Companies Push to Decode Cloud Encryption

Encryption has become less of a nice-to-have and more of a must-have as companies determine how to best protect their cloud-based data. Cloud providers are taking note and integrating encryption to stay competitive among security-savvy customers.

In the past, businesses have put off encryption because it took up a lot of time and resources, explains Marty Puranik, CEO at Atlantic.net. Now, as breaches regularly make headlines, more are buckling down on data security and providers are adjusting their services to help. In industries like healthcare, leaving data unencrypted isn't an option.

"There are lots of compromises in the news and companies don't want to have that happen," he explains. "A lot of best practices are actually becoming requirements as the industry matures and standards form."

How providers are simplifying encryption

Cloud providers large and small are buckling down on security to win customers' trust, Lane says. "They need to make sure they're secure because nobody trusts cloud vendors at first," he explains. "A way to differentiate their service is to be more secure than on-prem."

Microsoft recently updated its service with Azure confidential computing. This will encrypt data in use in the public cloud, which has so far lacked this level of security. People can maintain control over their data while it's processed in the cloud, protecting it from threats like malicious insiders with administrative privilege, or third parties accessing it without their consent.

It makes sense in the broader context of Microsoft's approach to security, which Prendergast describes as "hardened by default." If users want to make information accessible to others, they have to open it themselves. The idea is to give people a more secure cloud environment by default so they don't have to figure it out themselves.

Amazon is different, he continues. The company provides encryption and management tools, but the customer has to be able to properly implement and run them. It's easy for someone to start playing with a project that spreads into production, bringing data into an unsecure place -- an issue he says contributed to the AWS data leaks in recent news.

The encryption trend isn't only popular among tech giants. Cloud companies like Atlantic.Net and Fortanix have also begun to jump on the encryption trend. The former recently began encrypting all user data by default; the latter encrypts data while applications are using it.

Encryption challenges and mistakes

Several factors have hampered the growth of encryption, says Adrian Lane, CTO and analyst at Securosis. For starters, it's expensive. Security teams struggle to justify technologies that aren't directly tied to revenue and provide more benefit in the short term than the long term.

"Over the years, cost justification was the biggest impediment," he explains. "Businesses didn't see a big enough risk to procure and pay for encryption."

Some held back because they feared they would lose their encryption key and as a result, lose all of their data. Complexity proved another obstacle; businesses could easily encrypt their databases but didn't know how to leverage decryption for file access.

"There is overhead, and it is more work," says Puranik. "If [encryption] wasn't something required in the past, people didn't do it. Now it has become more common."

This isn't to say security teams don't make mistakes when they encrypt their data. One major error Lane frequently sees is the use of application encryption, especially with older legacy applications.

"If you want to be the most secure, you implement [encryption] within an application so the app itself manages its own keys, can determine which users and which circumstances can see decrypted data, and decrypt the data itself," Lane says. "It's the most secure use case itself, but implementing that into the application is really hard."

Some businesses neglect to encrypt data at rest, which Evident.io CEO Tim Prendergast describes as a severe oversight.

"There's no excuse not to encrypt data at rest," he notes. "It doesn't make any sense unless you just don't care about the data … and some people don't." This mistake has led to data compromise at major companies including Viacom and Fedex.

The issue of bring your own key (BYOK) is also critical, Lane adds. Many companies use multiple clouds and as more turn to different cloud providers, it will be important to use a consistent multicloud key management approach so they can use their keys for various providers.

If you don't trust the vendor or think a malicious actor could access keys, you might want to do BYOK, he says. In some cases, you may not even want to leverage native cloud key services at all.

The case for encrypting everything

When businesses decide which data gets encrypted, they prioritize sensitive data like personal financial records and health information. While this arguably makes sense, what's considered "important" data varies from person to person.

What doesn't get encrypted? Puranik points to metadata; for example, customer logs containing information on the websites they visit and options they prefer. This data is often kept on the back burner, unencrypted, and many businesses don't realize its value to attackers.

He points to social media, which is a treasure trove of data that may seem harmless in small chunks but when pieced together, can paint an accurate picture of someone's life. While he abstains from Facebook and LinkedIn, Puranik explains how both networks can generate data on him based on account holders who ask him to join.

"Is that data relevant? Well It's not a Social Security Number or driver's license, but in a way, it's a digital fingerprint," he says. An attacker could use this data to, for example, launch a targeted phishing attack by sending a fraudulent email and claim to know one of his contacts.

Consumers and end users want everyone to encrypt everything, explains Prendergast. While the operational cost used to make companies say "we'll do that later," now, they have no excuse.

"It's table stakes," he says.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.