Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

2/10/2015
12:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Box Giving Customers Control Over Encryption Keys

Box says they've eliminated the last major barrier to cloud adoption, even in highly regulated organizations.

Box, a leading provider of cloud storage and collaboration services, today announced new technology they say will eliminate the final major barrier to cloud adoption. The new solution, Box Encryption Key Management (EKM), gives Box customers the ability to manage, create, and revoke their own encryption keys.

"EKM helps break into more heavily regulated areas," says Box's vice-president of enterprise product, Rand Wacker.

One of the major reasons organizations -- particularly those that are risk-averse or in highly regulated industries -- avoid cloud adoption is that, in the cloud, they share servers with strangers. Although each tenant has always been in its own virtual instance, segregated from other customers', some organizations were rightly wary.

If attackers could break out of one customer's virtual instance and access the cloud providers' hardware, they might break into all other virtual machines on that hardware, through the back door. And if an attacker broke into wherever a cloud service company stored all of its encryption keys, that would be even worse.

These things, among others, complicate matters for organizations that have to comply with privacy and security regulations.

EKM might end that particular quarrel, and give Box customers better single-tenant control. It gives customers the authority to manage their own hardware security module, create and revoke their own encryption keys, and maintain up-to-date logs.

Wacker says that Box was determined to provide better security without damaging the user experience. This led them to decide that they needed a solution bespoke to Box -- something built in, not bolted on.

Box has already partnered with Amazon and SafeNet to roll out EKM first. The technology is currently in beta, and will be generally available this spring.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pablo Valerio
100%
0%
Pablo Valerio,
User Rank: Strategist
2/10/2015 | 12:23:02 PM
Zero-Knowledge??
Sara, is Box joining a Zero-Knowledge approach with Encryption Key Management? or just providing customers a Key management tool?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/3/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10548
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10549
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10546
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10547
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-11094
PUBLISHED: 2020-06-04
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as ...