Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

2/10/2015
12:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Box Giving Customers Control Over Encryption Keys

Box says they've eliminated the last major barrier to cloud adoption, even in highly regulated organizations.

Box, a leading provider of cloud storage and collaboration services, today announced new technology they say will eliminate the final major barrier to cloud adoption. The new solution, Box Encryption Key Management (EKM), gives Box customers the ability to manage, create, and revoke their own encryption keys.

"EKM helps break into more heavily regulated areas," says Box's vice-president of enterprise product, Rand Wacker.

One of the major reasons organizations -- particularly those that are risk-averse or in highly regulated industries -- avoid cloud adoption is that, in the cloud, they share servers with strangers. Although each tenant has always been in its own virtual instance, segregated from other customers', some organizations were rightly wary.

If attackers could break out of one customer's virtual instance and access the cloud providers' hardware, they might break into all other virtual machines on that hardware, through the back door. And if an attacker broke into wherever a cloud service company stored all of its encryption keys, that would be even worse.

These things, among others, complicate matters for organizations that have to comply with privacy and security regulations.

EKM might end that particular quarrel, and give Box customers better single-tenant control. It gives customers the authority to manage their own hardware security module, create and revoke their own encryption keys, and maintain up-to-date logs.

Wacker says that Box was determined to provide better security without damaging the user experience. This led them to decide that they needed a solution bespoke to Box -- something built in, not bolted on.

Box has already partnered with Amazon and SafeNet to roll out EKM first. The technology is currently in beta, and will be generally available this spring.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Pablo Valerio
100%
0%
Pablo Valerio,
User Rank: Strategist
2/10/2015 | 12:23:02 PM
Zero-Knowledge??
Sara, is Box joining a Zero-Knowledge approach with Encryption Key Management? or just providing customers a Key management tool?
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29043
PUBLISHED: 2021-05-17
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle a...
CVE-2021-29044
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary we...
CVE-2021-29045
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPor...
CVE-2021-29046
PUBLISHED: 2021-05-17
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortl...
CVE-2021-29053
PUBLISHED: 2021-05-17
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.