Securely Manage PII with Skyflow and Enhanced File Security on AWS

Organizations face challenges in protecting PII and ensuring compliance. Skyflow Data Privacy Vault isolates and secures sensitive data, transforming it into tokens for downstream storage, reducing compliance scope. Cloud Storage Security complements this by automatically scanning uploaded files for viruses and malware, mitigating potential threats. This partnership simplifies file management, ensures data security, and eases compliance burdens.

Securely Managing Personally Identifiable Information (PII) with Skyflow and Cloud Storage Security on AWS

Introduction

Organizations entrusted with the management of personally identifiable information (PII) face significant challenges in maintaining the security and compliance of this sensitive data. Despite best efforts, PII often resides in a fragmented fashion across diverse repositories, including databases, data warehouses, log files, and backups, making comprehensive security and compliance measures difficult to implement.

Furthermore, file management introduces additional complexities, necessitating stringent security measures, robust access controls, and compliance-aligned storage practices. The risk of data breaches and malware threats escalates when organizations receive files from external sources, such as customers. To mitigate these risks, organizations must meticulously scan external files for viruses and malware prior to processing.

Addressing Challenges with Skyflow and Cloud Storage Security

To minimize risk and alleviate the burdens associated with existing upstream and downstream systems, organizations leverage Skyflow, available within AWS Marketplace. Skyflow Data Privacy Vault delivers comprehensive security, compliance, and data residency for Amazon Web Services (AWS) workloads.

In conjunction with Skyflow, Cloud Storage Security (CSS) plays a crucial role in further safeguarding infrastructure and alleviating the complexities associated with sensitive file management. CSS, an AWS Specialization Partner with the Security Competency, automates the scanning of uploaded files for malicious code and malware.

Securing PII with Skyflow Data Privacy Vault

Skyflow, a software-as-a-service (SaaS) offering, supports both multi-tenant and single-tenant deployment models. Its Data Privacy Vault isolates, protects, and governs access to sensitive customer data, transforming it into opaque tokens that serve as references to the original data. These non-sensitive tokens can be securely stored in any application storage system or utilized in data warehouses.

A Skyflow vault enables the confinement of sensitive data within a specific geographic location and tightly controls access to this data. Other systems interact only with the non-sensitive tokenized data, effectively removing them from the scope of compliance. The tokenization process preserves formatting when necessary and maintains consistency for analytics and machine learning (ML) workflows.

Skyflow Data Privacy Vault serves as the core infrastructure for PII, providing compute, storage, and network resources as a service. Its architectural simplicity is achieved through an API call, and Skyflow employs polymorphic encryption to secure PII and preserve its usability. This enables the execution of operations on fully encrypted data.

Organizations can seamlessly build PII-specific workloads on a Skyflow vault for tasks such as data sharing, analytics, and encrypted operations. This capability empowers businesses to identify records with specific attributes, such as area code, without decrypting the data or calculate customer income averages, all without exposing PII to unauthorized parties.

Working with a Skyflow Vault

While a data privacy vault differs from a traditional database, Skyflow Data Privacy Vault emulates certain database properties. Notably, a Skyflow vault supports a customizable schema consisting of tables, columns, and rows.

Skyflow's vault is specifically designed to manage the entire lifecycle of sensitive data, comprehensively understanding the structure and applications of PII. For instance, a Skyflow vault recognizes a social security number as a distinct data type, not merely a string. This deep understanding allows the vault to natively support use cases such as revealing only the last four digits of a social security number based on defined roles and policies or securely sharing the complete social security number with third-party vendors for identity verification purposes.

Beyond transforming sensitive data into non-sensitive forms, the vault strictly controls access to sensitive data through a zero-trust model. This model ensures that no user account or process can access data without explicit authorization via access control policies. These policies are meticulously constructed from the ground up, granting access to specific columns and rows of PII. This granular control enables organizations to meticulously define who can access what data, when, where, for how long, and in what format.

For data storage, management, and retrieval, Skyflow offers both APIs and software development kits (SDKs). Skyflow supports both frontend and backend SDKs, providing flexibility based on integration requirements.

