When running workloads with sensitive and regulated data in the cloud, organisations are seeking greater options to enable them to protect and control that data themselves. Faiyaz Shahpurwala, Chief Product Officer at Fortanix, tells us how, by taking control of their encryption keys, organisations will be able complete their Digital Transformation journeys and start applying the benefits of the cloud for their most sensitive and essential assets.
Cloud technology has redefined the business world in recent years, with IDC finding that 90% of organisations now have at least some of their applications or infrastructure hosted in the cloud and the remainder expected to catch up by 2021.
The increased flexibility, agility and cost-savings offered bymoving to the cloud mean there are few reasons for organisations to hold back.One of the last barriers for public cloud adoption is concern around securityand data protection. While most firms now have at least some of theiroperations based in the cloud, many are still reluctant when it comes to theirmost sensitive data and mission critical assets.
Why are public clouds a security concern?
Working with a third-party cloud provider necessitates a certain loss of control and a large degree of trust. If a cloud host is not properly configured and secured, it will leave the data of its customers vulnerable to being breached by threat actors. Data security regulations such as GPDR also make it clear that an organisation is still responsible for any data breach involving a third party, so firms must ensure they carry out due diligence on their chosen cloud providers.
One of the most important elements of good cloud security is the proper use of encryption. When it comes to data security compliance, GDPR, as well as others such as the upcoming California Consumer Protection Act (CCPA) maintain that firms will not be subject to penalties if they suffer a data breach, but only if the information has been encrypted.
However, encryption is only an effective defence if the cryptographic keys that govern access are well defended. Encryption keys are usually held in the cloud as well and if threat actors are able to get their hands on them, they will have free reign to access all of the information on the cloud server.
From a compliance perspective, PCI DSS, the global creditcard security standard, states that encryption keys cannot be held in the cloud,which means any firm that deals with payment details cannot store this data ona public cloud and remain compliant.
Aside from the threat posed by an external intruder, cryptographickeys held on a cloud server are also potentially vulnerable to maliciousinsiders or other third parties. Because the organisation has no control overthe keys, it will also be unable to prevent the provider from giving them up incircumstances such as legal action.
Taking back control of cloud security
The security, privacy and compliance concerns around storingsensitive data in the cloud can all be overcome by organisations taking controlof their encryption keys and keeping them outside of the cloud. By using abring your own keys (BYOK) approach, organisations will be able to store theirkeys in their own preferred data centre.
Taking this tactic will greatly reduce the risk of encryption keys being accessed by cyberattackers or malicious insiders, as well as restoring control when it comes to access issues from other third parties or legal requests. Even if the cloud provider suffers a catastrophic data breach, the data will remain safely encrypted if the keys are secured in a separate data centre.
The additional security assurance created by taking directownership of their cloud encryption keys means that organisations can gain theconfidence to start using their cloud infrastructure to host sensitive data andmission critical assets. For the first time, firms will also be able to begin storingcredit card data in the cloud without falling foul of the PCI DSS.
Managing encryption keys effectively
Taking control of its cloud encryption keys is only a beneficial strategy if the enterprise itself can secure them properly. Firms should take their time when selecting a colocation data centre to hold their keys and ensure their chosen provider has advance security measures in place.
In addition, organisations need to implement an effective encryption key management system for securely generating, storing and using cryptographic keys and certificates. This is particularly important when it comes to managing multi-cloud environments, which has increasingly become the cloud strategy of choice. Recent research from Gartner found that 81% of public cloud users are working with two or more providers.
Businesses will be dealing with different sites at multiplegeographies, as well as potentially different cryptographic processes includingencryption, tokenisation and shared secrets. Alongside this, many firms rely ona hybrid approach that combines on-premise and cloud-based infrastructure.
An effective management tool will make it easier to cutthrough the complexity created by these environments to establish a consistentapproach that ensures there is no oversight or connectivity issues around theuse of encryption keys.
Ideally, organisations should be seeking a key managementsystem that uses a cloud native approach and is designed to be developerfriendly. In particular, it is important to have an accessible API for cloudand dev-ops teams to work with.
While the cloud has become a ubiquitous part of the business world and particularly Digital Transformation, you could argue that were still very much at the beginning of the journey. Just five years ago, most firms were still only doing minor, low risk testing and development on the public cloud. Only now are we at last getting to the point where more critical assets and infrastructure are being migrated over.
By taking control of their encryption keys into their own hands, organisations will be able complete their Digital Transformation journeys and start applying the benefits of the cloud for their most sensitive and essential assets as well.
