Posted by Gilad Parran-Nissany on Feb 12, 2014 | 2 Discuss With the news stories of possible data breaches at enterprises like Target, and the current trend of companies migrating to cloud environments for the flexibility, scalability, agility, and cost-effectiveness they offer, CIOs have been asking hard questions about cloud security. As CIO, protecting your data (and your users) is one of your key responsibilities. Whether you already have some cloud projects running or are starting your first cloud project, these questions and answers may provide you with solutions and introduce some new techniques.

1. Answering Common Cloud Security Questions
from CIOs
Posted by Gilad Parran-Nissany[1] on Feb 12, 2014 | 2 Discuss
With the news stories of possible data breaches at enterprises like Target, and the
current trend of companies migrating to cloud environments for the flexibility,
scalability, agility, and cost-effectiveness they offer, CIOs have been asking hard
questions about cloud security.
As CIO, protecting your data (and your users) is one of your key responsibilities.
Whether you already have some cloud projects running or are starting your first cloud
project, these questions and answers may provide you with solutions and introduce
some new techniques.
InfoQ: Is the cloud safe?
Gilad: The cloud, by definition, is not more or less safe than your own data center.
As an interesting note, the recent media storm around the NSA, which started as a
“cloud computing security” story, has morphed into a more general discussion. It
turns out the NSA is able to eavesdrop on physical servers in physical data centers
and has actually done so at many of the world’s most secure organizations.
Today, cloud computing has been discovered as safe and effective for a wide range of
projects and data types, ranging across most vertical industries and market niches.
Regulated, sensitive areas such as finance, health, legal, retail or government - are
all in various stages of going to the cloud..
However, just like certain security precautions are taken in the physical world, cloud
security also entails taking the appropriate precautions.
InfoQ: How does migrating to the cloud change my risks?
Gilad: Migrating applications and data to the cloud obviously shifts some

2. responsibilities from your own data center to the cloud provider. It is an act of
outsourcing. As such, it always involves a shift of control. Taking back control
involves procedures and technology.
Cloud computing may be seen – in some aspects – as revolutionary; yet in other
aspects it is evolutionary. Any study of controlling risks should start out by
understanding this point. Many of the things we have learned in data centers evolve
naturally to the cloud. The need for proper procedures is unchanged. Many of the
technologies are also evolving naturally.
You should therefore start by mapping out your current procedures and current
security-related technologies, and see how they evolve to the cloud. In many cases
you’ll see a correspondence.
You’ll find however, that some areas really are a revolution. Clouds do not have
walls, so physical security does not map well from the data center to the cloud.
Clouds involve employees of the cloud service provider, so you need to find ways to
control people who do not work for you. These are significant changes, and they
require new technology and new procedures.
InfoQ: What are the most important aspects of a cloud security policy?
Gilad: Continuing the themes of evolution and revolution, some aspects of cloud
security will seem familiar. Firewalls, antivirus, and authentication – are evolving to
the world of cloud computing. You will find that your cloud provider often offers you
solutions in these areas; and traditional vendors are evolving their solutions as well.
Some aspects may change your current thinking. Since clouds do not have walls, and
cloud employees could see your data - you must create metaphoric walls around your
data. In cloud scenarios, data encryption is the recognized best practice for these
new needs.
Incidentally, data encryption also helps with a traditional data center need – most
data breaches happen from the inside, so the threat is not just from cloud employees.
However, there is no question that the threat from cloud insiders has shined a new
spotlight on the need for data encryption.
InfoQ: What is the best practice for encrypting cloud data?

3. Gilad: You should encrypt data at rest and in motion. Encrypting “in motion” is
already well known to you – the standards of HTTPS/SSL and IPSEC apply equally
well in the data center and in the cloud.
Encrypting “at rest” means that the data must be encrypted when it resides on a disk,
in a database, on a file system, in storage, and of course if it is backed up. In the real
world, people have not always done this in data centers – often relying on physical
security as a replacement. In the cloud, physical security is no alternative – you must
encrypt sensitive data.
This actually means data must be encrypted constantly as it is being written, and
decrypted only when it is going to be used (i.e. just before a specific calculation, and
only in memory). Standards such as Advanced Encryption Standard (AES) are
commonly used for data encryption at rest.
InfoQ: Does cloud encryption singlehandedly protect data?
Gilad: If data is properly encrypted it is, in a sense, locked and cannot be used if it
falls into the wrong hands. Unless, of course, those hands have a key.
Proper management of encryption keys is as important as the encryption itself. In
fact, if you keep your encryption keys to yourself – you keep ownership of your data.
This is an interesting and fundamental point – in the cloud you are outsourcing your
infrastructure, but you can maintain ownership by keeping the encryption keys.
If encryption keys are stored alongside the data, any breach that discloses the data
will also disclose the key to access it. If encryption keys are stored with cloud
providers, they own your data.
Think of your data like a safe deposit box – would you leave your key with the
banker? What if he gets robbed? What if his employees are paid to make copies of
your key?
A best practice is split key encryption[2]. With this method, your data is encrypted
(e.g. with AES), and then the encryption key is split into parts. One part is managed
with a cloud security provider and one part stays only with you. This way, only you
control access to your data.

