The cloud is an attractive business proposition for many. But time and time again, companies express concerns about how secure their information is in the cloud. Security is the biggest inhibitor of organizations moving their precious data to the cloud in the first place. Issues arise such as data co-mingling, privileged user abuse, snapshots and backups, data deletion, data leakage and geographic regulatory requirements.

Security concerns also arise if you want to switch from one cloud provider to another. How can you be sure what is happening to back-ups and archives of VMs, data volumes and maybe databases that were hosted there? You don't necessarily know where all those copies are held or how they are held. Indeed, even if you remain with the same provider you can never be certain of the location of your data.

So based on the assumption that you cannot guarantee your data's location and you need to know that the data is secure, the best practice is now widely acknowledged to be encryption. This then negates issues around the data location, so should it be compromised, it is unreadable.

However, what is often neglected is that by encrypting data, we shift the security risk from the loss of data to the loss of cryptographic keys. The keys must be stored and managed securely. Failure to protect encryption keys is akin to locking your car and leaving the keys on the bonnet.

If your data is encrypted and protected, it is absolutely essential that you turn your attention to crypto management - the creation, management, security and storing of encryption keys. You may have encryption, but without crypto management, it's not worth encrypting because your data could still be at risk through the loss or mismanagement of your crypto keys!

You need to know where and how the crypto keys are stored, and by whom? Should the service provider hold the keys? If so, how do they do that? Are they secured within a hardware security module or just sat on a server? Is there an audit trail for the life cycle of the keys? Do you have access to that?

Perhaps it would be more prudent for a company to manage their own keys, so that should assets be moved between service providers, access to the keys can be removed from the old provider, making the backup copies of those assets safe.

2014 research(1) by SafeNet, a leading provider of encryption and crypto management solutions, indicated that strong encryption and secure management of keys were critical prerequisites to data center consolidation and cloud migration. It found that -

• Only 45.6% managed their keys centrally.
• 18% didn't know where their keys were stored
  

Further 2014 research(2), sponsored by SafeNet and conducted by the Ponemon Institute, found that

• On average in the UK 52% said they stored encryption keys in software. This is the worst possible place for the crown jewels.
• Only 34% of respondents said their organisations had a policy that required the use of security safeguards, such as encryption, as a condition to using certain cloud computing resources
  

Solutions
SafeNet provides encryption and crypto management solutions which are tailored to the realities and risks of cloud and virtual environments. They allow security teams to control privileged users and super-admin access, guard against potential unauthorized copying, and mitigate the exposure of raw data. SafeNet solutions are designed for companies to reap the cost benefits of virtualization and the cloud, while addressing the most stringent compliance and security requirements.
SafeNet's cloud and virtualization management solutions include -

• KeySecure - A hardened security appliance for the protection of sensitive data, which allows users to manage keys, unify encryption, and enforce access control across virtualized and cloud environments. Available in a physical or virtual format. Virtual KeySecure is also available on AWS Marketplace.
• Luna HSM Crypto Hypervisor - This provides the security of hardware-based encryption, with the scale, unified control and agility to meet the demands of cloud and virtual infrastructure, allowing for accelerated adoption of on-demand cryptographic service across data centres, virtualised infrastructures and the cloud.
  

Conclusion
With the proper use of both encryption AND crypto-management, organizations can now reap the benefits of virtual and cloud computing, with the confidence that they are still in control of their own security.