Cloud Encryption and KeyManagement Considerations

Daniel CuschieriInformation Security Distance Learning Weekend Conference August 2013

What is the Cloud?An evolving term Many existing technologies and approaches to computing combined into something differentStoring your data on someone else’s computer and accessing it via a network (Bruce Schneier)A collection of services, applications, information, and infrastructure comprised of pools of compute, network, information, and storage resources that can be acquired or released as necessary (Cloud Security Alliance, 2009)

Types of Clouds

(NIST, 2009)

The Cloud’s Benefits…Cost savingsImproved flexibility Better scalabilityMore focus on the core businessHigher availabilityDevice independence

… And It’s Concerns

(KPMG Netherlands, 2010)

Risk Assessment: CC-RAM

Generic security threats applyConfidentiality, Integrity and Availability

Virtually unlimited Cloud compute power Vulnerability of Cloud management interfaces Malicious Cloud provider insiders A shared Cloud infrastructureLittle direct control over data Insufficient forensic and auditing informationAn unknown risk profile

Cloud Threats

Encryption as a Countermeasure

DataCloud managementForensics Malicious Cloud provider insiders ComplianceUnknown risk profile

Where to Encrypt Data

Data at rest, in transit or in use

(Ponemon Institute, 2012)

How to Encryption Data

In SaaSConsumer encryption before data transmittalProvider encryption after data transmittalThird party encryption during data transmittal

In PaaSApplication-level encryptionInfrastructure-level encryption

In IaaSApplication-level encryptionVolume-based encryption

Challenges of Cloud Encryption

Encryption policies Availability of encrypted data Integrity of encrypted data Encryption client security Compliance with legislation and standards

Desirable Encryption Functionality

Processing encrypted data Sorting encrypted data Searching encrypted data Encryption interoperability

Challenges of Key Management

Key generation and storage Key availability Key disposal and expiration Key management policy Separation of duties Key management interoperability

The Future of Cloud Security

Cloud security is an issue, but measures such as encryption can address these concernsThese measures are constantly improving Security will soon change from being a Cloud inhibitor to being one of the key enablers of Cloud adoption (Penn, 2010)

The Future of Cloud Security

Questions?

Thank youDaniel Cuschieridanielcuschieri@gmail.com