Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/21/2012
07:14 PM
50%
50%

Protecting Data In The Cloud Without Making It Unusable

Encrypting data in the cloud is an important security step, but without the proper handling, it can make processing the data -- from searching to number crunching -- much more difficult

Encryption in the cloud is about preventing outside hackers and external partners -- even the cloud provider themselves -- from accessing a company's private data. However, companies tend to shy away from scrambling their data because, in the past, making the data unreadable to others also disrupted the business.

With encryption, usability is usually the quality that companies have to sacrifice. Employees either have to use special tools to access the data or lose the ability to perform necessary business operations without downloading and decrypting significant portions of the data set.

"The thinking has been that encryption messes with your data -- you can't do operations on it -- and key management is very hard," says Pravin Kothari, founder and CEO of cloud-security firm CipherCloud.

As security firms start to create technologies to secure data in the cloud, they have addressed businesses' primary concern: Not how much security the technology will provide, but whether it will get in the way. While companies have sought out encryption solutions to increase security, meet compliance obligations, and abide by national data residency requirements, many balked because most encryption experts never really thought about usability, says Terence Spies, chief technology officer of Voltage Security.

"People in the crypto world tend to get obsessed with how many bits of protection, but what became evident is that usability and the ability to work with existing business processes is the major determining factor in how much adoption you are going to get," Spies says.

Take a simple property like the storage allocated for data in a database field. Encryption typically expands a piece of text -- or plaintext -- to a certain block size when it turns it into an encrypted format, or ciphertext. This can be a problem if the cloud application expects a relatively short string -- say, a last name -- to be only a score of characters. Typical encryption could make the string too long to fit in the allocated space.

To fix the problem with fitting ciphertext into limited database fields, companies such as Voltage have designed format-preserving encryption that can turn plaintext of a maximum length into a string of ciphertext with the same number of digits. The transformation sacrifices no security, says Spies.

"You've taken a whole class of applications and made them able to operate without needing to get access to keys that would expose the entire data," he says.

Yet using format-preserving encryption does not solve a number of other problems. Encryption also breaks any sort of ordering, and encrypted numbers cannot be added, subtracted, or multiplied in any meaningful way.

[Encrypting data is one of the most basic -- and most effective -- data security measures we have at our disposal, but when used with relational databases, encryption creates two major problems. See A Look At Encrypted Query Processing.]

To support searching, sorting, and other operations requires the security gateway to perform some behind-the-scenes trickery that can, in some cases, reduce the security of the encryption, but in a predictable -- and acceptable -- way. CipherCloud, for example, allows businesses to leave some fields only partially encrypted to facilitate sorting and matching. In other cases, the cloud security provider imports indices and decrypts the data behind the company's firewall to allow for more advanced processing.

Cloud security-broker PerspecSys uses an on-premise system to act as an application gateway, keeping only necessary data to perform processing on the records.

"We are able to preserve that end user experience, with really strong encryption and tokenization techniques, and still provide the enterprise with really strong security," says Gerry Grealish, vice president of products for PerspecSys.

Grealish criticizes hybrid methods that sacrificed some security. "We did not head down that path because we felt that the trade-off between strong security and making your end user happy was not good," he says.

Researchers continue to work toward a goal of creating encryption systems that can retain their security while being operated on by special functions. Known as homomorphic encryption, such techniques are the Holy Grail of data security, allowing ciphertext to be added and multiplied in a way that returns valid plaintext results, says Voltage's Spies.

"There has been a number of breakthroughs in the past few years that show that it is possible," Spies says, while stressing that usable techniques are still a long way off.

While companies have to choose between reducing security to allow operations in the cloud or keeping some of the operations on-premise to retain control, homomorphic encryption could give them the best of both worlds.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
12/23/2012 | 2:46:31 PM
re: Protecting Data In The Cloud Without Making It Unusable
protecting IP could be the issue that resolves computer systems vulnerability to hacking

content owners may be storing their IP (music, video, books, games, programs etc) in the "Cloud" and then licensing users... by device

to make it work the device will have to be secured

while it is not possible to secure a device that is not in your physical possession it may be possible to detect tampering on a pretty reliable basis

and extension of UEFI could do this particularly if launched from a read-only source .
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13890
PUBLISHED: 2020-06-06
The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
CVE-2020-13889
PUBLISHED: 2020-06-06
showAlert() in the administration panel in Bludit 3.12.0 allows XSS.
CVE-2020-13881
PUBLISHED: 2020-06-06
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CVE-2020-13883
PUBLISHED: 2020-06-06
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.