Best practices for securing sensitive data in a public environment?

All answers to this question.

The biggest pitfall in <cloud computing> security isn't the provider's infrastructure; it's misconfigured IAM roles and public S3 buckets. For PII, you should definitely use the "Principle of Least Privilege." Only allow specific roles to access the decryption keys. Regarding BYOK, it gives you more control and satisfies certain regulatory requirements, but it adds significant operational overhead. If you lose those keys, your data is gone forever. For most companies, using the provider's Key Management Service (KMS) with hardware security modules (HSM) is a safer and more scalable middle ground for their <cloud computing> security posture.

   Answered 2025-01-07 by Cheryl Simmons

Are you also looking into "Confidential Computing" where your data is encrypted even while it is being processed in the <cloud computing> RAM?

   Answered 2025-01-09 by Louis Murphy

• Louis, I’ve heard of Nitro Enclaves in AWS. Is that what you mean? I’m interested in that for our most sensitive financial calculations. Is it difficult to refactor existing code to run in a TEE (Trusted Execution Environment), or is it mostly a configuration change at the instance level? We want to stay ahead of any potential sophisticated memory-scraping attacks.

     Commented 2025-01-10 by Alan Woods

Always enable MFA for any user with console access. It’s the simplest way to prevent 90% of unauthorized access in <cloud computing> accounts.

   Answered 2025-01-12 by Janet Myers

• I can't stress Janet's point enough. I've seen entire environments wiped because a developer's credentials were leaked without MFA.

     Commented 2025-01-13 by Rebecca Hayes