- Why the US government is questioning WhatsApp's encryption - CNBC - February 25th, 2020
- No Backdoor on Human Rights: Why Encryption Cannot Be Compromised - Bitcoin News - February 25th, 2020
- Backdoor to encryption back on agenda in absurdly named bill - 9to5Mac - February 25th, 2020
- Signal is the European Union's encrypted messaging app of choice - Cult of Mac - February 25th, 2020
- cloudAshur, hands on: Encrypt, share and manage your files locally and in the cloud - ZDNet - February 25th, 2020
- ASIO: Relentless advance of technology was outstripping our capabilities - ZDNet - February 25th, 2020
- Cygilant to Highlight the Need for Encrypted Traffic Visibility at RSA Conference 2020 - Business Wire - February 25th, 2020
- Encryption Software Market 2020 Emerging Trends, Growing Demand, Leading Companies, Applications, Overview and Regional Analysis 2026 - News Times - February 25th, 2020
- US bill seen threatening encryption on tech platforms - EJ Insight - February 25th, 2020
- AES Encryption Software Market to Witness Increased Incremental Dollar Opportunity During the Forecast Period 2020 2026 | Dell, Eset, Gemalto, IBM,... - February 25th, 2020
- Malware and HTTPS a growing love affair - Naked Security - February 25th, 2020
- Hardware-based Full Disk Encryption Market To Witness Growth Acceleration During 2020-2026 | Western Digital Corp, Samsung Electronics, Toshiba,... - February 25th, 2020
- Encryption Software Market are anticipated to lucrative growth opportunities in the future by Product Type, Structure, End-user and Geography to 2027... - February 25th, 2020
- Proposed Bill Could Threaten Apple, Facebook Messaging Platforms - MSSP Alert - February 25th, 2020
- Zettaset to Participate in Cybersecurity Forum at Annual HIMSS 2020 Conference - Business Wire - February 25th, 2020
- Cloud Encryption Technology Market Analysis with Key Players, Applications, Trends and Forecasts to 2025 | Gemalto, Sophos, Symantec - Nyse Nasdaq... - February 25th, 2020
- US legislation to fend off end-to-end encryption of Facebook, Google and others - Financial World - February 25th, 2020
- Encryption on Facebook, Google, others threatened by planned new bill - Reuters - February 22nd, 2020
- What Is an Encryption Backdoor? - How-To Geek - February 22nd, 2020
- Sophos Takes On Encrypted Network Traffic With New XG Firewall 18 - CRN: Technology news for channel partners and solution providers - February 22nd, 2020
- Last Week In Venture: Eyes As A Service, Environmental Notes And Homomorphic Encryption - Crunchbase News - February 22nd, 2020
- CIA Encryption Meddling and Chinese Espionage Allegations Make It Clear: We All Need Strong Data Protection - Reason - February 12th, 2020
- Congress, Not the Attorney General, Should Decide the Future of Encryption - Lawfare - February 12th, 2020
- The code breakers: This vault is the epicenter in law enforcement's battle to unlock encrypted smartphones - USA TODAY - February 12th, 2020
- Enea Announces New Smart Tools to Identify Encrypted and Evasive Network Traffic - Yahoo Finance - February 12th, 2020
- Encryption Vs. Decryption: What's the Difference? - Techopedia - February 12th, 2020
- Labor Bill to fix Australian encryption laws it voted for hits second debate - ZDNet - February 12th, 2020
- Encryption Software Market Growth by Top Companies, Trends by Types and Application, Forecast to 2026 - News Parents - February 12th, 2020
- Mobile Encryption Market to Grow Massively (2020-2025) By Size, Share, Price, Trend and Forecast | Blackberry, T-Systems International, ESET, Sophos,... - February 12th, 2020
- Child-Welfare Activists Attack Facebook Over Encryption Plans - The New York Times - February 9th, 2020
- How Attorney General Barr's War On Encryption Will Harm Our Military - Techdirt - February 9th, 2020
- Strong Opinions on Whether Police Calls Should be Encrypted - Government Technology - February 9th, 2020
- The EARN IT Act is the latest clueless attack on encryption, do not fall for it - Privacy News Online - February 9th, 2020
- Republican Senator Lindsey Graham introduces bill that threatens end-to-end encryption - World Socialist Web Site - February 9th, 2020
- Activists write to Facebook against encryption, says it will dent bid to curb child pornography - Hindustan Times - February 9th, 2020
- BBB Offers the Following Tips for National Clean Out Your Computer and Safer Internet Day WKTN- A division of Home Town Media - WKTN Radio - February 9th, 2020
- Optical Encryption Market Booming by Size, Revenue, Trends and Top Growing Companies 2026 - Instant Tech News - February 9th, 2020
- Federal government warning of voter coercion, foreign election interference through private messaging services - CBC.ca - February 9th, 2020
