areas:

1. Processing entrustment agreement (DPA) – must contain all the elements required by Article 28 of the RODO, including the purpose and time of processing, the obligations of the parties, and guarantees to implement appropriate safeguards. The DPA emphasizes the need to precisely identify the location of processing and the supplier’s subcontractors.
2. International Transfers – after the Schrems II ruling, it is necessary to carefully verify if and how data is transferred outside the EEA. The supplier should use updated Standard Contractual Clauses with additional technical and organizational safeguards.
3. Technical security measures – the provider should provide documentation of implemented security mechanisms, preferably confirmed by certifications such as ISO 27701 (RODO), ISO 27017/27018 (cloud).
4. Fulfillment of people’s rights – verify that the provider supports the controller in the realization of data subjects’ rights (access, correction, deletion, data portability).

National regulators, including Poland’s UODO, publish additional guidelines on cloud computing that are worth considering in the verification process.

For IT/security: Prepare an RODO compliance matrix and verify which elements are implemented by the vendor and which require additional action on your part.

Next steps: Consult your vendor’s documentation with a lawyer specializing in RODO and conduct a data protection impact assessment (DPIA) for your planned cloud operations.

Verifying cloud provider compliance with RODO – a Polish perspective

Independent audits – Check the results of audits conducted by Polish certification bodies

Local representation – Verify that the supplier has a representative in Poland in accordance with Article 27 of the RODO.

Processing in the EU – Ensure that data can only be processed in the EEA, if necessary

Polish-language documentation – Check the availability of contracts and technical documentation in Polish

What provisions should a contract with a cloud service provider contain?

A contract with a cloud provider is the basis for a secure cooperation. In addition to the typical commercial aspects, it should include detailed provisions for security and legal compliance:

1. Service specification – a precise description of performance parameters, SLA metrics (availability, response time) and compensation mechanisms. For Polish organizations, it is important that the SLA take into account the minimum levels specified in sector regulations (e.g., KNF requirements for banks).
2. Data security – clear definition of the shared responsibility model, protection mechanisms implemented by the provider, and incident response procedures. It is necessary to include the right to audit by the customer or an independent entity.
3. Processing location – a list of data centers where data will be processed, taking into account EU processing requirements. For organizations subject to Polish sector regulations, processing is often required only within the EEA.
4. Termination of cooperation – data export procedures, retention period after contract termination, and confirmation of data deletion. The export format should allow migration to another provider.
5. Additional requirements for Polish organizations – clauses on compliance with KRI (for public entities), FSC requirements (for the financial sector), or sector regulations on cyber security.

For business decision makers: When negotiating a contract, pay particular attention to clauses regarding changes in terms by the supplier and the jurisdiction and law applicable to the contract.

Next steps: Consult with legal and technical specialists on the draft agreement to ensure that the organization’s interests are adequately protected and that it complies with local regulatory requirements.

How do you monitor and audit data security in the cloud?

Effective monitoring and auditing of cloud security requires a systematic approach that combines technical tools with formal processes:

1. Comprehensive logging – all operations on data should be recorded (who, when, from where, what data was accessed). It is especially important to monitor changes in security configuration. The Polish KRI standard requires logs to be kept for at least 2 years for systems that process classified information.
2. Behavior and Anomaly Analysis – Implement UEBA (User and Entity Behavior Analytics) systems that detect unusual access patterns or activity that may indicate a security breach.
3. Regular audits – formal security reviews of the cloud environment, in accordance with ISO 27001 requirements and national standards (e.g. KRI for public administration). For regulated entities (e.g., banks), sector-specific requirements need to be addressed.
4. Automated configuration scanning – regularly checking configuration compliance with best practices (e.g., CIS Benchmarks) and internal requirements.

For IT/Security: Integrate cloud logs into a central SIEM, set alerts for critical security events, and automate configuration compliance analysis.

Next steps: Develop a schedule of regular audits, including both internal reviews and independent external audits in line with regulatory requirements specific to your organization.

How to properly manage encryption keys in a cloud environment?

