SAFEGUARDING PRIVACY IN DATABASE ACTIVITY MONITORING WITHIN CLOUD ENVIRONMENTS: CHALLENGES AND SOLUTIONS
Keywords:
Privacy-Preserving, Technologies, Cloud Database Monitoring, Access Control Mechanism, Compliance Management, Homomorphic EncryptionAbstract
This article talks about the problems and ways to fix them when it comes to protecting privacy while monitoring database behavior in the cloud. Monitoring database activity is important for making sure data is safe and correct because more and more people are using cloud computing. However, the monitoring method itself raises a lot of privacy concerns. The article looks at the current situation, the limits of technology, and the laws that govern things. It gives a full picture of how privacy can be successfully protected. The talk emphasizes how important privacy-protecting technologies, access control systems, tracking and monitoring plans, and compliance management tools are for dealing with the problems of sensitive data, the complexity of the cloud environment, and government rules. Case studies from real life show how privacy protection methods can work well in healthcare and finance. The piece also talks about what might happen in the future, including how Privacy by Design ideas could be used and how anomaly detection could be improved. It also talks about new technologies like homomorphic encryption and blockchain for permanent access logs. The results add to the ongoing conversation about how to balance the need for security with the right to privacy in the digital age.
References
Gartner. (2021). Gartner Forecasts Worldwide Public Cloud End-User Spending to Grow 18% in 2021. https://www.gartner.com/en/newsroom/press-releases/2020-11-17-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-grow-18-percent-in-2021
K. Kaur, S. Dhindsa, and G. Singh, "Database Activity Monitoring: A Review," International Journal of Advanced Research in Computer Science, vol. 8, no. 5, pp. 2182-2186, 2017.
Cloud Security Alliance. (2021). Top Threats to Cloud Computing: Egregious Eleven Deep Dive. https://cloudsecurityalliance.org/artifacts/top-threats-egregious-eleven-deep-dive/
IBM. (2020). Cost of a Data Breach Report 2020. https://www.ibm.com/security/data-breach
T. Wachter, "Privacy Law and Artificial Intelligence: The EU and US Approach," in Privacy and Identity Management. Data for Better Living: AI and Privacy, M. Friedewald, M. Önen, E. Lievens, S. Krenn, and S. Fricker, Eds. Cham: Springer International Publishing, 2020, pp. 3-16.
Ponemon Institute. (2020). 2020 Cost of Insider Threats Global Report. https://www.observeit.com/2020costofinsiderthreat/
UpGuard. (2019). The UpGuard Cyber Risk Team Discovers Massive Data Exposure to businesses Orvibo Smart Home Devices. https://www.upguard.com/breaches/orvibo-smart-home-data-breach
Cloud Security Alliance. (2021). Top Threats to Cloud Computing: Egregious Eleven Deep Dive. https://cloudsecurityalliance.org/artifacts/top-threats-egregious-eleven-deep-dive/
B. Krebs, "Microsoft Azure Multi-Factor Authentication Bypass Flaw Exposed," Krebs on Security, 03-Oct-2018. https://krebsonsecurity.com/2018/10/microsoft-azure-multi-factor-authentication-bypass-flaw-exposed/
European Commission. (2018). GDPR: Rules for business and organisations. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations_en
Ponemon Institute. (2019). The 2019 Cost of Cloud Cybersecurity Incidents. https://www.netskope.com/netskope-threat-labs/ponemon-institute-cloud-cybersecurity-incidents-report/
CVE-2019-7609. (2019). Kibana versions before 6.6.1 and 5.6.15 contain an arbitrary file inclusion flaw in the Console plugin. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7609
Ponemon Institute. (2020). Cost of a Data Breach Report 2020. https://www.ibm.com/security/data-breach
A. Machanavajjhala, D. Kifer, J. Abowd, J. Gehrke, and L. Vilhuber, "Privacy: Theory meets Practice on the Map," in 2008 IEEE 24th International Conference on Data Engineering, 2008, pp. 277-286.
Cloud Security Alliance. (2021). State of Cloud Security Concerns, Challenges, and Incidents. https://cloudsecurityalliance.org/artifacts/state-of-cloud-security-concerns-challenges-and-incidents/
V. C. Hu et al., "Attribute-Based Access Control," Computer, vol. 48, no. 2, pp. 85-88, 2015.
J. Glasser and B. Lindauer, "Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data," in 2013 IEEE Security and Privacy Workshops, 2013, pp. 98-104.
