DATA SECURITY KNOWLEDGE BASE

A Definition of Cloud Encryption

Cloud storage providers offer cloud encryption services to encrypt data before it is transferred to the cloud for storage. Typical cloud encryption applications range from encrypted connections to limited encryption only of data that is known to be sensitive (such as account credentials) to end-to-end encryption of any data that is uploaded to the cloud. In these models, cloud storage providers encrypt data upon receipt, passing encryption keys to the customers so that data can be safely decrypted when needed.

Encryption is regarded as one of the most effective approaches to data security, scrambling the content of any system, database, or file in such a way that it’s impossible to decipher without a decryption key. By applying encryption and practicing secure encryption key management, companies can ensure that only authorized users have access to sensitive data. Even if lost, stolen, or accessed without authorization, encrypted data is unreadable and essentially meaningless without its key.

Cloud Encryption Challenges

One of the primary challenges associated with encryption as a whole is the simple fact that it’s underutilized, despite its proven effectiveness at bolstering data security. As more enterprises and SMBs demand greater security measures from cloud providers to improve compliance while maintaining efficiency, use is becoming more widespread.

Encryption drives costs for cloud storage providers (and ultimately their customers) due to the additional bandwidth required to encrypt data before it is transferred to the cloud. As a result, many providers limit their cloud encryption services while some cloud storage customers simply encrypt their own data on-premises before it is moved to the cloud. Some cloud customers will choose this approach regardless, as it can save costs while keeping the entire encryption process and all keys within their environment, transferring data to the cloud only after it has been encrypted.

Benefits of Cloud Encryption

The key benefit of cloud encryption is the same as in any application of encryption: encrypted data is only readable for authorized parties with access to the decryption keys. Encrypting data ensures that even if that data falls into the wrong hands, it is useless as long as its keys remain secure. This is especially beneficial when data is being stored in the cloud, as it protects data contents in the event that a provider, account, or system is compromised.

Cloud encryption is also important for industries that need to meet regulatory compliance requirements. Encryption, when combined with other security measures, enables enterprises to meet the stringent compliance requirements of HIPAA (for healthcare organizations and business associates), PCI DSS (for e-commerce and retail organizations), and SOX (for financial reporting).

Any organization within these industries that has adopted the cloud must be prepared to meet the security challenges that come with using cloud storage and services. Cloud encryption allows companies to be proactive in their defense against data breaches and cyberattacks and has become a necessity in today’s data-driven world.

Cloud Encryption Best Practices

When choosing a cloud storage provider, map out your security needs for your cloud deployment and any data that will be moved to the cloud. Identify what data should be encrypted and select a cloud provider offering sufficient encryption for those needs. For example, a marketing team using cloud storage for graphics and videos may only require encryption for their account credentials, but not for any data uploaded to the cloud. On the other hand, engineers and manufacturers using cloud storage services to share source code and design documents would likely require cloud providers with end-to-end encryption. At the bare minimum, choose cloud providers that use HTTPS to ensure that all connections are encrypted.

Whenever possible, sensitive data that is to be uploaded to the cloud should be encrypted on-premises, prior to upload. This ensures that data will be secure in the cloud even if your account or the cloud storage provider is compromised.

Secure encryption key management – both for your keys and any keys provided by a cloud vendor – is critical as well. Encryption keys should be stored separately from the encrypted data to ensure data security. Key backups also should be kept offsite and audited regularly. Other encryption key best practices include periodically refreshing keys, especially if keys are set to expire automatically. Some companies choose to encrypt keys themselves, but that can add unnecessary complexity in some cases. Another best practice for key management is to implement multi-factor authentication for both the master and recovery keys.

While there are some challenges associated with cloud encryption, business regulations and data security requirements make it a necessity. Privacy and data security experts agree that encryption is a critical tool for information security, and cloud providers offer different applications of encryption to fit a range of data security needs and budgets. Taking the time to understand your cloud data protection needs, research the encryption services offered by different cloud vendors, and plan for secure cloud adoption will enable your business to reap the benefits of cloud storage and computing without putting your data at unnecessary risk.