Are Cryptographic Keys Safe in the Cloud?

By Istvan Lam, CEO, Tresorit

By migrating data to the cloud, businesses can enjoy scalability, ease of use, enhanced collaboration and mobility, together with significant cost savings. The cloud can be especially appealing to subject-matter experts as they no longer have to invest in building and maintaining their own infrastructure. However, the cloud also brings challenges when it comes to information security.

Given the cloud has a much higher density of data than a local storage, it gives a bigger surface to attack. The reward for getting into a cloud system is much higher than getting into a local file server. The cloud stores millions of companies’ data, while a local server hosts the data of one company only. This makes the cloud a much greater target for hackers.

Maintaining data integrity and security is, therefore, a significant challenge for cloud-based services and is one of the key reasons that holds companies back from moving to the cloud. That’s where encryption comes into the picture; it can play a key role in preserving the confidentiality and integrity of data stored in the cloud and significantly reduce the risk of a data breach.

Not all encryption is created equal

Most cloud providers offer some sort of data encryption and therefore claim that your data is safe in the cloud. However, it’s important to take a closer look at what exactly the provider is offering and how it stores the encryption keys. In order to ensure the confidentiality of your data, the system needs to be designed in a way that at no point can the cloud provider have access to it. This is called end-to-end encryption.

However, the vast majority of file sync and sharing services only use encryption in transit and at rest. In transit, or channel encryption, means that there is an encrypted channel between you and the server, but once the information gets out of the channel, it gets decrypted. Hence, once your data arrives at the server, it can be accessible to a hacker or a rogue employee. In this case, the encryption keys are shared between you and the server, which is good protection if, for example, you are using public Wi-Fi to upload data. However, when it comes to the security of your data on the server, there is a vulnerability and anyone who exploits it can get access to your information.

In the case of at-rest encryption, the cloud provider encrypts the file before storing it on its disks. However, the service provider also holds the encryption keys to your files. This means that their system administrators and anyone who manages to hack their servers or simply get hold of an administrator’s password can access and read your files. This has already happened to a mainstream cloud service provider; hackers got hold of and used an employee’s password to get into the provider’s corporate network and steal user credentials.

The confidentiality of your files can only be guaranteed if the cloud provider uses end-to-end encryption. With end-to-end encryption based on zero-knowledge authentication methods, all the encryption happens on your computer—neither your files nor your password leaves your device unencrypted. This means that the admins who run the cloud cannot access the content of your files. In addition, in case of a breach into the cloud provider’s servers, your data would still be safe, as there would be no means for hackers to decrypt them.

Therefore, to ensure the confidentiality of your files in the cloud, you should look for a cloud service provider which offers its customers the ability to manage key generation on the customer side. The right way to store the information in the cloud is by putting the client in control of both the key management and the encryption process. This is what ENISA, The European Union Agency for Network and Information Security, points out in its paper on Privacy and Security in Personal Data Clouds:

“To this end, the lack of implementation of client-side encryption is an additional security challenge, as this type of encryption is the only way to provide the user with true control over his/her data, while mitigating the risk of an unauthorised or unwanted assess by third parties (such as a rogue administrator or government mass surveillance programs).”

To conclude, even if data stored by a cloud storage provider is encrypted, the type of encryption and the key management methods are what matter. Not only your documents but your keys also have to be kept safe. Public key cryptography combined with strong symmetric encryption algorithms is a standard, proven way that allows you to share documents with others without the storage provider or any third-party having access to your files any time. Look for solutions that allow you to bring your own hardware keys or the ones that do not offer password reset functionality—a good sign that the provider does not have access to your keys. Only this way can you be reassured that your and your clients’ files are protected against data breaches.