Commentary

Risk and reward in the cloud: How to attack security concerns.

Richard Moulds is vice president of product management and strategy at Thales e-Security.

The Obama administration’s cloud-first strategy is designed to lower IT costs and consolidate federal data centers through the adoption of cloud-based applications. The new policy requires agencies to identify three IT services that can be migrated to cloud computing applications.

However, many government organizations are rightfully concerned about the security of sensitive data, and creating a protected cloud environment is not easy. Generally, the adoption of a data-centric approach to security provides a strong starting point. Here are some strategies for applying data security and maintaining control.

1. Rely on cryptography to secure data in the cloud. Over time, cryptography has been proven to maintain confidentiality by rendering data unreadable to anyone unable to convert it back to its original state. That means if a data breach occurs, the data is useless to the attacker. The stolen data is only readable with the correct “key,” the string of bits used for decryption.

When assessing cloud providers’ security claims, it is crucial to remember the data classifications that will be sent and, therefore, the appropriate security criteria. The definition of what “secure” really means comes down to a number of factors, but at the top of the list will be the data’s value, the impact its loss would have and the risk of it being attacked.

2. Determine who is responsible for protecting cloud data. Either the cloud provider has control over security or it doesn’t. If the cloud provider does not take responsibility, then the government agency must encrypt the data internally, minimizing the impact of an attack by ensuring that only already-encrypted data is stored in the cloud. Because it can be difficult to manage encrypted data, that approach limits the operations that are performed in the cloud.

3. Take a proactive approach to key management. Central to the overall encryption security model is the question of who has key control and who has key access. For network-level or basic storage-level encryption, the keys may be owned and controlled by the cloud provider.

Keys will span multiple tenants, each of whom will have no control. A multilayer approach is a reliable level of protection but delivers nothing in terms of segregated protection. The only way to achieve isolation between tenants is to have keys dedicated to each while accounting for the fact that even these keys will probably be controlled or at least accessible to the cloud provider. That constitutes a potential insider threat, which is an unacceptable risk for many.

Some government users of cloud services might have no choice but to manage the keys within their own environment. That is important, because at the end of the day, it is the government that is held accountable for that protection.

4. Add another level of trustworthiness. Wherever encryption is deployed and whoever is responsible for key management, it is important to assess the trustworthiness of the systems. Although encryption algorithms are unbreakable, they are worthless if the keys can easily be stolen or misused. Government agencies have known this for years. To deliver necessary levels of assurance in the cloud, agencies must deploy tamper-resistant systems, such as hardware security models.

The cloud opens opportunities for government organizations to address seemingly conflicting goals — increased flexibility, capacity and responsiveness — while simultaneously lowering costs. Government agencies must evaluate their data security requirements and then identify the best security level. Strong cryptography provides protection for data and delivers strong segregation, and the wise use of key management provides the means to ensure control.

About the Author

Richard Moulds is vice president of product management and strategy at Thales e-Security.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group