The concept of encryption has been around for quite a while and has traditionally been performed on servers in an on-premises data center. Organizations had complete control over these resources and could determine when data needed to be encrypted and when it was safe to leave it in plaintext. 

The security of data in the cloud is not fully controlled by the customer. Security is a shared responsibility as defined in this chart from AWS. A look at the matrix indicates that the cloud service provider (CSP) is responsible for the security of the cloud, including storage. Customers are tasked with securing their data. But that data needs to be transmitted to the cloud and will eventually reside on a CSP’s storage devices. 

How Does Cloud Cryptography Work? 

The objective of cloud cryptography is to secure data when it is stored in the cloud and as it moves to and from cloud applications. This requires cooperation between a customer and their CSP to address the three phases in which data exists. To ensure security, data needs to be encrypted when at rest, in use, and in motion.  

Encryption techniques can be classified into two main categories: 

Symmetric encryption - This method uses the same key for encrypting and decrypting data. It is the faster but less secure encryption option.

Asymmetric encryption - Two keys are used in this method, a public and a private key. Asymmetric encryption is more secure but can be slower than symmetric encryption.  

Many companies only encrypt the subset of their data which requires a greater level of security due to the processing-intensive nature of encryption. Encrypting and decrypting data takes time and processing cycles which may impact application performance. Organizations need to take this factor into account when designing applications that rely on high performance. 

It’s All About the Keys! 

Keys are at the heart of cloud cryptography. They are the passwords without which it is impossible to encrypt and decrypt data. Key management is an essential part of maintaining the security of encrypted data. Several factors need to be considered and addressed to ensure data remains secure. 

• A method of generating strong keys needs to be implemented to eliminate the risk of using weak passwords that can easily be compromised.
• Customers need to clarify who will be responsible for key management and storage procedures. In most cases, the CSP can assume that role, but regulatory compliance may require the customer to handle these tasks.
• Lost keys can make encrypted data useless by making it impossible to decrypt.
• Mismanaged keys can allow malicious entities to access encrypted data. 

The bottom line is that organizations should be encrypting sensitive data in the cloud. They need to focus on key management to ensure the data stays safe and accessible. Failure to take advantage of cloud cryptography needlessly puts a company’s data at risk.