Cloud Encryption and Key Management Considerations
Post on 22-Feb-2016
68 Views
Preview:
DESCRIPTION
Transcript
Cloud Encryption and KeyManagement Considerations
Daniel CuschieriInformation Security Distance Learning Weekend Conference August 2013
What is the Cloud?An evolving term Many existing technologies and approaches to computing combined into something differentStoring your data on someone else’s computer and accessing it via a network (Bruce Schneier)A collection of services, applications, information, and infrastructure comprised of pools of compute, network, information, and storage resources that can be acquired or released as necessary (Cloud Security Alliance, 2009)
Types of Clouds
(NIST, 2009)
The Cloud’s Benefits…Cost savingsImproved flexibility Better scalabilityMore focus on the core businessHigher availabilityDevice independence
… And It’s Concerns
(KPMG Netherlands, 2010)
Risk Assessment: CC-RAM
Generic security threats applyConfidentiality, Integrity and Availability
Virtually unlimited Cloud compute power Vulnerability of Cloud management interfaces Malicious Cloud provider insiders A shared Cloud infrastructureLittle direct control over data Insufficient forensic and auditing informationAn unknown risk profile
Cloud Threats
Encryption as a Countermeasure
DataCloud managementForensics Malicious Cloud provider insiders ComplianceUnknown risk profile
Where to Encrypt Data
Data at rest, in transit or in use
(Ponemon Institute, 2012)
How to Encryption Data
In SaaSConsumer encryption before data transmittalProvider encryption after data transmittalThird party encryption during data transmittal
In PaaSApplication-level encryptionInfrastructure-level encryption
In IaaSApplication-level encryptionVolume-based encryption
Challenges of Cloud Encryption
Encryption policies Availability of encrypted data Integrity of encrypted data Encryption client security Compliance with legislation and standards
Desirable Encryption Functionality
Processing encrypted data Sorting encrypted data Searching encrypted data Encryption interoperability
Challenges of Key Management
Key generation and storage Key availability Key disposal and expiration Key management policy Separation of duties Key management interoperability
The Future of Cloud Security
Cloud security is an issue, but measures such as encryption can address these concernsThese measures are constantly improving Security will soon change from being a Cloud inhibitor to being one of the key enablers of Cloud adoption (Penn, 2010)
The Future of Cloud Security
Questions?
Thank youDaniel Cuschieridanielcuschieri@gmail.com
top related