Steps to address data spillage in the cloud (ITSAP.50.112)

Step 1: Identify the data spill

Swiftly identifying a data spillage incident is crucial for limiting the potential damage. Recognizing unauthorized data exposure is vital to identifying data spillage. This can occur in various ways, such as misplaced emails, unsecured cloud storage or misplaced physical devices. Early detection is key and is dependent on robust monitoring systems and awareness of data flows within an organization. This allows you to quickly assess the nature, scope, and potential impact of the data spill.

Take the following actions to effectively triage and assess the damage caused by a data spill:

• What information was compromised?
  • Understanding the type of data—whether personal, financial, or confidential—helps determine the severity of the spill
• Where was the information moved?
  • Identifying the unintended location(s) of the data can guide the containment strategy
• How was the information moved?
  • Understanding the method of transfer, such as USB or email, can provide insights into the nature and potential spread of the spill
• Who was the information sent to?
  • Knowing who received the spilled data is essential for containment and remediation efforts
• Where did the information come from?
  • Tracing the origin of the spilled data helps identify potential vulnerabilities within the system
• When did the spill occur?
  • Determining the timing of the spill can affect the response strategy and potential impact assessment

Early identification depends on a comprehensive understanding of these aspects and allows your organization to respond effectively and mitigate the impacts of data spillage.

Step 2: Contain the data spill

The immediate containment of a data spill is critical to preventing further unauthorized access or distribution. This step requires your organization to secure the spilled data by removing it from unsecured locations or restricting access to it. In cloud environments, containment may also involve working with cloud service providers (CSPs) to leverage their tools and capabilities for securing data. A rapid response is essential to seal off vulnerabilities and limit data proliferation.

To effectively contain a data spill, consider the following:

Utilize platform functions

Employ available cloud platform functions to delete the affected files and any known copies from your system. If the spill involves email, recall the message if possible.

Direct recipients

For all forms of data, including email, contact the recipients directly and instruct them not to forward or access the data. Ask all recipients to delete the spilled information from their environments and to empty their recycle bins.

Challenges containing data in the cloud

Recognize the unique challenges of containing data spillages in cloud environments, including:

• verifying the complete removal of spilled data post-cleanup
• determining whether data has been compromised once the spilled data has been exposed

These steps underscore the complexity of managing data spillage in cloud services and the importance of swift, strategic actions to mitigate risks effectively.

Step 3: Alert your stakeholders of the data spill

After the data spillage is identified and contained, it’s crucial to promptly alert the appropriate internal and external stakeholders. Effective communication ensures a coordinated response to the incident and helps mitigate potential damage.

To ensure a comprehensive alert protocol, consider the following actions:

Internal reporting

Immediately contact your IT service desk to report the spillage. If the IT service desk is designated as the remediation authority, they will triage the incident following your organization’s security incident management process. If not, it will escalate the incident to the appropriate remediation authority.

Report to management

Inform your management chain of the incident, regardless of the type of breach. They will provide support, direction for the remediation effort and to respond to any inquiries as required.

Secure communication with cloud service providers

When involving CSPs, use secure communication methods. Ensure that cleared CSP personnel have located and deleted all possible copies of the data (if this is included in your service agreement). If secure communication methods and cleared personnel are not readily available, assess the benefits versus the risks of contacting the CSP with your manager.

External notifications

Depending on the nature of the data and the spillage, external notifications may be required. This includes notifying affected individuals, regulatory bodies or other stakeholders as dictated by law, regulation or policy.

Additional information for government departments and critical infrastructure sectors

For Government of Canada departments and critical infrastructure sectors, external notifications involve reporting breaches directly to the Canadian Centre for Cyber Security (Cyber Centre) by phone at 1-833-CYBER-88 (1-833-292-3788) or online at Report a cyber incident.

Government of Canada departments

In addition to reporting the incident to the Cyber Centre, follow your department’s incident response procedures and the Government of Canada Cyber Security Event Management Plan (GC CSEMP).

Critical infrastructure sectors

In addition to reporting the incident to the Cyber Centre, consult Public Safety’s action-oriented guidance in Fundamentals of Cyber Security for Canada’s CI community for more information.

Privacy

If a data spill impacts or potentially impacts the privacy of Canadians, report the spill to the Office of the Privacy Commissioner.

Step 4: Remediate the data spill

After containing the spill and notifying the relevant parties, your focus should shift to remediation. This involves not only addressing the immediate impacts of the spill but also implementing measures to prevent future incidents. Effective remediation depends on a thorough investigation to understand the root causes of the spillage.

For a comprehensive remediation process, consider the following actions:

Work with your cloud service provider

Engage with your CSP to ensure the spill is fully contained and to leverage their expertise in cleaning up the spill. This includes utilizing platform functions for data clean-up, such as removing tags and pointers or employing crypto-shredding.

Manage device and cloud space

Recall, destroy, and replace any affected mobile devices, servers or portions of the cloud tenant space that contained the spilled data. Crypto-shredding can be an effective method for ensuring the data is irrecoverable.

Review policies and procedures

Analyze the incident to identify any weaknesses in current policies and procedures. Update these to incorporate lessons learned from the spillage, focusing on improving data management, transfer, and storage practices.

Engage stakeholders

Ensure all stakeholders, including CSPs and any external organizations involved, are informed of the remediation actions and progress. Coordination with these parties is essential for a holistic approach to remediation.

Considerations to enhance your cyber security posture in the cloud

To enhance your overall cyber security posture in the cloud, your organization should consider the following:

Responsibility and collaboration

Understand that the legal responsibility for data security remains with the data owner, even in cloud environments. Effective collaboration with CSPs and clear internal policies are crucial for protecting data.

Awareness and training

Educating personnel on the risks of data spillage and proper data-handling techniques is essential for preventing data spills. Regular training can significantly reduce the likelihood of future incidents. To view the full list of Cyber Centre courses, please visit The Learning Hub.

Continuous improvement

Adopting a posture of continuous improvement, learning from past incidents, and updating policies accordingly are vital steps in enhancing an organization's data security measures.

Appropriate disposal of IT equipment

Proper disposal reduces the risk of threat actors exploiting residual data that is left on IT equipment with electronic memory or data storage media. This advice is applicable when considering data spillages using cloud services. Consult IT media sanitization (ITSP.40.006) for additional advice on properly disposing of IT media.