|By Gilad Parann-Nissany||
|September 6, 2014 10:00 PM EDT||
Encrypted Data in the Cloud? Be Sure to Control Your Own Keys
With cloud computing there’s no longer a question about whether you should encrypt data. That’s a given. The question today is, who should manage and control the encryption keys?
Protecting regulated data is top-of-mind in the U.S. where regulations such as PCI and HIPAA dictate that third parties not be able to access an organization’s sensitive data. Even if the data is strongly encrypted, it’s a compliance compromise if a cloud service provider has access to a full key that can decrypt the information without the data owner’s knowledge or permission.
European countries, especially Germany and France, are more concerned with data privacy. They are troubled by the fact that U.S.-based cloud vendors can be subpoenaed by the U.S. government to provide access to specific information, even if it resides outside the United States. Last April, Microsoft was ordered to hand over a customer’s emails to U.S. authorities, even though the data was held in a data center in Ireland. If Microsoft also held the data’s encryption key, the vendor could be compelled to provide that to authorities as well.
When it comes to processing and storing data in the cloud, organizations need to control their own encryption keys. What’s more, this ownership must be established before contracting for a cloud application or platform.
One key management and encryption company, Porticor, has an interesting way to address these issues. When we first introduced you to Porticor as a startup company in 2012, we mentioned the company uses a split-key approach to key management (see New key technology simplifies data encryption in the cloud). This approach has gained a lot of traction in the past two years, with a significant partnership with HP validating the notion of a “safe deposit box” for encryption keys that puts the customer in control.
Porticor provides both encryption schemes and key management technology, but it is the latter that is the distinct service offering. Porticor’s Virtual Private Data (VPD) solution is a cloud-based virtual appliance. The encryption engine and the key management function are software based and hosted in the cloud, allowing the solution to become part of the cloud infrastructure for platforms (e.g., AWS, VMware, HP Cloud Services, etc.) and for SaaS offerings.
According to Porticor CEO Gilad Parann-Nissany, the company has two customer segments. One is the end user organization that is deploying its applications on AWS or a similar cloud infrastructure. The other is SaaS providers who want to offer their customers a range of encryption schemes and, most importantly, the ability for those end customers to control their own keys.
In developing its Virtual Key Management Service, Porticor followed the principle of a bank safe deposit box. When data in the cloud is encrypted, the key is split such that Porticor holds one part of the key and the customer holds the other—the master key. As with a safe deposit box, the customer can’t decrypt the data without the key held by Porticor, and Porticor can’t decrypt the data without access to the customer’s master key. The keys must pair to provide access to the encrypted data, thus putting the user in control of the data. To further enhance security, the keys themselves are encrypted by the customer’s master key.
This solution has been designed to basically snap into cloud infrastructures, so it is apparently possible to bring up secure encrypted disks in a matter of minutes and entire database systems in a matter of hours. Porticor makes extensive use of APIs and offers RESTful APIs in order to integrate with cloud systems and applications.
In addition, Porticor’s solution can work on multiple levels. For example, customers can encrypt a complete database or a complete file store, and at the same time they can get granular in order to encrypt a single field of an application. Porticor’s customers often use these capabilities in tandem to address a specific need. This multi-level capability is especially important for SaaS providers that want to enable users to encrypt, say, a field containing a credit card number, but not necessarily the entire database. Moreover, different encryption schemes can be applied to each element that is being encrypted; for example, order-preserving encryption will be applied to the ZIP code field.
Porticor’s encryption and key management approach received quite a boost when HP selected the vendor to partner with for its own cloud-based Atalla security solution. Porticor’s technology has been integrated into the HP stack to provide secure cloud encryption. An HP cloud encryption customer can now automatically store their part of the encryption key – the master key – directly into a FIPS Level II compliant hardware security module that is part of the Atalla security system.
The imperative for encryption for data in the cloud grows stronger every day—for security, for compliance, for privacy, and for peace of mind. Organizations that are putting their data in the cloud need options in which they control the encryption keys. Porticor’s cloud-based Virtual Private Data system addresses those needs at the infrastructure level to reduce complexity while providing strong security.
The post Encrypted data in the cloud? Be sure to control your own keys appeared first on Porticor Cloud Security.
All clouds are not equal. To succeed in a DevOps context, organizations should plan to develop/deploy apps across a choice of on-premise and public clouds simultaneously depending on the business needs. This is where the concept of the Lean Cloud comes in - resting on the idea that you often need to relocate your app modules over their life cycles for both innovation and operational efficiency in the cloud. In his session at @DevOpsSummit at19th Cloud Expo, Valentin (Val) Bercovici, CTO of Soli...
Feb. 22, 2017 10:45 AM EST Reads: 336
Almost two-thirds of companies either have or soon will have IoT as the backbone of their business. Though, IoT is far more complex than most firms expected with a majority of IoT projects having failed. How can you not get trapped in the pitfalls? In his session at @ThingsExpo, Tony Shan, Chief IoTologist at Wipro, will introduce a holistic method of IoTification, which is the process of IoTifying the existing technology portfolios and business models to adopt and leverage IoT. He will delve in...
