| ||||||||||
| ||||||||||
Current Filter: Cloud>>>>>Opinion> Crypto management - the key to cloud data security? Editorial Type: Opinion Date: 04-2015 Views: 1918 Key Topics: Cloud Security Encryption Cloud-based Security Key Companies: Wick Hill SafeNet Key Products: Key Industries: | |||
Ed Kidson, product manager, Wick Hill on why encryption is the key to securing cloud data - just as long as the key isn't lost! The cloud is an attractive business proposition for many. But time and time again, companies express concerns about how secure their information is in the cloud. Security is the biggest inhibitor of organisations moving their precious data to the cloud in the first place. Issues arise such as data co-mingling, privileged user abuse, snapshots and backups, data deletion, data leakage and geographic regulatory requirements. Security concerns also arise if you want to switch from one cloud provider to another. How can you be sure what is happening to back-ups and archives of VMs, data volumes and maybe databases that were hosted there? You don’t necessarily know where all those copies are held or how they are held. Indeed, even if you remain with the same provider you can never be certain of the location of your data. So based on the assumption that you cannot guarantee your data’s location and you need to know that the data is secure, the best practise is now widely acknowledged to be encryption. This then negates issues around the data location, so should it be compromised, it is unreadable. However, what is often neglected is that by encrypting data, we shift the security risk from the loss of data to the loss of cryptographic keys. The keys must be stored and managed securely. Failure to protect encryption keys is akin to locking your car and leaving the keys on the bonnet. If your data is encrypted and protected, it is absolutely essential that you turn your attention to crypto management - the creation, management, security and storing of encryption keys. You may have encryption, but without crypto management, it’s not worth encrypting because your data could still be at risk through the loss or mismanagement of your crypto keys! You need to know where and how the crypto keys are stored, and by whom? Should the service provider hold the keys? If so, how do they do that? Are they secured within a hardware security module or just sat on a server? Is there an audit trail for the life cycle of the keys? Do you have access to that? Perhaps it would be more prudent for a company to manage their own keys, so that should assets be moved between service providers, access to the keys can be removed from the old provider, making the backup copies of those assets safe. 2014 research(1) by SafeNet, a leading provider of encryption and crypto management solutions, indicated that strong encryption and secure management of keys were critical prerequisites to data centre consolidation and cloud migration. It found that - * Only 45.6% managed their keys centrally. * 18% didn’t know where their keys were stored Further 2014 research(2), sponsored by SafeNet and conducted by the Ponemon Institute, found that * On average in the UK 52% said they stored encryption keys in software. This is the worst possible place for the crown jewels. * Only 34% of respondents said their organisations had a policy that required the use of security safeguards, such as encryption, as a condition to using certain cloud computing resources
Solutions
KeySecure
Luna HSM Crypto Hypervisor
Conclusion 1, http://www.safenet-inc.com/news/2014/global-survey-reveals-data-center-security-concerns/ 2. http://www2.safenet-inc.com/cloud-security-research/ | |||
Like this article? Click here to get the Newsletter and Magazine Free! | |||
Email The Editor! OR Forward Article | Go Top | ||
PREVIOUS | NEXT |