Risk
10/10/2013
07:54 PM
Elad Yoran
Elad Yoran
Commentary
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Don't Let 'Spooks' Get Your Cloud Data

Lesson from National Cyber Security Awareness Month: Keys are the key, and keep it simple.

This is the 10th anniversary of the Department of Homeland Security's National Cyber Security Awareness Month. Is it coincidence, or did DHS choose October on purpose? I ask because security has certainly gotten scary lately. Whether it's attackers stealing Adobe's customer data in a series of sophisticated assaults or the NSA gaining access to cloud data, it seems each day we're reminded that protecting our information and privacy from cyber threats demands constant vigilance. While security is a complex system, like most everything else in life, if you can keep it simple, it's easier to manage.

With the current slate of headlines putting the spotlight on cloud data security, two prominent organizations in that sphere recently issued updated best practices for protection of data stored and processed in third-party clouds. The common link: encryption.

In both the Cloud Security Alliance's updated Cloud Control Matrix and the National Institute of Standards and Technology (NIST) September Interagency Report, encryption key management, in particular, features prominently:


"Strong encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider." -- CSA CCM v3, Encryption & Key Management

"...in all architectural solutions where cryptographic keys are stored in the cloud, there is a limit to the degree of security assurance that the cloud Consumer can expect to get, due to the fact that the logical and physical organization of the storage resources are entirely under the control of the cloud Provider." -- NIST Interagency or Internal Report 7956 (September 2013)

[ Respondents to the InformationWeek 2013 Strategic Security Survey rate encryption the No. 2 most effective security practice, behind firewalls. See more here. ]

If you don't want "ghouls" stealing your customer data or government "spooks" twisting your cloud provider's arm to hand over information, it's crucial to retain ownership and control of encryption keys. In fact, while doing encryption key management in-house may seem down in the weeds, allowing someone else to hold your keys has direct consequences on the business. I argue that key management should be a priority agenda item not just for the chief security officer but also CEOs and boards of directors, especially for any company that stores or processes data in the cloud. What recent headlines have reinforced is the simple fact that the person or entity that controls and manages the encryption keys has effective control over the data. It really is that simple. When nobody else has the encryption keys, any entity seeking to decrypt data needs to demand the keys directly from the data owner.

chart: security practices

With direct control of encryption keys, businesses may also:

-- Maintain their compliance responsibility for adequate data protection safeguards

-- Address data residency and privacy regulations for data stored and processed in the cloud

-- Respond directly to government and law enforcement subpoenas for cloud data

-- Implement and enforce best practices for securing and governing cloud data

Three Data Security Tricks

While holding onto the keys is critical, any approach to protecting data in the cloud must incorporate three other elements to ensure its effectiveness:

-- First, encryption must be invisible to the end user, both to ensure that the business gains the full productivity benefit of the service and also to ensure that users aren't motivated to find ways around security measures because they get in the way of business processes. Simply, it needs to be a part of the existing workflow and remain frictionless for the user.

-- Second, data must be persistently encrypted throughout its life cycle, whether in transit, at rest or in use.

-- Third, the encryption scheme must be watertight. If the encryption itself is easily broken, who holds the keys no longer matters. The 256-AES algorithm should be non-negotiable. Anything else isn't strong enough.

So as October rolls on and we read more about cybersecurity issues, stay grounded in the fundamentals and control the things you can control. While it's impossible to guarantee you'll never be the target of a cyber attack, you can put yourself in the best position to defend, deflect or mitigate it. And with data, what you can control is encryption keys -- whether data is on-premises or in the cloud.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Ulf Mattsson
50%
50%
Ulf Mattsson,
User Rank: Apprentice
10/11/2013 | 9:49:27 PM
re: Don't Let 'Spooks' Get Your Cloud Data
I agree that "it's crucial to retain ownership and control of encryption keys", but sensitive data can still be exposed.
If you outsource to a public-cloud provider, they often have multiple data storage systems located in multiple data centers, which may often be in multiple countries or regions. Consequently, the client may not know the location of their data, or the data may exist in one or more of several locations at any particular time. Additionally, a client may have little or no visibility into the controls protecting their stored data. This can make validation of data security and access controls for a specific data set particularly challenging. In a public-cloud environment, one clientGÇÖs data is typically stored with data belonging to multiple other clients. This makes a public cloud an attractive target for attackers, as the potential gain may be greater than that to be attained from attacking a number of organizations individually.
I think that the good news here is that strong data-level security can be enforced on all sensitive or potentially sensitive data before it is sent to the cloud.
I recently read an interesting report from the Aberdeen Group that revealed that GÇ£Over the last 12 months, tokenization users had 50% fewer security-related incidents (e.g., unauthorized access, data loss or data exposure than tokenization non-usersGÇ¥. The name of the study, is GÇ£Tokenization Gets TractionGÇ¥.
Ulf Mattsson, CTO Protegrity
Eddie Mayan
50%
50%
Eddie Mayan,
User Rank: Apprentice
10/14/2013 | 11:34:16 AM
re: Don't Let 'Spooks' Get Your Cloud Data
Consult about Security for your product to cloudways here: http://www.cloudways.com/en/cl...
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-0914
Published: 2014-07-30
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management f...

CVE-2014-0915
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

CVE-2014-0947
Published: 2014-07-30
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

CVE-2014-0948
Published: 2014-07-30
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

Best of the Web
Dark Reading Radio