Skip navigation

You need to know where and how the crypto keys are stored, and by whom?

By Ed Kidson, product manager, Wick Hill

The cloud is an attractive business proposition for many. But time and time again, companies express concerns about how secure their information is in the cloud. Security is the biggest inhibitor of organisations moving their precious data to the cloud in the first place. Issues arise such as data co-mingling, privileged user abuse, snapshots and backups, data deletion, data leakage and geographic regulatory requirements.

Security concerns also arise if you want to switch from one cloud provider to another. How can you be sure what is happening to back-ups and archives of VMs, data volumes and maybe databases that were hosted there? You don’t necessarily know where all those copies are held or how they are held. Indeed, even if you remain with the same provider you can never be certain of the location of your data.

So based on the assumption that you cannot guarantee your data’s location and you need to know that the data is secure, the best practise is now widely acknowledged to be encryption. This then negates issues around the data location, so should it be compromised, it is unreadable.

However, what is often neglected is that by encrypting data, we shift the security risk from the loss of data to the loss of cryptographic keys. The keys must be stored and managed securely. Failure to protect encryption keys is akin to locking your car and leaving the keys on the bonnet.

If your data is encrypted and protected, it is absolutely essential that you turn your attention to crypto management - the creation, management, security and storing of encryption keys. You may have encryption, but without crypto management, it’s not worth encrypting because your data could still be at risk through the loss or mismanagement of your crypto keys!

You need to know where and how the crypto keys are stored, and by whom? Should the service provider hold the keys? If so, how do they do that? Are they secured within a hardware security module or just sat on a server? Is there an audit trail for the life cycle of the keys? Do you have access to that?

Perhaps it would be more prudent for a company to manage their own keys, so that should assets be moved between service providers, access to the keys can be removed from the old provider, making the backup copies of those assets safe.

2014 research(1) by SafeNet, a leading provider of encryption and crypto management solutions, indicated that strong encryption and secure management of keys were critical prerequisites to data centre consolidation and cloud migration. It found that -

* Only 45.6% managed their keys centrally.

* 18% didn’t know where their keys were stored

Further 2014 research(2), sponsored by SafeNet and conducted by the Ponemon Institute, found that

* On average in the UK 52% said they stored encryption keys in software. This is the worst possible place for the crown jewels.

* Only 34% of respondents said their organisations had a policy that required the use of security safeguards, such as encryption, as a condition to using certain cloud computing resources

Solutions
SafeNet provides encryption and crypto management solutions which are tailored to the realities and risks of cloud and virtual environments. They allow security teams to control privileged users and super-admin access, guard against potential unauthorised copying, and mitigate the exposure of raw data. SafeNet solutions are designed for companies to reap the cost benefits of virtualisation and the cloud, while addressing the most stringent compliance and security requirements.
SafeNet’s cloud and virtualisation management solutions include -

* KeySecure
A hardened security appliance for the protection of sensitive data, which allows users to manage keys, unify encryption, and enforce access control across virtualised and cloud environments. Available in a physical or virtual format. Virtual KeySecure is also available on AWS Marketplace.

* Luna HSM Crypto Hypervisor
This provides the security of hardware-based encryption, with the scale, unified control and agility to meet the demands of cloud and virtual infrastructure, allowing for accelerated adoption of on-demand cryptographic service across data centres, virtualised infrastructures and the cloud.

Conclusion
With the proper use of both encryption AND crypto-management, organisations can now reap the benefits of virtual and cloud computing, with the confidence that they are still in control of their own security.

About Wick Hill
Established in 1976, value added distributor Wick Hill specialises in secure IP infrastructure solutions. The company sources and delivers best-of-breed, easy-to-use solutions through its channel partners, with a portfolio that covers security, performance, access, networking, convergence, storage and hosted solutions.

Wick Hill is part of the Wick Hill Group, based in Woking, Surrey with sister offices in Hamburg. Wick Hill is particularly focused on providing a wide range of value added support for its channel partners. This includes a strong lead generation and conversion programme, technical and consultancy support for reseller partners in every stage of the sales process, and extensive training facilities. For more information about Wick Hill, please visit http://www.wickhill.com/company/company-profile or www.twitter.com/wickhill

1, http://www.safenet-inc.com/news/2014/global-survey-reveals-d...

2. http://www2.safenet-inc.com/cloud-security-research/

ENDS
For further press information, please contact Annabelle Brown on 01326 318212, email pr@wickhill.com. For reader queries, contact Wick Hill on 01483 227600. Web http://www.wickhill.com

This press release was distributed by ResponseSource Press Release Wire on behalf of Wick Hill in the following categories: Business & Finance, Manufacturing, Engineering & Energy, Computing & Telecoms, for more information visit http://pressreleasewire.responsesource.com/about.