Risk and reward in the cloud: How to attack security concerns.

Richard Moulds is vice president of product management and strategy at Thales e-Security.

The Obama administration’s cloud-first strategy is designed to lower IT costs and consolidate federal data centers through the adoption of cloud-based applications. The new policy requires agencies to identify three IT services that can be migrated to cloud computing applications.

However, many government organizations are rightfully concerned about the security of sensitive data, and creating a protected cloud environment is not easy. Generally, the adoption of a data-centric approach to security provides a strong starting point. Here are some strategies for applying data security and maintaining control.

1. Rely on cryptography to secure data in the cloud. Over time, cryptography has been proven to maintain confidentiality by rendering data unreadable to anyone unable to convert it back to its original state. That means if a data breach occurs, the data is useless to the attacker. The stolen data is only readable with the correct “key,” the string of bits used for decryption.

When assessing cloud providers’ security claims, it is crucial to remember the data classifications that will be sent and, therefore, the appropriate security criteria. The definition of what “secure” really means comes down to a number of factors, but at the top of the list will be the data’s value, the impact its loss would have and the risk of it being attacked.

2. Determine who is responsible for protecting cloud data. Either the cloud provider has control over security or it doesn’t. If the cloud provider does not take responsibility, then the government agency must encrypt the data internally, minimizing the impact of an attack by ensuring that only already-encrypted data is stored in the cloud. Because it can be difficult to manage encrypted data, that approach limits the operations that are performed in the cloud.

3. Take a proactive approach to key management. Central to the overall encryption security model is the question of who has key control and who has key access. For network-level or basic storage-level encryption, the keys may be owned and controlled by the cloud provider.

Keys will span multiple tenants, each of whom will have no control. A multilayer approach is a reliable level of protection but delivers nothing in terms of segregated protection. The only way to achieve isolation between tenants is to have keys dedicated to each while accounting for the fact that even these keys will probably be controlled or at least accessible to the cloud provider. That constitutes a potential insider threat, which is an unacceptable risk for many.

Some government users of cloud services might have no choice but to manage the keys within their own environment. That is important, because at the end of the day, it is the government that is held accountable for that protection.

4. Add another level of trustworthiness. Wherever encryption is deployed and whoever is responsible for key management, it is important to assess the trustworthiness of the systems. Although encryption algorithms are unbreakable, they are worthless if the keys can easily be stolen or misused. Government agencies have known this for years. To deliver necessary levels of assurance in the cloud, agencies must deploy tamper-resistant systems, such as hardware security models.

The cloud opens opportunities for government organizations to address seemingly conflicting goals — increased flexibility, capacity and responsiveness — while simultaneously lowering costs. Government agencies must evaluate their data security requirements and then identify the best security level. Strong cryptography provides protection for data and delivers strong segregation, and the wise use of key management provides the means to ensure control.

About the Author

Richard Moulds is vice president of product management and strategy at Thales e-Security.

The Fed 100

Read the profiles of all this year's winners.


  • Then-presidential candidate Donald Trump at a 2016 campaign event. Image: Shutterstock

    'Buy American' order puts procurement in the spotlight

    Some IT contractors are worried that the "buy American" executive order from President Trump could squeeze key innovators out of the market.

  • OMB chief Mick Mulvaney, shown here in as a member of Congress in 2013. (Photo credit Gage Skidmore/Flickr)

    White House taps old policies for new government makeover

    New guidance from OMB advises agencies to use shared services, GWACs and federal schedules for acquisition, and to leverage IT wherever possible in restructuring plans.

  • Shutterstock image (by Everett Historical): aerial of the Pentagon.

    What DOD's next CIO will have to deal with

    It could be months before the Defense Department has a new CIO, and he or she will face a host of organizational and operational challenges from Day One

  • USAF Gen. John Hyten

    General: Cyber Command needs new platform before NSA split

    U.S. Cyber Command should be elevated to a full combatant command as soon as possible, the head of Strategic Command told Congress, but it cannot be separated from the NSA until it has its own cyber platform.

  • Image from Shutterstock.

    DLA goes virtual

    The Defense Logistics Agency is in the midst of an ambitious campaign to eliminate its IT infrastructure and transition to using exclusively shared, hosted and virtual services.

  • Fed 100 logo

    The 2017 Federal 100

    The women and men who make up this year's Fed 100 are proof positive of what one person can make possibile in federal IT. Read on to learn more about each and every winner's accomplishments.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group