It’s a common sense fact that a cloud encryption solution needs to fit the specifics of a requirement. Some scenarios need out-of-the-box solutions that require no changes to existing application code. Other scenarios demand changes to application code. A recent article by Ken Smith pointed out the limitations of out-of-the-box solutions, and militated for application-level code implementing cloud encryption solutions.

Application-level solutions do have definite benefits for compliance requirements. If you want to be sure that cloud database administrators cannot read sensitive data, it makes sense to encrypt the data at a level which is inaccessible to DB administrators. For this requirement, encrypting at the application level is better than solutions such as TDE (“Transparent Data Encryption”).

However note that – even if you have implemented such techniques and are protected from a malicious DB admin – you may still not be safe from application administrators. The trouble with cloud compliance and cloud security discussions is that people tend to see them through a specific prism, of what they can solve rather than what is truly needed.

What you really want – for full cloud security and cloud compliance – is to base your cloud encryption and security strategy on encryption keys that are constructed from multiple secrets. A specific secured field should be protected by

• A secret owned by the user, group, role or process that is using the data
• A secret owned by the administrator of the application
• A secret owned by a trusted party, such as a CISO, CFO or project leader

The best solution integrates with a security framework that does such key-splitting automatically. What we are seeing is cloud security solutions emerging that are built for these scenarios. Look for solutions that are

• Built for key splitting from day one
• Support token-based management of keys so that tokens can be handed out to the correct principals (users, groups, roles, applications and processes)
• Offer a secure cloud API (preferably based on RESTful standards, as is common in the cloud) that fully allows application-level integration
• Offer a high level of automation so you do not need to reinvent this complex area, but rather rely on a knowledgeable implementation
• Support a wide range of use cases, including security for data stored on databases, virtual disks, file systems, and object storage (e.g. S3)
• Also offers out-of-the-box support for the cases where you just want a quick solution and do not need application level integration

Such systems also raise unique cloud security considerations, such as the need for homomorphic key encryption for fully protecting your keys in the cloud.

The post Cloud Encryption at The Application Level For Cloud Security And Full Compliance appeared first on Porticor Cloud Security.