IBM. (2021). IBM QRadar User Behavior Analytics. https://www.ibm.com/products/qradar-user-behavior-analytics
Gartner. (2020). Gartner Predicts for the Future of Privacy 2020. https://www.gartner.com/smarterwithgartner/gartner-predicts-for-the-future-of-privacy-2020/
OneTrust. (2021). The Most Widely Used Privacy, Security, and Data Governance Platform. https://www.onetrust.com/platform/
J. Li, Y. Zhang, X. Chen, and Y. Xiang, "Secure attribute-based data sharing for resource-limited users in cloud computing," Computers & Security, vol. 72, pp. 1-12, 2018.
R. Mogull, "Tokenization Guidance: How to Reduce PCI DSS Compliance Costs," Securosis, LLC, 2011.
S. Hou, Q. Ye, Y. Cheng, and J. Ma, "Anomaly detection for healthcare systems using unsupervised learning," in 2019 IEEE Global Communications Conference (GLOBECOM), 2019, pp. 1-6.
V. C. Hu et al., "Attribute-Based Access Control," Computer, vol. 48, no. 2, pp. 85-88, 2015.
OneTrust. (2021). The Most Widely Used Privacy, Security, and Data Governance Platform. https://www.onetrust.com/platform/
IAPP. (2020). California Consumer Privacy Act (CCPA). https://iapp.org/resources/article/california-consumer-privacy-act-ccpa/
Google Cloud. (2021). Confidential Computing. https://cloud.google.com/confidential-computing
E. Boeker, "Google Cloud Launches Confidential VMs for Sensitive Data," Virtualization & Cloud Review, 14-Jul-2020.
Microsoft. (2021). What is Azure role-based access control (Azure RBAC)? https://docs.microsoft.com/en-us/azure/role-based-access-control/overview
Microsoft. (2021). Azure customers. https://azure.microsoft.com/en-us/case-studies/
A. Cavoukian, "Privacy by Design: The 7 Foundational Principles," Information and Privacy Commissioner of Ontario, Canada, 2009.
D. Schiff, S. Borgesius, and J. v. Hoboken, "Privacy by Design: Promise versus Reality," IEEE Security & Privacy, vol. 19, no. 2, pp. 20-27, 2021.
Gartner. (2020). Gartner Predicts for the Future of Privacy 2020. https://www.gartner.com/smarterwithgartner/gartner-predicts-for-the-future-of-privacy-2020/
S. M. Erfani, S. Rajasegarar, S. Karunasekera, and C. Leckie, "High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning," Pattern Recognition, vol. 58, pp. 121-134, 2016.
D. Kwon, H. Kim, J. Kim, S. C. Suh, I. Kim, and K. J. Kim, "A survey of deep learning-based network anomaly detection," Cluster Computing, vol. 22, no. 1, pp. 949-961, 2019.
J. Glasser and B. Lindauer, "Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data," in 2013 IEEE Security and Privacy Workshops, 2013, pp. 98-104.
C. Gentry, "Fully homomorphic encryption using ideal lattices," in Proceedings of the 41st Annual ACM Symposium on Theory of Computing, 2009, pp. 169-178.
J. H. Cheon, A. Kim, M. Kim, and Y. Song, "Homomorphic Encryption for Arithmetic of Approximate Numbers," in Advances in Cryptology – ASIACRYPT 2017, 2017, pp. 409-437.
R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, "CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy," in Proceedings of the 33rd International Conference on Machine Learning, 2016, pp. 201-210.
T. T. A. Dinh, R. Liu, M. Zhang, G. Chen, B. C. Ooi, and J. Wang, "Untangling Blockchain: A Data Processing View of Blockchain Systems," IEEE Transactions on Knowledge and Data Engineering, vol. 30, no. 7, pp. 1366-1385, 2018.
N. Rifi, E. Rachkidi, N. Agoulmine, and N. C. Taher, "Towards using blockchain technology for eHealth data access management," in 2017 Fourth International Conference
on Advances in Biomedical Engineering (ICABME), 2017, pp. 1-4.
U.S. Department of Health and Human Services. (2020). HHS Announces Health IT Awardees Focused on Innovative Interoperability Solutions. https://www.hhs.gov/about/news/2020/10/29/hhs-announces-health-it-awardees-focused-on-innovative-interoperability-solutions.html
Downloads
Published
Issue
Section
License
Copyright (c) 2024 Venkatakrishna Valleru (Author)
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
