The dichotomy between cloud computing and security is readily apparent; for years, security was touted as one of the caveats of utilizing the cloud.
Depending on who you talk to, it still is.
On the one hand, there are those who cite the security benefits of the cloud, and those of public cloud providers in particular. Proponents claim it’s difficult to match the security spending of major public cloud hosts such as AWS or Azure, and that hackers would still have to find an organization’s data in those clouds even if they managed to penetrate their security.
“It might be true that the cloud can have better security at a firewall level, at an access level, than an under-resourced small business,” acknowledged Scram Software CEO Linus Chang.
On the other hand, the number of egregious instances of data breach occurring in the cloud in the past several years indicates that this architecture is far from impenetrable. “Where I get a little bit uneasy in seeing the data practices that go on is when people abdicate their responsibility [to protect their data] because they think the cloud is secure and is a panacea,” Chang commented.
If any remedy for safeguarding information assets in the cloud exists, it pertains to encryption. Less than five percent of recent data breaches have involved encryption; most instances of data loss are caused by user mistakes.
By properly encrypting data prior to replicating them to the cloud, users can minimize both instances and truly fortify their data in the cloud.
False Cloud Security
Perhaps the two most surprising facets of solidifying cloud security with encryption are the traditional difficulty associated with doing so and the proper means of implementation. Of the two, the latter is far less known. There are two dominant paradigms for encrypting data in the cloud: server side encryption and client side encryption. Server side encryption typically involves the cloud provider encrypting the data and holding the keys to the encoded information to unlock those data. All users do is transmit their data via plaintext. The fundamental flaw with this approach is, “If a hacker breaks in or they steal your credentials, which often happens through phishing attacks, the cloud will decrypt your data and hand it over to the hacker, which completely defeats the purpose of doing encryption,” Chang maintained. Social engineering and other deceptive means can also procure organization’s cloud credentials. Worse, server side encryption can give users a false sense of security, prompting them to store even more sensitive information in the cloud via this model.
Secure Cloud Encryption
A far more reliable method for encrypting cloud data is to leverage client side encryption. With this approach users encrypt data themselves, are the sole holders of the keys, and replicate encrypted data (as opposed to that in plaintext) to cloud providers. The advantages to employing encryption in this fashion are manifold. Users now have encryption at both ends for complete protection in the cloud. Moreover, they help to facilitate a decentralized cloud model by retaining responsibility for securing their data themselves. With client side encryption, “In terms of decentralization, it’s not just one cloud provider that has the responsibility,” Chang said. “We all have the responsibility of knowing what we’re purchasing with the cloud service. And also, in terms of client side encryption, we have the opportunity to each take back control of our data.”
Client side encryption has become increasingly feasible because of advancements in encryption platforms addressing the conventional difficulties of encryption: the multiplicity of data sources involved, the scattering of data outside and within the enterprise, and the paucity of technical knowledge necessary for efficient implementation. Employing client side encryption also enables organizations to leverage more sophisticated security measures as needed, such as tokenization or masking, to better manage their security.
The necessity to encrypt data will likely increase in the near future. Many of the concerns for encrypting data in the cloud are associated with external security threats. However, encryption may soon be just as necessary for internal use as well. The influx of regulatory compliance measures is one of the most salient drivers for encrypting data within organization’s firewalls, although it’s just as applicable to cloud data too. The General Data Protection Regulation and other domestic regulations have stiff mandates about what data are available, how, and where, making encryption a viable solution for the enterprise. Additionally, instances of insider jobs (such as those in the Paradise Papers and the Panama Papers) also provide cogent examples for encrypting data internally.
But, as Change wryly observed, “For something like HIPAA compliance, they say you shall encrypt. They don’t say how. So it is actually possible to satisfy HIPAA and not really have proper security at all.” But by assuming the onus of protecting data with enterprise encryption methods, as opposed to solely relying on cloud-based security methods, organizations can access the cloud’s many benefits while mitigating its fundamental challenges. “Breaches are happening all the time,” Chang said. “We can’t rely on people to do the right thing. People will make mistakes. Therefore, encryption as a system enables people to safeguard the data in a way that kind of overcomes people’s mistakes.”