Click here to close now.


@CloudExpo Authors: Carmen Gonzalez, AppDynamics Blog, Liz McMillan, Teresa Schoch, Lori MacVittie

Blog Feed Post

Amazon S3 Server Side Encryption & Software Defined Key Management

encryption key management Cloud Key Management AWS security AWS Encryption  amazon s3 server side encryption Amazon S3 Server Side Encryption & Software Defined Key ManagementStrong data encryption is a critical line of defense against cyber criminals and spies. Amazon has always taken care of the front lines with their strong infrastructure with security mechanisms like multi-factor access control systems in AWS datacenters, availability zones, built-in firewalls, private subnets, etc.

Now, with the addition of Server Side Encryption with Customer-Provided Keys, Amazon protects the data you store with Amazon S3 server side encryption. Even better, Amazon encrypts your data using a key you provide; a key that is never stored by Amazon. Thus, they have successfully protected your data from prying eyes – even their own.

The result is that you no longer need to lose sleep over storing encryption keys with Amazon. You can easily encrypt your data with your own key. Thanks to Amazon, encrypting is easy and secure!

How do you manage your Amazon S3 encryption keys?

Herein lies the real issue now facing each of AWS’s customers. Amazon has provided you with an excellent arsenal: strong infrastructure, easy encryption. But your part of the shared responsibility model is to properly manage your encryption keys. You need:

  • A way to randomly and securely generate Amazon S3 encryption keys
  • A controlled system to store, manage, and retrieve the many keys required for each S3 object
  • A system that ensures that keys are kept within your control; thus complying with regulations like HIPAA and PCI.
  • A software-defined automated solution that eliminates the need for cumbersome, non-scalable, and expensive hardware security modules (HSMs)

AWS Encryption Key Management: What are the options?

You have three options when it comes to managing encryption keys for AWS.

1.       Hardware security modules (HSMs)

HSMs are reasonably secure. To manage keys outside the cloud, an HSM is a great option. Unfortunately, in cloud scenarios, they have major drawbacks. First, being hardware based, they limit the benefits of the cloud, especially auto provisioning, orchestration and geographic dispersion. Also, they are far more expensive than software-defined solutions.

2.       Cloud-based HSMs

Still based on hardware, cloud-based HSMs offer limited scaling and do not support auto-provisioning. Because they are complex systems, operational overhead is high, and involves up-front costs. Also, with cloud-based HSMs, you still deal with the problems of securing a key cache in the cloud and access credentials.

3.       Software-defined key management

To work with your software-based cloud-computing scenario, the best option is a software-defined cloud key management system. Such a system enables you to consume key management as a service, while ensuring data security that is stronger than hardware. It can be automated with a RESTful API. Its benefits are much like those which prompted you to migrate to cloud storage: scalability, flexibility, and agility. Software-defined key management costs a fraction of hardware-based modules and is more effective at securing your cloud data. Furthermore, it is compliant with laws and industry regulations. Two examples for such systems are Porticor Cloud Security, and HP Atalla Cloud Encryption

Key Management for Amazon S3 Server Side Encryption

Amazon, one of the most customer-centric companies in the world, has developed a cloud computing system that is great for customers. They provide you with a safe place to put your data. Now, they even provide you with a way to protect the data you put there. The only thing they can’t do (and rightfully so) is protect that protection.

Managing the encryption keys remains your responsibility because it must be your responsibility to ensure the integrity and ownership of your data. If Amazon could manage the encryption keys for you, they would . . . but by doing so, they would puncture a hole in your security (and defy regulations like HIPAA and PCI).

Encryption key management remains solely your discretion and the only way to do it in a manner that is secure, compliant, and cost-effective is with software-defined key management.

For a detailed technical example and an implementation sample, see this post.

