Risk
12/21/2012
07:14 PM
Connect Directly
RSS
E-Mail
50%
50%

Protecting Data In The Cloud Without Making It Unusable

Encrypting data in the cloud is an important security step, but without the proper handling, it can make processing the data -- from searching to number crunching -- much more difficult

Encryption in the cloud is about preventing outside hackers and external partners -- even the cloud provider themselves -- from accessing a company's private data. However, companies tend to shy away from scrambling their data because, in the past, making the data unreadable to others also disrupted the business.

With encryption, usability is usually the quality that companies have to sacrifice. Employees either have to use special tools to access the data or lose the ability to perform necessary business operations without downloading and decrypting significant portions of the data set.

"The thinking has been that encryption messes with your data -- you can't do operations on it -- and key management is very hard," says Pravin Kothari, founder and CEO of cloud-security firm CipherCloud.

As security firms start to create technologies to secure data in the cloud, they have addressed businesses' primary concern: Not how much security the technology will provide, but whether it will get in the way. While companies have sought out encryption solutions to increase security, meet compliance obligations, and abide by national data residency requirements, many balked because most encryption experts never really thought about usability, says Terence Spies, chief technology officer of Voltage Security.

"People in the crypto world tend to get obsessed with how many bits of protection, but what became evident is that usability and the ability to work with existing business processes is the major determining factor in how much adoption you are going to get," Spies says.

Take a simple property like the storage allocated for data in a database field. Encryption typically expands a piece of text -- or plaintext -- to a certain block size when it turns it into an encrypted format, or ciphertext. This can be a problem if the cloud application expects a relatively short string -- say, a last name -- to be only a score of characters. Typical encryption could make the string too long to fit in the allocated space.

To fix the problem with fitting ciphertext into limited database fields, companies such as Voltage have designed format-preserving encryption that can turn plaintext of a maximum length into a string of ciphertext with the same number of digits. The transformation sacrifices no security, says Spies.

"You've taken a whole class of applications and made them able to operate without needing to get access to keys that would expose the entire data," he says.

Yet using format-preserving encryption does not solve a number of other problems. Encryption also breaks any sort of ordering, and encrypted numbers cannot be added, subtracted, or multiplied in any meaningful way.

[Encrypting data is one of the most basic -- and most effective -- data security measures we have at our disposal, but when used with relational databases, encryption creates two major problems. See A Look At Encrypted Query Processing.]

To support searching, sorting, and other operations requires the security gateway to perform some behind-the-scenes trickery that can, in some cases, reduce the security of the encryption, but in a predictable -- and acceptable -- way. CipherCloud, for example, allows businesses to leave some fields only partially encrypted to facilitate sorting and matching. In other cases, the cloud security provider imports indices and decrypts the data behind the company's firewall to allow for more advanced processing.

Cloud security-broker PerspecSys uses an on-premise system to act as an application gateway, keeping only necessary data to perform processing on the records.

"We are able to preserve that end user experience, with really strong encryption and tokenization techniques, and still provide the enterprise with really strong security," says Gerry Grealish, vice president of products for PerspecSys.

Grealish criticizes hybrid methods that sacrificed some security. "We did not head down that path because we felt that the trade-off between strong security and making your end user happy was not good," he says.

Researchers continue to work toward a goal of creating encryption systems that can retain their security while being operated on by special functions. Known as homomorphic encryption, such techniques are the Holy Grail of data security, allowing ciphertext to be added and multiplied in a way that returns valid plaintext results, says Voltage's Spies.

"There has been a number of breakthroughs in the past few years that show that it is possible," Spies says, while stressing that usable techniques are still a long way off.

While companies have to choose between reducing security to allow operations in the cloud or keeping some of the operations on-premise to retain control, homomorphic encryption could give them the best of both worlds.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
12/23/2012 | 2:46:31 PM
re: Protecting Data In The Cloud Without Making It Unusable
protecting IP could be the issue that resolves computer systems vulnerability to hacking

content owners may be storing their IP (music, video, books, games, programs etc) in the "Cloud" and then licensing users... by device

to make it work the device will have to be secured

while it is not possible to secure a device that is not in your physical possession it may be possible to detect tampering on a pretty reliable basis

and extension of UEFI could do this particularly if launched from a read-only source .
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0560
Published: 2014-09-17
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.

CVE-2014-0561
Published: 2014-09-17
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.

CVE-2014-0562
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

CVE-2014-0563
Published: 2014-09-17
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.

CVE-2014-0565
Published: 2014-09-17
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant