There is no single right way to pick the best encryption option. Which is ‘best’ depends on a ton of factors including the specifics of the cloud deployment, what you already have for key management or encryption, the nature of the data, and so on. That said, here are some guidelines that should work in most cases.
Volume Storage
- Always use external key management. Instance-managed encryption is only acceptable for test/development systems you know will never go into production.
- For sensitive data in public cloud computing choose a system with protection for keys in volatile memory (RAM). Don’t use a cloud’s native encryption capabilities if you have any concern that a cloud administrator is a risk.
- In private clouds you may also need a product that protects keys in memory if sensitive data is encrypted in instances sharing physical hosts with untrusted instances that could perform a memory attack.
- Pick a product designed to handle the more dynamic cloud computing environment. Specifically one with workflow for rapidly provisioning keys to cloud instances and API support for the cloud platform you use.
- If you need to encrypt boot volumes and not just attached storage volumes, select a product with a client that includes that capability, but make sure it works for the operating systems you use for your instances. On the other hand, don’t assume you need boot volume support – it all depends on how you architect cloud applications.
- The two key features to look for, after platform/topology support, are granular key management (role-based with good isolation/segregation) and good reporting.
- Know your compliance requirements and use hardware (such as an HSM) if needed for root key storage.
- Key management services may reduce the overhead of building your own key infrastructure if you are comfortable with how they handle key security. As cloud natives they may also offer other performance and management advantages, but this varies widely between products and cloud platforms/services.
It is hard to be more specific without knowing more about the cloud deployment but these questions should get you moving in the right direction. The main things to understand before you start looking for a product are:
- What cloud platform(s) are we on?
- Are we using public or private cloud, or both? Does our encryption need to be standardized between the two?
- What operating systems will our instances run?
- What are our compliance and reporting requirements?
- Do we need boot volume encryption for instances? (Don’t assume this – it isn’t always a requirement).
- Do
rootkeys need to be stored in hardware? (Generally a compliance requirement because virtual appliances or software servers are actually quite secure). - What is our cloud and application topology? How often (and where) will we be provisioning keys?
Object storage
- For server-based object storage, such as you use to back an application, a cloud encryption gateway is likely your best option. Use a system where you manage the keys – not your cloud provider – and don’t store those keys in the cloud.
- For supporting users on services like Dropbox, use a software client/agent with centralized key management. If you want to support mobile devices make sure the product you select has apps for the mobile platforms you support.
As you can see, figuring out object storage encryption is usually much easier than volume storage.
Conclusion
Encryption is our best tool protecting cloud data. It allows us to separate security from the cloud infrastructure without losing the advantages of cloud computing. By splitting key management from the data storage and encryption engines, it supports a wide array of deployment options and use cases. We can now store data in multi-tenant systems and services without compromising security.
In this series we focused on protecting data in IaaS (Infrastructure as a Service) environments but keep in mind that alternate encryption options, including encrypting data when you collect it in an application, might be a better choice or an additional option for greater granularity.
Encrypting cloud data can be more complex than on traditional infrastructure, but once you understand the basics adapting your approach shouldn’t be too difficult. The key is to remember that you shouldn’t try to merely replicate how you encrypt and manage keys (assuming you even do) in your traditional infrastructure. Understand how you use the cloud and adapt your approach so encryption becomes an enabler – not an obstacle to moving forward with cloud computing.
Reader interactions
One Reply to “IaaS Encryption: How to Choose”
Nice series so far!
Concerning object storage encryption via self-managed cloud encryption gateway, when used for backing up an application, special care should be taken with regard to (securely) backing up the keys on that gateway.
It is too easy to forget that backup is only as good as the weakest link, and assume that my data is safe once it is stored in the cloud (replicated across zone, etc.).
But if I lose the keys when a flood hits my only gateway, my beloved data instantly transforms into nicely replicated blobs of gibberish…