Risk

8/11/2011
11:36 AM
50%
50%

Encrypt Early, Encrypt Often

You can't rely on cloud providers for data security.

Slideshow: Cloud Security Pros And Cons
Slideshow: Cloud Security Pros And Cons
(click image for larger view and for full slideshow)
This column was written by the editor-in-chief of Dr. Dobbs.

A theme that appears anytime the cloud is discussed in the context of IT is security. The general direction of this concern is the prevention of unauthorized access to cloud-hosted data and apps. If the topic is pursued, rather than just acknowledged as an issue, it generally forks into two main threads: preventing access by outside parties (hackers, crackers, protesters, and the like) and preventing access by inside parties, such as unauthorized employees.

Both issues are problems and in both cases the cloud platform vendors offer an assurance that is, at first blush, comforting. Namely, that providers deliver better security of the hosted data than most data centers can provide. The primary reason for this is that they have many full-time, dedicated resources watching security, monitoring threats, and enforcing access control. Moreover, the staff members know what to do in the event of a violation. It is true that this pool of expertise--especially at large cloud providers--is likely to significantly exceed the capabilities of most small-to-medium IT organizations and even some of the larger IT shops. And the few reports of any break-ins at cloud providers tend to support the view of good security.

What is not clear from the cloud providers' contention, however, is that there is a third possible source of access, which the providers will not protect against: Access by the provider itself either on its own initiative or at the request of government agencies. Let's look at these.

Cloud providers vary widely with respect to the access they grant themselves to your data. However, none forswears all access. Many of the companies, such as Dropbox, use encryption, but have a backdoor to decrypt anything they've encrypted. (To quote, "Dropbox cooperates with United States law enforcement when it receives valid legal process, which may require Dropbox to provide the contents of your private Dropbox. In these cases, Dropbox will remove Dropbox's encryption from the files before providing them to law enforcement.")

A reaction I see frequently to this common policy is, "If I'm doing nothing wrong, I shouldn't mind the scrutiny." This view is, of course, intensely naive. Even if you have done nothing wrong, the government agencies examining your files have no contractual obligation to you to keep them safe, nor even to get rid of all their copies once they've determined you're not guilty or that they pulled the wrong party's data. In other words, by a simple bureaucratic error of accessing the wrong account, government agencies can disseminate your information more or less freely.

Some hosts, such as Box.Net, do not even encrypt your data unless you purchase a plan that specifically includes encryption. Right now, that's only their most expensive plan, despite the company's advertisements that seem to imply all data is encrypted--it is not.

Earlier this week, Microsoft announced that foreign customers were not immune from similar provisions. Namely, that the U.S. Patriot Act forces it to provide access to any data hosted anywhere by a U.S. company--even if that data resides outside the United States.

This is a major concern. Two parties--the government and the cloud provider--have access to the data, even if it's encrypted. In the former case, the access is unfettered. The cloud provider will not defend your data on your behalf, but will turn over whatever is asked for by government request (no posted policy I've seen requires a subpoena). In the latter case, the access is nearly as unfettered. The provider is free to change the terms of their privacy policies at any time and your only choice is to remove your data--a possibly enormous cost if your infrastructure depends on the cloud application.

Read the rest of this article on Dr. Dobbs.

At the 2011 InformationWeek 500 Conference, C-level executives from leading global companies will gather to discuss how their organizations are turbo-charging business execution and growth--how their accelerated enterprises manage cash more effectively, invest more wisely, delight customers more consistently, manage risk more profitably. The conference will feature a range of keynote, panel, and workshop sessions. St. Regis Monarch Beach, Calif., Sept. 11-13. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11354
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.
CVE-2018-11355
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.
CVE-2018-11356
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.
CVE-2018-11357
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.
CVE-2018-11358
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.