# Cloud data security solutions Data security in a cloud is based on a risk sharing approach: cloud providers cover some security concerns, but the application owner is still responsible for the data security inside the application and some of the infrastructure security settings. Having less things to worry about, but also less control impacts security posture and creates unique requirements for orchestrating data security controls. Things get especially tricky in a multi-cloud environment. Learn below about data security challenges in cloud computing and their solutions. ## Cloud data security challenges ### BYOK / HYOK challenges Enterprise customers expect that their sensitive data is encrypted by unique keys. It’s achieved with Bring Your Own Key or Hold Your Own Key schemes. The challenge of BYOK / HYOK is to build key management procedures depending on who is responsible for key storage and backup—the customers themselves or the solution provider. ### Gap in available cloud security controls It is still necessary to maintain application security and eliminate data breaches as the [data owner is responsible for data privacy](/content/blog/cloud-security-gaps-in-a-shared-responsibility-model/index.html) in the cloud. Useful cloud security controls include [field level encryption](/content/solutions/application-level-encryption/index.html) (protects sensitive data from developers and DBAs); firewalling and SQL injection protection; audit logging to restore the picture in case of an incident. ### Managing complexity The biggest cloud data security challenge is managing complexity. Moving data through several services, using multi-cloud or hybrid cloud requires more refined access policies and configurations to coordinate different data security controls. ### Vendor lock-in and cloud migration When moving between clouds, migrating cloud-specific controls, configurations and keys becomes a challenge. Even cloud-agnostic tools require re-deployment. Migration means massive risk exposure of spillover and risk of misconfigurations along the way. ## Modern cloud data security solutions ### Cover cloud security risks with fewer tools Mitigating security risks with fewer tools decreases a number of bugs and narrows down the attack surface. It’s also easier to orchestrate security policy over dozens, not hundreds, components. [See AcraModern cloud data security solutions](/content/acra/index.html) ### Scalability and security The cloud data security layer should not prevent scaling and efficient maintenance of your cloud solution. The data security layer could take many shapes: a transparent database encryption proxy, encryption-as-a-service API, or client-side SDK. [See AcraModern cloud data security solutions](/content/acra/index.html) ### Developer friendly tools Cloud data security tools should be easy to integrate, easy to deploy, easy to configure and use. They should work with popular programming frameworks, databases and BI tools. [See AcraModern cloud data security solutions](/content/acra/index.html) ## Our offerings ### Cloud data security software #### Acra ##### A DATABASE SECURITY SUITE Acra is a best fit for cloud data security. Acra offers transparent field level encryption, searchable encryption, masking, tokenization, firewalling and many more. Acra protects data in cloud computing platforms, efficiently applying encryption & other security controls to the data flow, and works in many clouds. [Read moreOur offerings](/content/acra/index.html) #### To be announced There’s something we’re preparing to address new cloud data security challenges – Please stay tuned for further announcements. [Check available productsOur offerings](/content/all-products/index.html) ### Custom solutions and consulting #### Tamper-free audit logs Audit logging module helps to achieve PCI DSS compliance. It gathers logs and security events from any app, transforms them into a stream of cryptographically-protected logs, and stores them securely. The validation utility checks log messages and alerts the security team if logs were modified. #### Security engineering We advise you on designing cloud security architecture, implementing security features, assessing your ongoing or finished development project, verifying its security properties, and providing actionable advisory on improvements. [Read moreOur offerings](/content/solutions/security-engineering-architecture/index.html) #### Security advisory We offer security advisory to ensure your high level security goals are transformed into a clear roadmap. Our security managers and auditors assist with maintaining and formulating security procedures that bring pragmatic and compliance benefits. [Read moreOur offerings](/content/solutions/security-strategy-advisory/index.html) ## Benefits of our cloud security solutions ### Cloud platform compatibility Our cloud data security solution supports all cloud computing platforms (DigitalOcean, AWS, GCP, Heroku, Azure). [Acra](/content/acra/index.html) is cloud-agnostic, which makes protecting data in multi-cloud or hybrid environments as easy as deploying one container. ### Fast time to solution [Acra](/content/acra/index.html) is easy to integrate, easy to configure and run without significant interruption of the existing architecture. Acra is perfect for solutions that process sensitive data and value time-to-market. ### Reduce risks and burden with engineering assistance Our customer success program fits each use case – whether it’s configuring our products, building a custom solution, or analysing security architecture – we are here to lift this burden off you. We provide [security engineering consulting](/content/solutions/security-engineering-architecture/index.html), ongoing support and monitoring under fixed SLAs to ensure that you retain maximum security benefits from using our products and services. ## Cloud data security in use Data security in a cloud requires specific thinking, as data is everywhere: apps, databases, logs, 3rd party services, etc. Data security tools like [Acra](/content/acra/index.html) help to build a cloud-agnostic security layer, protecting data whenever it exists. Cloud security becomes an orchestration of tools, policies and processes spread across all places where data appears. Take a look at this Data Access Object (DAO) architecture as example. A DAO is a service that proxies data exchange between backend services and multiple databases. The DAO controls the dataflow: it knows which data is sensitive and where it's stored, which data fields should be encrypted/decrypted during each request. Often, the DAO also authenticates applications, and provides high availability. On the scheme below the DAO calls [Acra](/content/acra/index.html) as encryption service to encrypt/decrypt sensitive data fields. Acra is responsible for key management and audit logging.