Welcome!

Cloud Security Authors: Yeshim Deniz, Zakia Bouachraoui, Liz McMillan, Elizabeth White, Ravi Rajamiyer

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Agile Computing, Cloud Security, @DXWorldExpo

@CloudExpo: Blog Feed Post

Cloud Encryption: How to Choose an IaaS Encryption Solution

Instance managed encryption means the encryption keys are kept on the virtual disk

During the past month or so, Rich Mogull, analyst and CEO of securosis has published multiple blogs on cloud encryption best practices, specifically in infrastructure clouds. The final blog IaaS Encryption: How to Choose, provides a good opportunity for us to touch and expand on some of the volume storage cloud security points highlighted on Rich’s article:

“Always use external key management. Instance-managed encryption is only acceptable for test/development systems you know will never go into production”

Instance managed encryption means the encryption keys are kept on the virtual disk. In other words, anyone with access to your cloud instance, has access to your encryption keys – hence to your data. In addition, specific cloud operations, such as disk snapshots, will snapshot the encryption keys with it.

Cloud Security Cloud Key Management Cloud Encryption  clouds 250X188 Cloud Encryption: How to choose an IaaS encryption solution“For sensitive data in public cloud computing choose a system with protection for keys in volatile memory (RAM). Don’t use a cloud’s native encryption capabilities if you have any concern that a cloud administrator is a risk”

As I see it, there are two great points here, one relates to cloud security concerns, the second is interesting for compliance reasons. Protecting keys in RAM (the security concern) is actually not a simple thing to achieve.  We have worked extremely hard to create a mechanism which keeps the encryption keys encrypted themselves, even while in use in RAM.  To do so, we have used partially homomorphic encryption techniques (fancy name, I know…), a world first implementation of such technology to a cloud security product (you can read more about it here, or download the Porticor white paper for additional information). Now for the second point; using the IaaS provider’s native cloud encryption capabilities means there’s a risk that someone (an employee) within the cloud data center can potentially read your data. While an obvious security risk, this is also a compliance issue as certain regulations (for example PCI) mention separation of duties as a core compliance requirement.

“Pick a product designed to handle the more dynamic cloud computing environment. Specifically one with workflow for rapidly provisioning keys to cloud instances and API support for the cloud platform you use”

I couldn’t agree more. Traditional, “on-premise” encryption and key management systems are not built for the cloud. As a result, many of the cloud most significant advantages, such as scalability and flexibility might not function well (dare I say not function at all) with such encryption systems. A cloud encryption system should seamlessly integrate with your cloud design, and integrate with any automation process you have in place. An API is important as an integration point between your cloud systems and (for example) an orchestration system.  In such scenario you can automate encryption together with the rest of the IaaS system, spin up new or down new encrypted disks, encrypt S3 objects, and even automatically feed encryption keys to specific SaaS applications (I will discuss cloud encryption keys security and split-key encryption in one of my next blogs).

Ariel Dan is co-founder at Porticor Cloud Security.

The post Cloud Encryption: How to choose an IaaS encryption solution appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

IoT & Smart Cities Stories
"MobiDev is a Ukraine-based software development company. We do mobile development, and we're specialists in that. But we do full stack software development for entrepreneurs, for emerging companies, and for enterprise ventures," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Cloud computing delivers on-demand resources that provide businesses with flexibility and cost-savings. The challenge in moving workloads to the cloud has been the cost and complexity of ensuring the initial and ongoing security and regulatory (PCI, HIPAA, FFIEC) compliance across private and public clouds. Manual security compliance is slow, prone to human error, and represents over 50% of the cost of managing cloud applications. Determining how to automate cloud security compliance is critical...
Enterprises have taken advantage of IoT to achieve important revenue and cost advantages. What is less apparent is how incumbent enterprises operating at scale have, following success with IoT, built analytic, operations management and software development capabilities - ranging from autonomous vehicles to manageable robotics installations. They have embraced these capabilities as if they were Silicon Valley startups.
Recently, REAN Cloud built a digital concierge for a North Carolina hospital that had observed that most patient call button questions were repetitive. In addition, the paper-based process used to measure patient health metrics was laborious, not in real-time and sometimes error-prone. In their session at 21st Cloud Expo, Sean Finnerty, Executive Director, Practice Lead, Health Care & Life Science at REAN Cloud, and Dr. S.P.T. Krishnan, Principal Architect at REAN Cloud, discussed how they built...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the...
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
Machine learning has taken residence at our cities' cores and now we can finally have "smart cities." Cities are a collection of buildings made to provide the structure and safety necessary for people to function, create and survive. Buildings are a pool of ever-changing performance data from large automated systems such as heating and cooling to the people that live and work within them. Through machine learning, buildings can optimize performance, reduce costs, and improve occupant comfort by ...
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
JETRO showcased Japan Digital Transformation Pavilion at SYS-CON's 21st International Cloud Expo® at the Santa Clara Convention Center in Santa Clara, CA. The Japan External Trade Organization (JETRO) is a non-profit organization that provides business support services to companies expanding to Japan. With the support of JETRO's dedicated staff, clients can incorporate their business; receive visa, immigration, and HR support; find dedicated office space; identify local government subsidies; get...