Box Giving Customers Control Over Encryption Keys

Box says they've eliminated the last major barrier to cloud adoption, even in highly regulated organizations.

Sara Peters, Senior Editor

February 10, 2015

1 Min Read

Box, a leading provider of cloud storage and collaboration services, today announced new technology they say will eliminate the final major barrier to cloud adoption. The new solution, Box Encryption Key Management (EKM), gives Box customers the ability to manage, create, and revoke their own encryption keys.

"EKM helps break into more heavily regulated areas," says Box's vice-president of enterprise product, Rand Wacker.

One of the major reasons organizations -- particularly those that are risk-averse or in highly regulated industries -- avoid cloud adoption is that, in the cloud, they share servers with strangers. Although each tenant has always been in its own virtual instance, segregated from other customers', some organizations were rightly wary.

If attackers could break out of one customer's virtual instance and access the cloud providers' hardware, they might break into all other virtual machines on that hardware, through the back door. And if an attacker broke into wherever a cloud service company stored all of its encryption keys, that would be even worse.

These things, among others, complicate matters for organizations that have to comply with privacy and security regulations.

EKM might end that particular quarrel, and give Box customers better single-tenant control. It gives customers the authority to manage their own hardware security module, create and revoke their own encryption keys, and maintain up-to-date logs.

Wacker says that Box was determined to provide better security without damaging the user experience. This led them to decide that they needed a solution bespoke to Box -- something built in, not bolted on.

Box has already partnered with Amazon and SafeNet to roll out EKM first. The technology is currently in beta, and will be generally available this spring.

About the Author(s)

Sara Peters

Senior Editor

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law -- a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights