Page 100 - October 2022 Issue 611 Part 1

É`«Lƒ`dƒ`æμJ
The challenge of shared responsibility in the cloud – Whose keys are they, anyway?
by Sebastien Pavie, Regional Director for Data Protection at Thales
Key management – the processing, manage-
ment and storage of keys for who can
decrypt and access protected information – is an
often-overlooked, and yet critical element of
encryption. Many organisations left that part up to
their vendors or stored them inconsistently across
their IT infrastructure in both hardware and soft-
ware. This lack of centralized control can jeopar-
dize the integrity of encryption. In fact, the man-
agement of the keys is more important than the
encryption itself, because if something happens
to the keys, entire sets of data can be stolen or
lost, and there’s nothing you can do about it.
The fact that major cloud heavyweights are diving
into this technology is a sign that key manage-
ment is being taken more seriously. And rightly
so. The ability to demonstrate control of data is
critical to meeting compliance mandates. But how
do you really own your data if you do not have total control and ownership
of the keys?
With every passing day, an increasing number of organisations are migrat-
ing their sensitive data and business applications to the cloud for opera-
tional flexibilities, cost efficiencies and quick scalability. To avoid vendor
lock-in on a single cloud service provider (CSP), like Microsoft Azure,
AWS, Oracle Cloud, and IBM Cloud, many organisations are opting to
work with multiple CSPs in a multi-cloud environment.
As an increasing amount of critical data gets stored in the cloud, the
prospect of cyber-attacks and data breaches rises exponentially. While
most CSPs offer native data protection features, the “Shared
Responsibility Model” dictates that the ultimate onus of safeguarding busi-
ness and customers’ sensitive data rests with organisations. While there
is a shared responsibility to secure data in the cloud, there is no shared
liability and the impact of potential security incidents jeopardising sensitive scriptions, organisations are forced to implement labour-intensive, error-
data remains the responsibility of the company and it is the company’s
responsibility to ensure compliance with the relevant privacy regulations
such as the GDPR, the Schrems II ruling, PCI-DSS, HIPAA or CCPA.
While organisations are increasingly investing in perimeter security mech-
anisms, they fail to adequately invest in encryption technologies that act
as the critical line of defence in the event of a cyber-attack. This is evident Lack of proper security and key management practices in a multi-cloud
through the ever-increasing incidents of sophisticated cyber-attacks that
result in data breaches costing organisations billions in losses.
To minimise the impact of potential security incidents and to optimise sen-
sitive data protection, security and privacy regulations like GDPR, PCI-
DSS, HIPAA or CCPA mandate the adoption of encryption.
However, merely encrypting sensitive data in the cloud is not sufficient.
The Cloud Security Alliance recommends as an industry best practice for
storing information in the cloud to put the customer in control of both the
key management and the encryption process. Effectively managing the
key lifecycle and being crypto-agile is paramount for establishing trust in
the confidentiality, integrity, and availability of your data.
To that extent, the EU Cybersecurity Agency (ENISA) points out that
client-side encryption is the only way to provide the customer with true
control over their data, while mitigating the risk of an unauthorised access
by third parties. NIST SP 800-144 adds that organisations should be “in
control of the central keying material and configure the key management
components for cloud-based applications.”
2022 (ôHƒàcG) ∫h’G øjô°ûJ - 611 O~©dG - ájOÉ°üàb’G ¿É«ÑdG
Barriers to multi-cloud data protection
When it comes to cloud security and efficient key
management, there are a number of major pain
points organisations face today that prevent them
from taking full advantage of the potentials offered
by cloud platforms.
1. Lack of visibility into security and encryption
practices. With CSPs providing limited visibility
and access on encryption practices and
schemes, organisations’ risk management teams
are reluctant to allow the storage of sensitive and
mission critical data in the cloud due to high
impact in case of a data breach.
2. Meeting compliance requirements. Security
and privacy regulations mandate the use of state-
of-the-art practices for securing the confidentiality
and integrity of personal and sensitive data,
requiring agility and strong control over key man-
agement. Lack of such controls entail big regulatory penalties.
3. Managing encryption keys across multiple cloud environments.
Organisations are embracing multi-cloud strategies to avoid vendor lock-
in. The use of cloud-native encryption and key management solutions is a
barrier to multi-cloud adoption.
4. Custodianship of encryption keys. When organisations elect to use
cloud-native encryption services, the corresponding keys are being man-
aged by the providers. Not having direct control on the keys presents
potential risks and vulnerabilities in the case of a security or cryptograph-
ic incident.
5. Managing, monitoring, and deploying multiple cloud native security
tools. Since cloud-native key management services offer limited ability to
automate the lifecycle of encryption keys, especially across multiple sub-
prone manual key management processes to meet their security
requirements.
The right approach to cloud data protection
environment will only increase the organisation’s attack surface, with
cybercriminals eager to take advantage of it as they get smarter and more
sophisticated. Luckily, there are many industry best practices, such as
Bring Your Own Key (BYOK), Bring You Own Encryption (BYOE) and cen-
tralised and automated key lifecycle management that can optimise data
protection in the cloud.
With cloud providers being responsible for the security “of” the cloud, and
organisations having responsibility for the security of their data “in” the
cloud, every CISO should ask the five pertinent questions below:
1. How do I maintain strong security controls of my cloud assets?
2. Post-migration, what key management controls do I need?
3. How do I manage my personal and sensitive data risks?
4. How do I manage my audits?
5. How do I meet regulatory compliance?
Cloud security is important for your business prosperity. Thales’s multi-
cloud security solutions offer a cohesive answer to each of these
questions.
100