There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently accessed data before making a trip to disk based RDBMS. AWS Elasticache is an example this. One architectural 'Best Practice' I've heard recently is to cache everything first. Then make trips to disk only for less used (cold) data.
With this growing trend to leverage more in-memory storage, I've not seen very much written about securing these data stores along with potential associated vulnerabilities that come along with them. When I asked Amazon if there is encryption available for Elasticache data they said no.
In addition, I'm not sure if traditional data storage security guidelines apply in the same manner as disk based storage for regulated agencies. For example, encrypting data at rest (DAR) is a NIST requirement for sensitive data (e.g. PII, PHI) in the cloud. Does this same standard apply to data which only exists in-memory? If not, is that really a good idea? Have NIST and other security organizations even considered the potential attack vectors in this space yet? If so, are there any published guidelines out there for in-memory storage? Or are we supposed to infer from old rules/regulations/guidelines and then extrapolate into this storage environment?
Any thoughts on Securing In-Memory Data Stores appreciated, especially from those who've had to certify the security of their systems through third-party assessors.