Effective encryption key management requires a systematic approach that combines security with operational availability:

1. Choice of key management model – organizations can use a cloud provider (AWS KMS, Azure Key Vault), hybrid solutions or their own BYOK/HYOK systems. For Polish financial and public institutions, increased control over keys is often required.
2. Key hierarchy – implementing a structure with master keys to protect the keys used to encrypt data. This approach facilitates rotation and management.
3. Rotation procedures – regular refreshment of keys in accordance with security policies (typically every 1-2 years for master keys, every 90 days for data keys). Polish sector regulations may specify minimum frequencies.
4. Separation of duties – implement key access control based on the “four eyes” principle, where operations on critical keys require authorization by at least two authorized persons.

For IT/security: Implement key rotation automation with appropriate controls and notification system. Conduct regular disaster recovery tests on encrypted data.

Dalsze kroki: Przygotuj kompletną dokumentację procesu zarządzania kluczami zgodną z wymaganiami ISO 27001 i lokalnymi standardami, uwzględniającą procedury awaryjne i plan ciągłości działania.

Managing encryption keys – practical tips

Key inventory – Maintain an up-to-date record of all keys with their purpose and rotation dates

Rotation automation – Implement automatic mechanisms to refresh keys without disrupting data access

Secure backups – Store copies of keys in offline safes or HSM systems

Regular testing – Verify ability to recover data after loss of primary key

What are the best practices for cloud backup?

A cloud backup strategy should be based on the 3-2-1 rule, which is the foundation for protecting data from loss:

1. Backup architecture – at least three copies of data (original + two copies), on two different media, with one copy in a different geographic location. In the context of Polish compliance requirements, it is often necessary to store copies within the EU.
2. Frequency and retention – tailored to data characteristics and business requirements, with clearly defined parameters for RPO (maximum acceptable data loss) and RTO (maximum recovery time). Polish sector regulations often specify minimum retention periods, such as for medical or financial records.
3. Encryption of backups – mandatory during both transmission and storage, with keys managed independently of the copies themselves. According to the recommendations of the DPA, copies of personal data should always be encrypted.
4. Regular restoration testing – scheduled testing of full and partial restoration of data, documented and verified for completeness and compliance with the specified RTO. For critical entities, testing is required as part of a broader business continuity plan.

For IT/security: Implement automatic backup integrity validation and ransomware detection mechanisms in backups before restoration.

Next steps: Develop a comprehensive restoration test plan that takes into account various failure scenarios and a schedule of regular exercises for the IT team.

How do you segment and classify data in the cloud?

Effective segmentation and classification of data is the foundation of a security strategy, enabling the implementation of appropriate safeguards depending on the sensitivity of the information:

1. Classification scheme – tailored to the specifics of the organization, industry regulations and the nature of the data. A typical division includes categories: unclassified, internal, confidential and strictly confidential data. For Polish organizations, it is worth taking into account the categories resulting from KRI (for administration) or sector regulations.
2. Automatic identification and tagging – using mechanisms offered by vendors (e.g. Azure Information Protection, AWS Macie) to automatically detect and classify personal, financial or intellectual property data.
3. Differentiated controls – implement safeguards appropriate to the level of sensitivity, from basic for public data to advanced (MFA, BYOK, detailed logging) for confidential information.
4. Geographic segmentation – addressing legal requirements for data localization. Polish public and regulated entities must often store data within the EU/EEA.

For IT/security: Integrate the classification process with DevOps tools so that security requirements are taken into account from the design stage of new services.

Next steps: Develop an organizational policy for classifying and labeling data, conduct employee training, and implement automated classification mechanisms.

How to perform a secure data migration to the cloud?

A secure migration to the cloud requires a methodical approach that considers security aspects at every stage of the process:

1. Preparation and risk assessment
   • Inventory and classification of data to be migrated
   • Risk analysis taking into account specific risks and compliance requirements
   • For Polish entities: verification of compliance with local regulations (RODO, KRI, sector requirements)
2. Choosing the right migration methods
   • For critical data: offline methods (e.g., AWS Snowball, Azure Data Box)
   • For systems that require continuity: real-time replication tools
   • Key: data encryption throughout the migration process
3. Validation after migration
   • Integrity and availability tests of transferred data
   • Verification of the correctness of access control and other security mechanisms
   • Permission audit with elimination of redundant accesses

For business decision makers: Ensure a clear division of responsibility and communication plan during migration, especially for business-critical systems.