4. Even if your encrypted data is compromised, the perpetrators will not be able to
decrypt it and it will be useless to them.
InfoQ: How can encryption keys be protected while they are in use?
Gilad: Keys in use in the cloud do not have to be vulnerable. They can be protected
using homomorphic key management[3]. This cryptographic technique gives the
application access to the data store without ever exposing the master keys to the
encryption - in an unencrypted state. It also ensures that if such (encrypted) keys are
stolen, they can still never be used to access your data store
InfoQ: Is cloud data encryption in compliance with regulations?
Gilad: Regulations like Payment Card Industry Data Security Standard (PCI DSS),
the Health Insurance Portability and Accountability Act (HIPAA), and many others
(GLBA, FINRA, PIPEDA, et al) require or encourage cloud data to be properly
encrypted and encryption keys to be properly managed. Some of these regulations
even provide for a sort of “safe harbor” – that is, if your data is breached, but you
can prove that you took the necessary steps to encrypt it and maintain control of the
encryption keys, you may save the financial burden, the bureaucratic reporting
requirements, and the damage to reputation involved with such an event.
InfoQ: Is cloud security cost-prohibitive and will it harm system performance?
Gilad: The cloud is often chosen for its lower operational overhead, and sometimes
for actual dollar savings, compared with traditional data centers. Securing a cloud
project does not need to negate the cloud’s ease of use nor make the project
prohibitively expensive.
There are security solutions that require no hardware and, therefore, no large cap-ex
investment. Pay-as-you-go business models make it easy to scale security up (or
down) with the size of your project, as you add (or remove) virtual machines and
data.
Performance can also be good. Modern cloud security virtual appliances and virtual
agents - are optimized for cloud throughput and latency. You’ll be able to dial up
performance as your cloud project scales up. To take a concrete example – data
encryption – good solutions will include a capability to stream data as it is being

5. encrypted (or decrypted), and do so inside your cloud account. Such approaches
mean that virtual CPUs available in your cloud will be able to handle your
performance needs with low latency.
InfoQ: Is there a way to protect cloud backups and disaster recovery?
Gilad: Data must be secured throughout its lifecycle. Properly encrypting data while
it is in use, but then offering hackers unencrypted replicas as backups defeats the
purpose of encrypting in the first place. You must encrypt and own the encryption
keys for every point of the lifecycle of your information. Fortunately solutions that are
built for the cloud do exist, and they should cover backups as well as primary copies.
InfoQ: What it more secure: a public cloud or a private cloud?
Gilad: Public and private clouds each have pros and cons in terms of ownership,
control, cost, convenience and multi-tenancy. We have found that private clouds
often require security controls similar to public ones. Use cases may involve users
external to your company; or large “virtual” deployments with multiple internal
projects, each with a need for strong security segregation. Your data can be properly
encrypted, your keys can be properly managed, and you can be safe in all the major
cloud scenarios: private, public, or hybrid.
InfoQ: If my data is in the cloud, my security is in the cloud, and my backup is in
the cloud, what do I control?
Gilad: If you use encryption properly and maintain control of the encryption keys,
you have replaced your physical walls with mathematical walls. You will own your
data. Even though you do not control the physical resources, you maintain control of
what they contain. This is one reason why encryption in the cloud is the best practice.
By properly using multiple regions or even multiple cloud providers, you can also
ensure that you always have availability and access to your project and your data.
By combining such techniques, you do take back control. As CIO and owner of your
data, you must always control your data – from beginning to end. Your control does
not need to be sacrificed when you migrate to the cloud, though it may need to be
managed differently.

6. About the Author
Gilad Parann-Nissany is the founder and CEO of Porticor Cloud Security[4].
He is a pioneer in the field of cloud computing who has built SaaS clouds, contributed
to SAP products and created a cloud operating system. He has written extensively on
the importance of cloud encryption and encryption key management for PCI and HIPAA
compliance. Gilad can be found on his blog[5], Twitter[6], LinkedIn [7], and Google+[8]
discussing cloud security.
Tell us what you think
Re: Encryption only a small part of the story Feb 23, 2014 11:08 by Gilad ParannNissany
Thanks Mike.
Regarding the provider going bust, indeed encryption doesn't solve that. Yet try looking
at two or more providers or at least two regions of the same provider for high
availability. Encryption can help by securing both parts of your high availability
deployment.
Regarding integrity, there are cases where encryption or digital signatures can help you
discover tampering has occured. More generally, if you snapshot your data regularly
you'll be able to recover from the tampering. Again, the snapshots can and should be
encrypted - a good solution will do that.
More generally, encryption is crucial because it solves one of the main differences
between clouds and traditional deployments. It restores control to the proper owner.
1. http://www.infoq.com/author/Gilad-Parran~Nissany
2. http://www.porticor.com/technology/
3. http://www.porticor.com/homomorphic-encryption/

7. 4. http://www.porticor.com/
5. http://www.porticor.com/articles/general/
6. https://twitter.com/giladpn
7. http://il.linkedin.com/in/giladparann
8. https://plus.google.com/109000829856881765332/posts