Story image

Encryption in 2016: Are you the key master?

19 Apr 16

In a world where perimeter security measures have proven ineffective in stopping data breaches, encryption is the only way to truly make data useless to those who are not supposed to have access to it. As a result, the importance of who owns the keys to encrypt and decrypt the data has become even more important. Put plain and simple, whoever owns the keys (or has access to them), also owns the data.

As more companies move their data to the cloud using encryption to protect it, key ownership is increasingly important in order to maintain total control of encrypted data in the cloud, for security and for compliance.

Some major cloud providers have taken notice of this. One example happened recently when Box launched its new enterprise cloud storage service, building it around a significant feature known as the customer-managed key. This gives customers full control over the keys that play a crucial role in the encryption of their data, representing a critical divergence from other popular services, such as and AWS, which manage the keys for the customer.

What are the different approaches to key management?

Key management is the processing and storage of keys that control who can decrypt and access protected information. This is a critical and yet often overlooked element of encryption. Too many organisations leave key management up to their vendors or store the keys inconsistently across their IT infrastructure in both hardware and software. That lack of centralised control can jeopardise the integrity of encryption. Often management of the keys is more important than the encryption itself, because if something happens to the keys, entire sets of data can be stolen or permanently lost.

Demonstrating control of data is a critical element of compliance. But it’s not full ownership without total control and ownership of the encryption keys. Salesforce has included important safeguards to its Platform Encryption in order to prevent any mishandling of the customers’ keys on their end. Still, at the end of the day, the keys cannot leave Salesforce, meaning their customers don’t necessarily have full control.

The other approach is to take the third party provider out of the equation and put the keys in the hands of the customer. This is the approach Box is taking. From a customer’s perspective, managing your own encryption keys may seem like a tall order, but it actually makes sense if you need to eliminate any chance of a vendor exposing your keys. Imagine if someone else was in charge of your house and car keys. Every time you have to get into either one, you need to go through that second party, and you live with the constant risk that the keys could be lost, leaving you with no recourse.

For those who are up to the challenge, customer-managed keys are a way around this problem. This approach gives control goes back to the data’s owner, and an external vulnerability is removed from the equation. This is the reason why organisations like Box are taking this approach.

While there are some drawbacks involved with key administration, more and more high-profile services and organisations seem to be giving their customers the opportunity to manage their own keys. This is another indication of just how seriously encryption is being taken by the tech industry in response to an increasingly security-fluent public.

If you would like to know more about innovative solutions from Gemalto, click here.

Gemalto offers one of the most complete portfolios of enterprise security solutions in the world, enabling customers to enjoy industry-leading protection of digital identities, transactions, payments and data. Through Gemalto’s portfolio of SafeNet Identity and Data Protection solutions, enterprises across many verticals take a data-centric approach to security by utilising innovative encryption methods, best-in-class crypto management techniques, strong authentication and identity management solutions to protect what matters and where it matters in an increasingly digital world.

Lenovo DCG moves Knight into A/NZ general manager role
Knight will now relocate to Sydney where he will be tasked with managing and growing the company’s data centre business across A/NZ.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Review: Blue Mic’s Satellite headphones are good but...
Blue Mic’s newest wireless headphones deliver on sound, aesthetic, and comfort - but there is a more insidious issue at hand.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
IDC: Smartphone shipments ready to stabilise in 2019
IDC expects year-over-year shipment growth of 2.6% in 2019, while the world's largest market is still forecast to be down 8.8% in 2018.
Microsoft NZ bids Goldie a “fond farewell”
Microsoft New Zealand director of commercial and partner business takes new role across the Tasman. The search for his replacement has begun.