Many organisations are nowadays looking on how to take advantage of cloud computing, but security of their data remains a serious concern. However, there are several mechanisms which can help you in encrypting your data in cloud and ensure there is effective data protection.
As organisations grow in size, they experience security challenges which they lack knowledge and experience to handle. Although most IT experts conclude that encryption of cloud data is the key to security, the approach can be daunting, and especially for small to mid-sized businesses. The process of managing encryption keys in a cloud environment is not easy. The encryption key should be kept separate from the encrypted data, and this is a challenge, especially in a cloud environment with an asymmetrical growth.
Encryption keys should be stored in a separate storage block or server. To stay protected against disasters, the encryption keys should be backed up in offline storage. The backup needs to be audited on a regularly basis, probably each month to ensure that it is free from corruption. Although some of the keys will expire automatically, others need to be refreshed, thus, calling for the need for a refresh schedule. For improved security, the key themselves should be encrypted, while the master and recovery keys should be given a multi-factor authentication.
It is good for any organisation to let a third party manage the encryption keys rather than the IT department of the organisation. If you encrypt the data before uploading it to your cloud storage provider, and then it happens that the same data is needed on a remote or mobile device having no decryption keys, the downloaded data will be useless. In case the company is in need of sharing the data with their business partner, and they don’t need the partner to access the decryption keys directly, this will become complex.
The following are some of the criteria which can be used for encrypting data in the cloud:
You have to determine the percentage of your organisation data which is considered as being sensitive. You will find that majority of your organisation data does not need to be encrypted. With a ubiquitous encryption, the functionality of the application can be interrupted, most probably the search and report functionality, and these are very important in the today’s cloud model. A discretionary approach to encryption should ensure that the sensitive data has been secured without interference with the advantages associated with emerging technologies.
Adherence to security policy of the corporate
The security policy for your organisation can help you determine the sensitive information in the environment and then make use of the strategy to create a strategy for the encryption strategy. Both the internal and external regulations in relation to the business have to be considered.
Once you have agreed on what needs to be encrypted, an action should be taken. Security technologies should be leveraged for identification of sensitive information in the corporate, and the encryption should be used as a remediation tool for risky situations. Once this process has been automated, inappropriate exposure of data will have been mitigated in a content-aware manner.
Consider the human element
Any data security mechanisms must consider the needs of the end users. If the security program of the corporate interferes with the normal workflow of the users, they will have to seek for alternatives to bypass the corporate network entirely.
Cloud providers and their potential SaaS partners should be asked about the protocol they use when transmitting their data. The SSL (Secure Socket Layer) protocol is now not the best since the discovery of a man-in-the-middle attack discovered in 2014. This can only be solved by implementation of TLS rather than the SSL, but the problem comes in that systems running older operating systems such as Windows XP are not able to implement the TLS. This has made some businesses to continue using SSL despite the risk it poses of exposing confidential data. The main solution to this problem is disabling the SSL completely, either on the server or client side, but this will make it inaccessible by systems which rely only on SSL.