Feb. 22, 2017 10:00 AM EST Reads: 1,498
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
Feb. 22, 2017 09:45 AM EST Reads: 795
Cloud Expo, Inc. has announced today that Aruna Ravichandran, vice president of DevOps Product and Solutions Marketing at CA Technologies, has been named co-conference chair of DevOps at Cloud Expo 2017. The @DevOpsSummit at Cloud Expo New York will take place on June 6-8, 2017, at the Javits Center in New York City, New York, and @DevOpsSummit at Cloud Expo Silicon Valley will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Feb. 22, 2017 09:45 AM EST Reads: 1,322
In his session at @ThingsExpo, Steve Wilkes, CTO and founder of Striim, will delve into four enterprise-scale, business-critical case studies where streaming analytics serves as the key to enabling real-time data integration and right-time insights in hybrid cloud, IoT, and fog computing environments. As part of this discussion, he will also present a demo based on its partnership with Fujitsu, highlighting their technologies in a healthcare IoT use-case. The demo showcases the tracking of pati...
Feb. 22, 2017 09:29 AM EST Reads: 139
Tricky charts and visually deceptive graphs often make a case for the impact IT performance has on business. The debate isn't around the obvious; of course, IT performance metrics like website load time influence business metrics such as conversions and revenue. Rather, this presentation will explore various data analysis concepts to understand how, and how not to, assert such correlations. In his session at 20th Cloud Expo, Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Sys...
Feb. 22, 2017 09:15 AM EST Reads: 1,378
The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new da...
Feb. 22, 2017 08:30 AM EST Reads: 832
Stratoscale, the software company developing the next generation data center operating system, exhibited at SYS-CON's 18th International Cloud Expo®, which took place at the Javits Center in New York City, NY, in June 2016.Stratoscale is revolutionizing the data center with a zero-to-cloud-in-minutes solution. With Stratoscale’s hardware-agnostic, Software Defined Data Center (SDDC) solution to store everything, run anything and scale everywhere, IT is empowered to take control of their data ce...
Feb. 22, 2017 08:30 AM EST Reads: 848
It is one thing to build single industrial IoT applications, but what will it take to build the Smart Cities and truly society changing applications of the future? The technology won’t be the problem, it will be the number of parties that need to work together and be aligned in their motivation to succeed. In his Day 2 Keynote at @ThingsExpo, Henrik Kenani Dahlgren, Portfolio Marketing Manager at Ericsson, discussed how to plan to cooperate, partner, and form lasting all-star teams to change the...
Feb. 22, 2017 08:15 AM EST Reads: 4,654
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
Feb. 22, 2017 08:00 AM EST Reads: 668
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
Feb. 22, 2017 07:00 AM EST Reads: 2,935
To manage complex web services with lots of calls to the cloud, many businesses have invested in Application Performance Management (APM) and Network Performance Management (NPM) tools. Together APM and NPM tools are essential aids in improving a business's infrastructure required to support an effective web experience... but they are missing a critical component - Internet visibility.
Feb. 22, 2017 06:45 AM EST Reads: 1,639
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem" ...
Feb. 22, 2017 06:00 AM EST Reads: 5,264
Both SaaS vendors and SaaS buyers are going “all-in” to hyperscale IaaS platforms such as AWS, which is disrupting the SaaS value proposition. Why should the enterprise SaaS consumer pay for the SaaS service if their data is resident in adjacent AWS S3 buckets? If both SaaS sellers and buyers are using the same cloud tools, automation and pay-per-transaction model offered by IaaS platforms, then why not host the “shrink-wrapped” software in the customers’ cloud? Further, serverless computing, cl...
Feb. 22, 2017 06:00 AM EST Reads: 1,851
“We're a global managed hosting provider. Our core customer set is a U.S.-based customer that is looking to go global,” explained Adam Rogers, Managing Director at ANEXIA, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Feb. 22, 2017 05:45 AM EST Reads: 1,701
The speed of software changes in growing and large scale rapid-paced DevOps environments presents a challenge for continuous testing. Many organizations struggle to get this right. Practices that work for small scale continuous testing may not be sufficient as the requirements grow. In his session at DevOps Summit, Marc Hornbeek, Sr. Solutions Architect of DevOps continuous test solutions at Spirent Communications, explained the best practices of continuous testing at high scale, which is rele...
Feb. 22, 2017 03:15 AM EST Reads: 5,534
Hardware virtualization and cloud computing allowed us to increase resource utilization and increase our flexibility to respond to business demand. Docker Containers are the next quantum leap - Are they?! Databases always represented an additional set of challenges unique to running workloads requiring a maximum of I/O, network, CPU resources combined with data locality.
Feb. 22, 2017 02:45 AM EST Reads: 2,052
"Matrix is an ambitious open standard and implementation that's set up to break down the fragmentation problems that exist in IP messaging and VoIP communication," explained John Woolf, Technical Evangelist at Matrix, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Feb. 22, 2017 02:00 AM EST Reads: 13,011
"A lot of times people will come to us and have a very diverse set of requirements or very customized need and we'll help them to implement it in a fashion that you can't just buy off of the shelf," explained Nick Rose, CTO of Enzu, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Feb. 22, 2017 01:45 AM EST Reads: 6,082
Web Real-Time Communication APIs have quickly revolutionized what browsers are capable of. In addition to video and audio streams, we can now bi-directionally send arbitrary data over WebRTC's PeerConnection Data Channels. With the advent of Progressive Web Apps and new hardware APIs such as WebBluetooh and WebUSB, we can finally enable users to stitch together the Internet of Things directly from their browsers while communicating privately and securely in a decentralized way.
Feb. 22, 2017 01:30 AM EST Reads: 4,155