Next steps: Prepare detailed documentation of the migrated environment, including security configuration and operational procedures in accordance with regulatory requirements.

Safe migration – key steps for Polish organizations

Compliance analysis – Verify the compliance of the planned architecture with the requirements of the FSA, UODO or other sector regulators

Encryption in transit – Use TLS 1.3 and application-level encryption for critical data

Security testing – Conduct penetration testing of the new environment before full production migration

Documentation – Prepare complete technical documentation and operating procedures

What procedures should be implemented in the event of a data security breach?

An effective response to a security breach in a cloud environment requires the preparation of appropriate procedures that take into account the specifics of the cloud:

1. Incident response plan – tailored to the cloud environment, with clearly defined roles, communication channels and escalation procedures. The plan should take into account the division of responsibilities between the organization and the cloud provider.
2. Procedures for containment and damage limitation – cloud-specific activities, such as:
   • Isolate compromised assets through security groups
   • Rotation or invalidation of access keys
   • Quickly replace compromised instances with clean images
3. Incident analysis and documentation – systematic collection of digital evidence and logs, crucial for subsequent investigation and breach reporting obligations (e.g., to the DPA in the case of personal data, according to Article 33 of the RODO).
4. Breach communication – prepared notification templates for supervisory authorities, data subjects (according to Article 34 of RODO) and other stakeholders.

For IT/security: Integrate incident response procedures with cloud automation tools for rapid isolation and containment of the threat.

Next steps: Conduct incident response simulations (tabletop exercise) with IT, security and legal teams, testing various breach scenarios in a cloud environment.

How to train employees to use the cloud safely?

Effective cloud security training must take into account the different roles in an organization and focus on practical aspects:

1. A role-specific approach – differentiated programs for:
   • Administrators (security configurations, monitoring)
   • Developers (secure coding, access management)
   • End users (security basics, threat recognition)
2. Practical scenarios – training based on real cases, simulations of phishing attacks, security configuration workshops. Exercises using actual tools used in the organization are particularly valuable.
3. Building a culture of security – promoting a proactive approach where every employee understands his or her role in protecting data and proactively reports potential threats.

In the Polish context, training should take into account local regulations (RODO, KRI, KSC Act) and the specifics of the national threat landscape, with examples of incidents reported by CERT Polska.

For business decision makers: Treat security training as an investment, not a cost. Well-trained employees are the first and most important line of defense against cyber threats.

Next steps: Develop a plan for regular training and practice exercises, differentiated for different groups of employees, with a mechanism to verify effectiveness (e.g., simulated phishing attacks).

How do you document compliance with RODO in the context of cloud services?

Documenting compliance with RODO in a cloud environment requires a systematic approach that takes into account the specifics of cloud computing:

1. Register of processing activities – expanded to include cloud-specific information:
   • Data processing locations (provider regions)
   • Cloud services used and their functions
   • The role of the supplier as a processor
2. Documentation of technical security measures – a detailed description of the protection mechanisms implemented in the cloud environment:
   • Data encryption configurations
   • Access control and authentication mechanisms
   • Backup and restore procedures
   • Supplier security certifications (ISO 27001, CSA STAR)
3. Documentation of cross-border processing – after the Schrems II ruling is necessary:
   • Analysis of third country legislation (if applicable)
   • Documentation of additional safeguards for transfers outside the EEA
   • Current standard contract clauses (SCC)

It is particularly important for Polish entities to take into account the guidelines of the DPA on cloud computing, including requirements for data localization and minimum security standards.

For IT/Security: Create and maintain an up-to-date map of data flows across the cloud ecosystem, with geographic locations and types of data processed labeled.

Next steps: Conduct a Data Protection Impact Assessment (DPIA) for critical cloud computing processes, following the methodology recommended by the DPA.

How do you combine convenience of use with a high level of security in the cloud?