The post Amazon S3 Server Side Encryption & Software Defined Key Management appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
Containers have changed the mind of IT in DevOps. They enable developers to work with dev, test, stage and production environments identically. Containers provide the right abstraction for microservices and many cloud platforms have integrated them into deployment pipelines. DevOps and Containers together help companies to achieve their business goals faster and more effectively.
The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new da...
WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
Achim Weiss is Chief Executive Officer and co-founder of ProfitBricks. In 1995, he broke off his studies to co-found the web hosting company "Schlund+Partner." The company "Schlund+Partner" later became the 1&1 web hosting product line. From 1995 to 2008, he was the technical director for several important projects: the largest web hosting platform in the world, the second largest DSL platform, a video on-demand delivery network, the largest eMail backend in Europe, and a universal billing syste...
There are many considerations when moving applications from on-premise to cloud. It is critical to understand the benefits and also challenges of this migration. A successful migration will result in lower Total Cost of Ownership, yet offer the same or higher level of robustness. Migration to cloud shifts computing resources from your data center, which can yield significant advantages provided that the cloud vendor an offer enterprise-grade quality for your application.
The IoT is upon us, but today’s databases, built on 30-year-old math, require multiple platforms to create a single solution. Data demands of the IoT require Big Data systems that can handle ingest, transactions and analytics concurrently adapting to varied situations as they occur, with speed at scale. In his session at @ThingsExpo, Chad Jones, chief strategy officer at Deep Information Sciences, will look differently at IoT data so enterprises can fully leverage their IoT potential. He’ll sha...
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi's VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driv...
In today's digital world, change is the one constant. Disruptive innovations like cloud, mobility, social media, and the Internet of Things have reshaped the market and set new standards in customer expectations. To remain competitive, businesses must tap the potential of emerging technologies and markets through the rapid release of new products and services. However, the rigid and siloed structures of traditional IT platforms and processes are slowing them down – resulting in lengthy delivery ...
The modern software development landscape consists of best practices and tools that allow teams to deliver software in a near-continuous manner. By adopting a culture of automation, measurement and sharing, the time to ship code has been greatly reduced, allowing for shorter release cycles and quicker feedback from customers and users. Still, with all of these tools and methods, how can teams stay on top of what is taking place across their infrastructure and codebase? Hopping between services a...
As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ability. Many are unable to effectively engage and inspire, creating forward momentum in the direction of desired change. Renowned for its approach to leadership and emphasis on their people, organizations increasingly look to our military for insight into these challenges.
DevOps and Continuous Delivery software provider XebiaLabs has announced it has been selected to join the Amazon Web Services (AWS) DevOps Competency partner program. The program is designed to highlight software vendors like XebiaLabs who have demonstrated technical expertise and proven customer success in DevOps and specialized solution areas like Continuous Delivery. DevOps Competency Partners provide solutions to, or have deep experience working with AWS users and other businesses to help t...
Nowadays, a large number of sensors and devices are connected to the network. Leading-edge IoT technologies integrate various types of sensor data to create a new value for several business decision scenarios. The transparent cloud is a model of a new IoT emergence service platform. Many service providers store and access various types of sensor data in order to create and find out new business values by integrating such data.
Overgrown applications have given way to modular applications, driven by the need to break larger problems into smaller problems. Similarly large monolithic development processes have been forced to be broken into smaller agile development cycles. Looking at trends in software development, microservices architectures meet the same demands. Additional benefits of microservices architectures are compartmentalization and a limited impact of service failure versus a complete software malfunction....
Containers are changing the security landscape for software development and deployment. As with any security solutions, security approaches that work for developers, operations personnel and security professionals is a requirement. In his session at @DevOpsSummit, Kevin Gilpin, CTO and Co-Founder of Conjur, will discuss various security considerations for container-based infrastructure and related DevOps workflows.
The cloud has reached mainstream IT. Those 18.7 million data centers out there (server closets to corporate data centers to colocation deployments) are moving to the cloud. In his session at 17th Cloud Expo, Achim Weiss, CEO & co-founder of ProfitBricks, will share how two companies – one in the U.S. and one in Germany – are achieving their goals with cloud infrastructure. More than a case study, he will share the details of how they prioritized their cloud computing infrastructure deployments ...
There are so many tools and techniques for data analytics that even for a data scientist the choices, possible systems, and even the types of data can be daunting. In his session at @ThingsExpo, Chris Harrold, Global CTO for Big Data Solutions for EMC Corporation, will show how to perform a simple, but meaningful analysis of social sentiment data using freely available tools that take only minutes to download and install. Participants will get the download information, scripts, and complete en...
Data loss happens, even in the cloud. In fact, if your company has adopted a cloud application in the past three years, data loss has probably happened, whether you know it or not. In his session at 17th Cloud Expo, Bryan Forrester, Senior Vice President of Sales at eFolder, will present how common and costly cloud application data loss is and what measures you can take to protect your organization from data loss.
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data...
The web app is agile. The REST API is agile. The testing and planning are agile. But alas, data infrastructures certainly are not. Once an application matures, changing the shape or indexing scheme of data often forces at best a top down planning exercise and at worst includes schema changes that force downtime. The time has come for a new approach that fundamentally advances the agility of distributed data infrastructures. Come learn about a new solution to the problems faced by software organ...
Between the compelling mockups and specs produced by analysts, and resulting applications built by developers, there exists a gulf where projects fail, costs spiral, and applications disappoint. Methodologies like Agile attempt to address this with intensified communication, with partial success but many limitations. In his session at DevOps Summit, Charles Kendrick, CTO and Chief Architect at Isomorphic Software, will present a revolutionary model enabled by new technologies. Learn how busine...