Cloud

9/27/2017
06:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Companies Push to Decode Cloud Encryption

Businesses buckle down on encryption as it becomes table stakes for securing data in the cloud.

Encryption has become less of a nice-to-have and more of a must-have as companies determine how to best protect their cloud-based data. Cloud providers are taking note and integrating encryption to stay competitive among security-savvy customers.

In the past, businesses have put off encryption because it took up a lot of time and resources, explains Marty Puranik, CEO at Atlantic.net. Now, as breaches regularly make headlines, more are buckling down on data security and providers are adjusting their services to help. In industries like healthcare, leaving data unencrypted isn't an option.

"There are lots of compromises in the news and companies don't want to have that happen," he explains. "A lot of best practices are actually becoming requirements as the industry matures and standards form."

How providers are simplifying encryption

Cloud providers large and small are buckling down on security to win customers' trust, Lane says. "They need to make sure they're secure because nobody trusts cloud vendors at first," he explains. "A way to differentiate their service is to be more secure than on-prem."

Microsoft recently updated its service with Azure confidential computing. This will encrypt data in use in the public cloud, which has so far lacked this level of security. People can maintain control over their data while it's processed in the cloud, protecting it from threats like malicious insiders with administrative privilege, or third parties accessing it without their consent.

It makes sense in the broader context of Microsoft's approach to security, which Prendergast describes as "hardened by default." If users want to make information accessible to others, they have to open it themselves. The idea is to give people a more secure cloud environment by default so they don't have to figure it out themselves.

Amazon is different, he continues. The company provides encryption and management tools, but the customer has to be able to properly implement and run them. It's easy for someone to start playing with a project that spreads into production, bringing data into an unsecure place -- an issue he says contributed to the AWS data leaks in recent news.

The encryption trend isn't only popular among tech giants. Cloud companies like Atlantic.Net and Fortanix have also begun to jump on the encryption trend. The former recently began encrypting all user data by default; the latter encrypts data while applications are using it.

Encryption challenges and mistakes

Several factors have hampered the growth of encryption, says Adrian Lane, CTO and analyst at Securosis. For starters, it's expensive. Security teams struggle to justify technologies that aren't directly tied to revenue and provide more benefit in the short term than the long term.

"Over the years, cost justification was the biggest impediment," he explains. "Businesses didn't see a big enough risk to procure and pay for encryption."

Some held back because they feared they would lose their encryption key and as a result, lose all of their data. Complexity proved another obstacle; businesses could easily encrypt their databases but didn't know how to leverage decryption for file access.

"There is overhead, and it is more work," says Puranik. "If [encryption] wasn't something required in the past, people didn't do it. Now it has become more common."

This isn't to say security teams don't make mistakes when they encrypt their data. One major error Lane frequently sees is the use of application encryption, especially with older legacy applications.

"If you want to be the most secure, you implement [encryption] within an application so the app itself manages its own keys, can determine which users and which circumstances can see decrypted data, and decrypt the data itself," Lane says. "It's the most secure use case itself, but implementing that into the application is really hard."

Some businesses neglect to encrypt data at rest, which Evident.io CEO Tim Prendergast describes as a severe oversight.

"There's no excuse not to encrypt data at rest," he notes. "It doesn't make any sense unless you just don't care about the data … and some people don't." This mistake has led to data compromise at major companies including Viacom and Fedex.

The issue of bring your own key (BYOK) is also critical, Lane adds. Many companies use multiple clouds and as more turn to different cloud providers, it will be important to use a consistent multicloud key management approach so they can use their keys for various providers.

If you don't trust the vendor or think a malicious actor could access keys, you might want to do BYOK, he says. In some cases, you may not even want to leverage native cloud key services at all.

The case for encrypting everything

When businesses decide which data gets encrypted, they prioritize sensitive data like personal financial records and health information. While this arguably makes sense, what's considered "important" data varies from person to person.

What doesn't get encrypted? Puranik points to metadata; for example, customer logs containing information on the websites they visit and options they prefer. This data is often kept on the back burner, unencrypted, and many businesses don't realize its value to attackers.

He points to social media, which is a treasure trove of data that may seem harmless in small chunks but when pieced together, can paint an accurate picture of someone's life. While he abstains from Facebook and LinkedIn, Puranik explains how both networks can generate data on him based on account holders who ask him to join.

"Is that data relevant? Well It's not a Social Security Number or driver's license, but in a way, it's a digital fingerprint," he says. An attacker could use this data to, for example, launch a targeted phishing attack by sending a fraudulent email and claim to know one of his contacts.

Consumers and end users want everyone to encrypt everything, explains Prendergast. While the operational cost used to make companies say "we'll do that later," now, they have no excuse.

"It's table stakes," he says.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Symantec Intros USB Scanning Tool for ICS Operators
Jai Vijayan, Freelance writer,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10008
PUBLISHED: 2018-12-10
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended...
CVE-2018-10008
PUBLISHED: 2018-12-10
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace br...
CVE-2018-10008
PUBLISHED: 2018-12-10
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jen...
CVE-2018-10008
PUBLISHED: 2018-12-10
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVE-2018-10008
PUBLISHED: 2018-12-10
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy san...