Managing Secure File Storage with Skyflow and CSS

To demonstrate the secure storage and handling of files through Skyflow, we will examine how this solution effectively removes exposure to sensitive documents for both frontend and backend applications.

In addition to Skyflow Vault, the solution leverages Amazon API Gateway as the backend API entry point for passing non-sensitive data downstream, AWS Lambda to receive and securely store non-sensitive data in Amazon DynamoDB, AWS Secrets Manager for secure storage and management of the Skyflow vault service account key, Amazon DynamoDB to save the skyflow_id shared by the vault after secure file storage, and Cloud Storage Security to automatically ensure that files are free from viruses and other potential threats.

The accompanying architecture diagram illustrates the file upload flow involving Skyflow, the aforementioned AWS services, and CSS.

Access Control Mechanisms

To govern access to the customer's vault, Skyflow employs policies that permit programmatic writes into the vault table for client records.

To ensure read and update access is restricted to the single record owned by the currently logged-in user, Skyflow customers can leverage authentication services like Auth0. The customer application can then identify the user based on the Auth0 token.

Skyflow's vault respects the user's identity and restricts access accordingly. To fulfill this requirement, customers utilize Skyflow's context-aware authorization.

Context-Aware Authorization

Programmatic access to Skyflow APIs is controlled through a service account established within the Skyflow account. The roles assigned to the service account and the policies associated with those roles determine the level of access to a vault. The creation of Skyflow roles, policies, and service accounts can be managed programmatically via Skyflow's management APIs or through Skyflow Studio, Skyflow's web-based vault administration portal.

Context-aware authorization empowers the backend to insert an additional claim for end-user context into the JWT token during insertion. This claim can be any string that uniquely identifies the end user, such as the token provided by Auth0 upon successful client login.

After the additional claim is incorporated, the vault verifies the request and returns a bearer token containing the context identifier. The context-aware authorization flow diagram illustrates authentication with contextual information for the Skyflow customer and data retrieval.

Leveraging the returned bearer token with the context restriction, the frontend customer application can retrieve the PII and files owned by only the currently logged-in user.

Furthermore, the time-to-live (TTL) of the bearer token can be controlled to ensure its validity only for the duration required to retrieve the record for the client.

Securing PII and Files from the Application Frontend

When collecting and managing sensitive data, such as files containing PII, it is prudent to exclude the entire application infrastructure from the security and compliance scope, including the frontend.

Skyflow Elements offers a secure platform for collecting and revealing sensitive data, including files. It provides numerous advantages, including complete programmatic isolation from frontend applications, end-to-end encryption, tokenization, and customizable data collection forms.

When users interact with Skyflow Elements, various components orchestrate to collect and reveal sensitive data. The process unfolds as follows:

1. When a user enters sensitive data into collect elements, the client-side SDK transmits the data to the vault and receives tokens representing the data.
2. When the data needs to be revealed to a user, the client-side SDK sends the tokens to the vault, receives the data, and displays the data in reveal elements.

Following file upload, Skyflow automatically scans the file for viruses through the integrated CSS within the vault. The status of a scan can be retrieved using the Get Status Scan API.

If the file is virus-free, a SCAN_CLEAN status is returned, and the file becomes available for retrieval or in-page display. In the event of a virus detection, a SCAN_INFECTED status is returned, and the file is moved into quarantine.

To reveal an uploaded file, it is embedded into the web frontend as an iframe, ensuring that the file never resides on the customer's servers.

Skyflow empowers organizations to delegate the security, privacy, and compliance responsibilities associated with sensitive file and PII handling, allowing them to focus on their core business objectives.

Conclusion

In this comprehensive overview, we have explored the challenges organizations face in managing sensitive customer data. We have examined how to secure personally identifiable information (PII) using Skyflow Data Privacy Vault and further enhance protection against malware using Cloud Storage Security (CSS) on AWS.

We have also demonstrated how Skyflow Data Privacy Vault can securely collect, manage, and utilize sensitive data. Skyflow seamlessly integrates with CSS to provide automatic virus and malware detection and protection for files.

Organizations寻求更多信息，请联系 Skyflow 或在 AWS Marketplace 中试用 Skyflow。关于 Cloud Storage Security 的更多信息，请访问 AWS Marketplace 中的 CSS。