At Infosecurity Europe earlier this week, I presented some high level findings of this year’s Encryption in the Cloud report. We have run this report for 10 years with the Ponemon institute, though the findings are perhaps particularly interesting and timely this year, with data protection and encryption in particular, right at the top of the global news agenda. Although the word ‘encryption’ can send some people running for the hills, the fact is that this rather elegant use of some pretty sophisticated mathematics underpins the notion of trust in today’s digital world.
Over the years, we have seen a dramatic expansion in the degree to which organisations are deploying encryption, often as part of a data-centric, enterprise wide strategy. Its use spans everything from encrypting data in databases and file systems, in storage networks, on back-up tapes, and while being transferred over a public and internal networks. Although this might seem that we’re are moving in the right direction when it comes to enterprise data protection there’s a real risk that we create fragmentation and inconsistency – encryption sprawl – as different organisations deploy the diverse technologies in different places, to secure different types of data. Now, to make matters worse, we have the cloud to consider with its own unique threats and challenges. With an undeniable value proposition, it seems clear that the cloud is inevitable and protecting data within it will be a top priority.
According the report we launched at the event, the number of businesses who admit to sending sensitive or confidential data to the cloud is perhaps surprisingly high – now over 50% and increasing every year. Only 11% of respondents say that their organisation has no plans to use the cloud for sensitive operations, down from 19% just two years ago. In response to this, it’s good to see that use of encryption to protect that sensitive data in the cloud is also increasing, but it’s pretty concerning that over half of those respondents that store sensitive data in the cloud report that their data is ‘cleartext’, and therefore readable by anyone that can get their hands on it.
When it comes to deciding where and how to apply encryption in the cloud there’s still a variety of opinions. The report shows an almost equal split between those that encrypt data before it is sent to the cloud and those that choose to apply encryption directly within the cloud. Regardless of approach, key management remains a pain point, as businesses tread the line between trust and control between their own organisation and the cloud provider.
This is significant if you consider that key management lies at the heart of an effective encryption strategy. Although many regard encryption itself as being black and white – data is either encrypted or not – the reality is that there is such a thing as good or bad encryption. Much of the variance comes down to implementation and key management – a point that became crystal clear with the recent ‘Heartbleed’ vulnerability in OpenSSL. With this in mind, we were pleased to see that 34% of respondents report that their own organisation is in control of encryption keys when data is encrypted in the cloud. Only 18% of respondents report that the cloud provider has full control over keys.
This second approach is a risky strategy. If the encryption keys are owned by the cloud provider, how do you know they’re safe? If someone shows up with a lawsuit or subpoena, will the cloud provider release these keys without your knowledge? From a criminal’s perspective, stealing keys is far more interesting than stealing data. Stealing data is the modern equivalent of stealing money, yet stealing keys is like stealing the machine that makes the money – an attack that keeps on giving, or to be more accurate, an attack that keeps on taking!
Confidence in the cloud depends on understanding your data. What is it? Where does it need to be protected? What’s the impact of it being compromised? And therefore what level of protection does it require? Failure to understand your organisation's requirements is to put valuable business assets at risk. Only you know what your data is worth – encrypt what you care about, keep hold of the keys, and keep control.