- Mobile Encryption Market 2020 Recent Industry Developments and Growth Strategies Adopted by Top Key Players Worldwide and Assessment to 2025 -... - February 9th, 2020
- Well-meaning charities urge Facebook to halt encryption plan to protect kids - 9to5Mac - February 6th, 2020
- How the B-Team watches over Australia's encryption laws and cybersecurity - ZDNet - February 6th, 2020
- Kids Need End-to-End Encryption for Protection Against Corporations - The Mac Observer - February 6th, 2020
- Encryption Backdoors: The Achilles Heel to Cybersecurity? - Techopedia - February 6th, 2020
- US Lawmakers Seeking to Ban Companies From Using End-to-End Encryption With a New Draft Bill - Bitcoin Exchange Guide - February 6th, 2020
- United States: a invoice towards end-to-end encryption? - Sahiwal Tv - February 6th, 2020
- TLS 1.0/1.1 end-of-life countdown heads into the danger zone - The Daily Swig - February 6th, 2020
- How Would a US Ban on End to End Encryption Affect Cryptocurrency? - Bitcoinist - February 5th, 2020
- Officials Ask Public to Weigh in on Encrypting Police Calls - Government Technology - February 5th, 2020
- Bluefin and FroogalPay Partner to Provide PCI-Validated Point-to-Point Encryption (P2PE) - Benzinga - February 5th, 2020
- Facebook to allow parents to monitor their kids' chat messages - Sussex Express - February 5th, 2020
- Hardware-based Full Disk Encryption Market To Boom In Near Future By 2027 With Industry Key Players - Science of Change - February 5th, 2020
- New ransomware with '.SaveTheQueen' extension discovered by Varonis - Information Age - February 5th, 2020
- The Best Encryption Software for 2020 | PCMag - February 2nd, 2020
- Encryption - What It Is, Types, Algorithms, & More ... - February 2nd, 2020
- A Beginner's Guide to Encryption: What It Is and How to ... - February 2nd, 2020
- Encryption | Internet Society - February 2nd, 2020
- Best encryption software tools of 2020: Keep your data ... - February 2nd, 2020
- What is 256-bit Encryption? How long would it take to crack? - February 2nd, 2020
- A new bill could punish web platforms for using end-to-end encryption - The Verge - February 2nd, 2020
- How to encrypt email (Gmail, Outlook iOS, OSX, Android ... - February 2nd, 2020
- Researchers showcase all-optical encryption tech to keep data hidden and safe - The Times of Israel - February 2nd, 2020
- The U.S. government's been trying to stop encryption for 25 years. Will it win this time? - Tom's Guide - February 2nd, 2020
- Apple's end-to-end encryption threatened by new proposed bill - AppleInsider - February 2nd, 2020
- With Streaming Becoming More Prevalent in 2020, it would be better to connect to the Internet with a VPN - gotech daily - February 2nd, 2020
- nCipher Security: More Americans trust encryption than know what it is - Security Boulevard - January 30th, 2020
- Encryption Software Market 2020 Analysis by Current Industry Status, Key Manufacturers, Industry Drivers and Forecast to 2024 Dagoretti News -... - January 30th, 2020
- Emerging Opportunities in Hardware-based Full Disk Encryption Market with Current Trends Analysis - Dagoretti News - January 30th, 2020
- Scientists from Israel have developed the worlds first optical encryption technology Stealth - The Times Hub - January 30th, 2020
- Government Report Reveals Its Favorite Way to Hack iPhones, Without Backdoors - VICE - January 30th, 2020
- How to Get the Most Out of Your Smartphone's Encryption - WIRED - January 30th, 2020
- Forensics detective says Android phones are now harder to crack than iPhones - Android Authority - January 30th, 2020
- Options to End the End to End Encryption Debate - Infosecurity Magazine - January 30th, 2020
- Remember the Clipper chip? NSA's botched backdoor-for-Feds from 1993 still influences today's encryption debates - The Register - January 30th, 2020
- Why Public Wi-Fi is a Lot Safer Than You Think - EFF - January 30th, 2020
- There is no legislation mandating encryption of private information - Kamloops This Week - January 30th, 2020
- Apple Watch rewards, iCloud encryption, and WhatsApp hacks on the AppleInsider Podcast - AppleInsider - January 30th, 2020
- Apple Wanted the iPhone to Have End-to-End Encryption. Then the FBI Stepped In - Popular Mechanics - January 27th, 2020
- Amazon Engineer Leaked Private Encryption Keys. Outside Analysts Discovered Them in Minutes - Gizmodo - January 27th, 2020
- Deployed 82nd Airborne unit told to use these encrypted messaging apps on government cell phones - Military Times - January 27th, 2020
- The FBI doesn't need Apple to give it a backdoor to encryption, because it already has all the access it needs - Boing Boing - January 27th, 2020