Cloud Encryption and Key Management Considerations
description
Transcript of Cloud Encryption and Key Management Considerations
![Page 1: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/1.jpg)
Cloud Encryption and KeyManagement Considerations
Daniel CuschieriInformation Security Distance Learning Weekend Conference August 2013
![Page 2: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/2.jpg)
What is the Cloud?An evolving term Many existing technologies and approaches to computing combined into something differentStoring your data on someone else’s computer and accessing it via a network (Bruce Schneier)A collection of services, applications, information, and infrastructure comprised of pools of compute, network, information, and storage resources that can be acquired or released as necessary (Cloud Security Alliance, 2009)
![Page 3: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/3.jpg)
Types of Clouds
(NIST, 2009)
![Page 4: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/4.jpg)
The Cloud’s Benefits…Cost savingsImproved flexibility Better scalabilityMore focus on the core businessHigher availabilityDevice independence
![Page 5: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/5.jpg)
… And It’s Concerns
(KPMG Netherlands, 2010)
![Page 6: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/6.jpg)
Risk Assessment: CC-RAM
![Page 7: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/7.jpg)
Generic security threats applyConfidentiality, Integrity and Availability
Virtually unlimited Cloud compute power Vulnerability of Cloud management interfaces Malicious Cloud provider insiders A shared Cloud infrastructureLittle direct control over data Insufficient forensic and auditing informationAn unknown risk profile
Cloud Threats
![Page 8: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/8.jpg)
Encryption as a Countermeasure
DataCloud managementForensics Malicious Cloud provider insiders ComplianceUnknown risk profile
![Page 9: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/9.jpg)
Where to Encrypt Data
Data at rest, in transit or in use
(Ponemon Institute, 2012)
![Page 10: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/10.jpg)
How to Encryption Data
In SaaSConsumer encryption before data transmittalProvider encryption after data transmittalThird party encryption during data transmittal
In PaaSApplication-level encryptionInfrastructure-level encryption
In IaaSApplication-level encryptionVolume-based encryption
![Page 11: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/11.jpg)
Challenges of Cloud Encryption
Encryption policies Availability of encrypted data Integrity of encrypted data Encryption client security Compliance with legislation and standards
![Page 12: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/12.jpg)
Desirable Encryption Functionality
Processing encrypted data Sorting encrypted data Searching encrypted data Encryption interoperability
![Page 13: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/13.jpg)
Challenges of Key Management
Key generation and storage Key availability Key disposal and expiration Key management policy Separation of duties Key management interoperability
![Page 14: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/14.jpg)
The Future of Cloud Security
Cloud security is an issue, but measures such as encryption can address these concernsThese measures are constantly improving Security will soon change from being a Cloud inhibitor to being one of the key enablers of Cloud adoption (Penn, 2010)
![Page 15: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/15.jpg)
The Future of Cloud Security
![Page 16: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/16.jpg)
Questions?
![Page 17: Cloud Encryption and Key Management Considerations](https://reader035.fdocuments.us/reader035/viewer/2022081520/568161b7550346895dd18456/html5/thumbnails/17.jpg)
Thank youDaniel [email protected]