Balancing security and usability is an ongoing challenge that can be effectively addressed through:

1. Intelligent, context-sensitive security mechanisms – an adaptive approach that adjusts the level of control to the actual risk:
   • Adaptive authentication requiring additional verification only in high-risk situations
   • User behavior analysis (UEBA) to automatically detect potential violations
2. Automation and integration – embedding security mechanisms into natural workflows:
   • Single sign-on (SSO) eliminating the need to manage multiple passwords
   • Automatic classification and protection of data based on content and context
   • DevSecOps integrated security tools for development teams
3. User-centered design – intuitive interfaces and security processes:
   • Clear messages and guidance instead of technical error messages
   • Simplified procedures, such as resetting passwords or requesting access
   • User education explaining the purpose of security mechanisms

For business decision makers: Involve end users in the design and testing of security mechanisms to ensure their effectiveness and acceptance.

Next steps: Implement pilot programs of new security mechanisms with a select group of users, gather feedback and iteratively refine solutions before full implementation.

What tools support data security in the cloud?

Both solutions from global leaders and local products supporting cloud security are available on the Polish market:

1. Cloud Access Security Broker (CASB) – tools that mediate between an organization’s infrastructure and cloud services:
   • Offer visibility, compliance monitoring, data protection and security against threats
   • Popular solutions: McAfee MVISION Cloud, Netskope, Microsoft Defender for Cloud Apps
2. Identity and access management (IAM) – control of authorization and authentication:
   • Single sign-on (SSO), multi-factor authentication (MFA)
   • Identity and entitlement lifecycle management
   • Solutions: Okta, Microsoft Entra ID, Cloudentity (with Polish R&D division), Protecto.ai (Polish startup)
3. Data leakage protection (DLP) – monitoring and controlling the flow of sensitive information:
   • Content inspection, transfer control, encryption and masking
   • Products: Forcepoint DLP, Digital Guardian, Polish solutions like Cryptomind DLP
4. Cloud-based vulnerability management – proactive detection of security vulnerabilities:
   • Configuration scanning, compliance audit, threat prioritization
   • Examples: Qualys Cloud Platform, Tenable.io, Datadog Cloud Security
5. SIEM/SOAR for the cloud – centralizing log analysis and automating response:
   • Collection and correlation of data from various sources, automatic response
   • Solutions: IBM QRadar, Splunk, Microsoft Sentinel, Polish C3M SIEM

For IT/Security: When choosing tools, prioritize integration with solutions already in use and compliance with Polish regulatory requirements for your industry.

Next steps: Conduct a proof of concept for 2-3 best-fit solutions, testing their effectiveness in your cloud environment.

Key categories of cloud security tools for Polish organizations

CASB – Provides visibility and control over the use of cloud services, especially important for organizations with distributed teams

IAM with advanced MFA – Enhances access security, in accordance with the recommendations of the UODO and the FSA

Compliance tools – Automate verification of compliance with RODO, KRI and sector regulations

SIEM/SOAR – Centralize security monitoring and improve incident response

How do you prepare your organization for cloud security emergencies?

Effective emergency preparedness requires a comprehensive approach, combining planning, testing and competence building:

1. Business continuity and disaster recovery plans
   • Tailored to the specifics of cloud services
   • Clearly defined RTO and RPO parameters for key systems
   • Taking into account different scenarios: from single failures to catastrophic events
   • Complies with regulatory requirements (e.g., FSA Recommendation D for banks)
2. Incident response team
   • Interdisciplinary composition: IT, security, legal, communications
   • Clearly defined roles, responsibilities and escalation procedures
   • Dedicated points of contact with the cloud provider
   • For Polish critical entities: compliance with the requirements of the KSC Act
3. Regular exercises and simulations
   • Tabletop testing for various security breach scenarios
   • Technical simulations to verify replicability of systems
   • Red team/blue team exercises to test security and response effectiveness
   • Documentation of applications and improvement of procedures

For business decision makers: Consider taking out cyber insurance policies that can partially cover costs associated with security breaches, including penalties under RODO. Ensure that you meet the technical requirements required by insurers.

Next steps: Develop an annual schedule of scenario and technical exercises, including backup recovery tests and verification of procedures for notifying all stakeholders.