Companies Push to Decode Cloud Encryption

Businesses buckle down on encryption as it becomes table stakes for securing data in the cloud.

Encryption has become less of a nice-to-have and more of a must-have as companies determine how to best protect their cloud-based data. Cloud providers are taking note and integrating encryption to stay competitive among security-savvy customers.
In the past, businesses have put off encryption because it took up a lot of time and resources, explains Marty Puranik, CEO at Atlantic.net. Now, as breaches regularly make headlines, more are buckling down on data security and providers are adjusting their services to help. In industries like healthcare, leaving data unencrypted isnt an option.
There are lots of compromises in the news and companies dont want to have that happen, he explains. A lot of best practices are actually becoming requirements as the industry matures and standards form.
How providers are simplifying encryption
Cloud providers large and small are buckling down on security to win customers trust, Lane says. They need to make sure theyre secure because nobody trusts cloud vendors at first, he explains. A way to differentiate their service is to be more secure than on-prem.
Microsoft recently updated its service with Azure confidential computing. This will encrypt data in use in the public cloud, which has so far lacked this level of security. People can maintain control over their data while its processed in the cloud, protecting it from threats like malicious insiders with administrative privilege, or third parties accessing it without their consent.
It makes sense in the broader context of Microsofts approach to security, which Prendergast describes as hardened by default. If users want to make information accessible to others, they have to open it themselves. The idea is to give people a more secure cloud environment by default so they dont have to figure it out themselves.
Amazon is different, he continues. The company provides encryption and management tools, but the customer has to be able to properly implement and run them. Its easy for someone to start playing with a project that spreads into production, bringing data into an unsecure place -- an issue he says contributed to the AWS data leaks in recent news.
The encryption trend isnt only popular among tech giants. Cloud companies like Atlantic.Net and Fortanix have also begun to jump on the encryption trend. The former recently began encrypting all user data by default; the latter encrypts data while applications are using it.
Encryption challenges and mistakes
Several factors have hampered the growth of encryption, says Adrian Lane, CTO and analyst at Securosis. For starters, its expensive. Security teams struggle to justify technologies that arent directly tied to revenue and provide more benefit in the short term than the long term.
Over the years, cost justification was the biggest impediment, he explains. Businesses didnt see a big enough risk to procure and pay for encryption.
Some held back because they feared they would lose their encryption key and as a result, lose all of their data. Complexity proved another obstacle; businesses could easily encrypt their databases but didnt know how to leverage decryption for file access.
There is overhead, and it is more work, says Puranik. If [encryption] wasnt something required in the past, people didnt do it. Now it has become more common.
This isnt to say security teams dont make mistakes when they encrypt their data. One major error Lane frequently sees is the use of application encryption, especially with older legacy applications.
If you want to be the most secure, you implement [encryption] within an application so the app itself manages its own keys, can determine which users and which circumstances can see decrypted data, and decrypt the data itself, Lane says. Its the most secure use case itself, but implementing that into the application is really hard.
Some businesses neglect to encrypt data at rest, which Evident.io CEO Tim Prendergast describes as a severe oversight.
Theres no excuse not to encrypt data at rest, he notes. It doesnt make any sense unless you just dont care about the data … and some people dont. This mistake has led to data compromise at major companies including Viacom and Fedex.
The issue of bring your own key (BYOK) is also critical, Lane adds. Many companies use multiple clouds and as more turn to different cloud providers, it will be important to use a consistent multicloud key management approach so they can use their keys for various providers.
If you dont trust the vendor or think a malicious actor could access keys, you might want to do BYOK, he says. In some cases, you may not even want to leverage native cloud key services at all.
The case for encrypting everything
When businesses decide which data gets encrypted, they prioritize sensitive data like personal financial records and health information. While this arguably makes sense, whats considered important data varies from person to person.
What doesnt get encrypted? Puranik points to metadata; for example, customer logs containing information on the websites they visit and options they prefer. This data is often kept on the back burner, unencrypted, and many businesses dont realize its value to attackers.
He points to social media, which is a treasure trove of data that may seem harmless in small chunks but when pieced together, can paint an accurate picture of someones life. While he abstains from Facebook and LinkedIn, Puranik explains how both networks can generate data on him based on account holders who ask him to join.
Is that data relevant? Well Its not a Social Security Number or drivers license, but in a way, its a digital fingerprint, he says. An attacker could use this data to, for example, launch a targeted phishing attack by sending a fraudulent email and claim to know one of his contacts.
Consumers and end users want everyone to encrypt everything, explains Prendergast. While the operational cost used to make companies say well do that later, now, they have no excuse.
Its table stakes, he says.
Related Content:
Cybercrime Costs Each Business $11.7M Per Year
Chevrons Jump to the Cloud is a Journey
Popular Mobile Trading Apps Riddled With Vulnerabilities, Security Firm Warns
7 SIEM Situations That Can Sack Security Teams
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security	▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security	▸ Homeland Security Background Checks Breach Raises Concerns. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Companies Push to Decode Cloud Encryption