Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/21/2012
07:14 PM
50%
50%

Protecting Data In The Cloud Without Making It Unusable

Encrypting data in the cloud is an important security step, but without the proper handling, it can make processing the data -- from searching to number crunching -- much more difficult

Encryption in the cloud is about preventing outside hackers and external partners -- even the cloud provider themselves -- from accessing a company's private data. However, companies tend to shy away from scrambling their data because, in the past, making the data unreadable to others also disrupted the business.

With encryption, usability is usually the quality that companies have to sacrifice. Employees either have to use special tools to access the data or lose the ability to perform necessary business operations without downloading and decrypting significant portions of the data set.

"The thinking has been that encryption messes with your data -- you can't do operations on it -- and key management is very hard," says Pravin Kothari, founder and CEO of cloud-security firm CipherCloud.

As security firms start to create technologies to secure data in the cloud, they have addressed businesses' primary concern: Not how much security the technology will provide, but whether it will get in the way. While companies have sought out encryption solutions to increase security, meet compliance obligations, and abide by national data residency requirements, many balked because most encryption experts never really thought about usability, says Terence Spies, chief technology officer of Voltage Security.

"People in the crypto world tend to get obsessed with how many bits of protection, but what became evident is that usability and the ability to work with existing business processes is the major determining factor in how much adoption you are going to get," Spies says.

Take a simple property like the storage allocated for data in a database field. Encryption typically expands a piece of text -- or plaintext -- to a certain block size when it turns it into an encrypted format, or ciphertext. This can be a problem if the cloud application expects a relatively short string -- say, a last name -- to be only a score of characters. Typical encryption could make the string too long to fit in the allocated space.

To fix the problem with fitting ciphertext into limited database fields, companies such as Voltage have designed format-preserving encryption that can turn plaintext of a maximum length into a string of ciphertext with the same number of digits. The transformation sacrifices no security, says Spies.

"You've taken a whole class of applications and made them able to operate without needing to get access to keys that would expose the entire data," he says.

Yet using format-preserving encryption does not solve a number of other problems. Encryption also breaks any sort of ordering, and encrypted numbers cannot be added, subtracted, or multiplied in any meaningful way.

[Encrypting data is one of the most basic -- and most effective -- data security measures we have at our disposal, but when used with relational databases, encryption creates two major problems. See A Look At Encrypted Query Processing.]

To support searching, sorting, and other operations requires the security gateway to perform some behind-the-scenes trickery that can, in some cases, reduce the security of the encryption, but in a predictable -- and acceptable -- way. CipherCloud, for example, allows businesses to leave some fields only partially encrypted to facilitate sorting and matching. In other cases, the cloud security provider imports indices and decrypts the data behind the company's firewall to allow for more advanced processing.

Cloud security-broker PerspecSys uses an on-premise system to act as an application gateway, keeping only necessary data to perform processing on the records.

"We are able to preserve that end user experience, with really strong encryption and tokenization techniques, and still provide the enterprise with really strong security," says Gerry Grealish, vice president of products for PerspecSys.

Grealish criticizes hybrid methods that sacrificed some security. "We did not head down that path because we felt that the trade-off between strong security and making your end user happy was not good," he says.

Researchers continue to work toward a goal of creating encryption systems that can retain their security while being operated on by special functions. Known as homomorphic encryption, such techniques are the Holy Grail of data security, allowing ciphertext to be added and multiplied in a way that returns valid plaintext results, says Voltage's Spies.

"There has been a number of breakthroughs in the past few years that show that it is possible," Spies says, while stressing that usable techniques are still a long way off.

While companies have to choose between reducing security to allow operations in the cloud or keeping some of the operations on-premise to retain control, homomorphic encryption could give them the best of both worlds.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
12/23/2012 | 2:46:31 PM
re: Protecting Data In The Cloud Without Making It Unusable
protecting IP could be the issue that resolves computer systems vulnerability to hacking

content owners may be storing their IP (music, video, books, games, programs etc) in the "Cloud" and then licensing users... by device

to make it work the device will have to be secured

while it is not possible to secure a device that is not in your physical possession it may be possible to detect tampering on a pretty reliable basis

and extension of UEFI could do this particularly if launched from a read-only source .
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...