How encryption and tokenization help with cloud services adoption
Posted on 23 August 2013.
Today’s CIOs and CISOs are facing continued pressure to adopt the cloud enterprise-wide while managing the increasing operational and security risks associated with it.
While the challenge can be daunting, a new Gartner report highlights the role that encryption and tokenization technologies can play in helping enterprises adopt cloud services, even those in highly regulated industries or in regions with strict data sovereignty requirements.
CIOs and CISOs should simplify audits such as the Payment Card Industry Data Security Standard (PCI DSS) when using cloud services by implementing access controls and encryption or tokenization of sensitive data.
Gartner highlights sector-based data compliance requirements, such as PCI DSS, as drivers for organizations to consider adopting encryption and tokenization technologies. Another catalyst is referred to as data residency requirements, where the protection is required to prevent access by government authorities and agencies while data resides in or is passing through other jurisdictions.
Regarding this issue, an alternative is to avoid storing the data in those jurisdictions, such as the U.S. and U.K., which use legal access or interception of data through laws such as the USA Patriot Act and the U.K. Regulation of Investigatory Powers Act.
But the report cautions enterprises to clearly think through the implications of deploying these technologies in their environments. Gartner’s research helps enterprises understand these risks and highlights the following:
“The security strength of the underlying data protection techniques that an enterprise uses is critical. This is why PerspecSys has refused to use any of the weakened security approaches that the report urges CIOs and CISOs to fully understand. I’m astonished to see some competitors tell enterprises they need to use modes of encryption modules that have not been opened up to public scrutiny and do not have well-vetted security proofs when they want to preserve cloud application functionality. This is a totally unacceptable position that opens these organizations to security risks as well as compliance and audit challenges. We do not force this tradeoff on our customers, which is why we are seeing our approach win in the marketplace,” Canellos added.
While the challenge can be daunting, a new Gartner report highlights the role that encryption and tokenization technologies can play in helping enterprises adopt cloud services, even those in highly regulated industries or in regions with strict data sovereignty requirements.
CIOs and CISOs should simplify audits such as the Payment Card Industry Data Security Standard (PCI DSS) when using cloud services by implementing access controls and encryption or tokenization of sensitive data.
Gartner highlights sector-based data compliance requirements, such as PCI DSS, as drivers for organizations to consider adopting encryption and tokenization technologies. Another catalyst is referred to as data residency requirements, where the protection is required to prevent access by government authorities and agencies while data resides in or is passing through other jurisdictions.
Regarding this issue, an alternative is to avoid storing the data in those jurisdictions, such as the U.S. and U.K., which use legal access or interception of data through laws such as the USA Patriot Act and the U.K. Regulation of Investigatory Powers Act.
But the report cautions enterprises to clearly think through the implications of deploying these technologies in their environments. Gartner’s research helps enterprises understand these risks and highlights the following:
- Protect sensitive fields/columns while using cloud SaaS applications
- Do not store keys or use keys in other jurisdictions, or use a third party; otherwise the encrypted data could be accessed if the keys are available
- It is important to review the claims of vendors carefully due to the novel and unique implementations of encryption solutions. … Enterprises should always check the claims of vendors that their solutions are based on proven security models
- When keys or tokens are managed on-premise, always check the impact on the access and availability of the cloud service provider (CSP) and the performance of appliances
- A growing best practice is emerging where enterprises encrypt data stored in the cloud and manage the keys locally.
“The security strength of the underlying data protection techniques that an enterprise uses is critical. This is why PerspecSys has refused to use any of the weakened security approaches that the report urges CIOs and CISOs to fully understand. I’m astonished to see some competitors tell enterprises they need to use modes of encryption modules that have not been opened up to public scrutiny and do not have well-vetted security proofs when they want to preserve cloud application functionality. This is a totally unacceptable position that opens these organizations to security risks as well as compliance and audit challenges. We do not force this tradeoff on our customers, which is why we are seeing our approach win in the marketplace,” Canellos added.
No comments:
Post a Comment