Enterprises are coming to realize the importance of encrypting or tokenizing sensitive data that is used in cloud-based applications. Many data security solutions are application-specific. Now there is a new solution that allows an enterprise to send encrypted or tokenized data into any cloud application. The solution is transparent to users and requires no changes to the cloud applications.
For enterprise organizations that are using cloud-based applications, a paramount question is how to meet data security, privacy, residency and compliance requirements. It’s no longer a matter of “if” data should be encrypted or tokenized, but “how” to do it in the most effective way.
For the most part, cloud service providers are leaving this decision up to customers. While cloud providers willingly offer to store or process data for clients, they maintain that the responsibility and liability of securing the data belongs to the organization that owns the data. As a result, many enterprises are now looking at the various encryption solutions that are coming to market to address this cloud conundrum.
ROUNDUP: 12 hot cloud computing companies worth watching
The requirements for a data encryption solution vary from company to company, and even from application to application. Nevertheless, there are some general guidelines that should help organization consider their options:
• Control of data — The enterprise should retain complete control of its data. The cloud provider should have no access to real data in the clear.
• Control of keys — The organization should have complete control of its encryption keys. The cloud provider should not be able to access keys that can decrypt the data.
• Flexibility — The solution should give the organization the flexibility to choose its preferred data security technique (i.e., encryption, tokenization or both) as well as which data fields will be protected, and in what formats.
• Usability — The solution should be transparent to end users so they don’t have to change normal work processes.
• Adaptability — The solution should not require any changes to the application or cloud services where the encrypted or tokenized data will reside. The enterprise is unlikely to be able to change them anyway, so the solution has to adapt to the application, not the other way around.
There are many new cloud encryption solutions coming to market. Vendors see this as a big new opportunity as more companies migrate their applications to the cloud. At this writing, however, many of the encryption solutions are application-specific — they have been developed with a particular target application in mind. These types of solutions often require some integration effort on the vendor’s part to adapt to different cloud applications.
Now there is a new solution just announced that is designed to support any cloud application. This allows an enterprise to deploy and manage encryption across multiple cloud applications with a single system. Obviously, the fewer security solutions an enterprise needs to deploy, the easier it is to manage the data environment.
Connect AnyApp from CipherCloud unifies data security across multiple clouds ranging from public SaaS applications to private clouds behind a firewall. Connect AnyApp is built on the CipherCloud Gateway, a software appliance that an enterprise installs within its data center or has hosted by a trusted third party. The gateway is a stateless appliance that performs encryption and tokenization of data before the resulting ciphertext or tokens are sent to the designated cloud applications.
The CipherCloud gateway sits between end users and the applications they need. It supports multiple protocols, including HTTP, HTTPS and SMTP, and others. The architecture of the gateway is application independent, which allows it to work with — as the name implies — any app. The enterprise directs traffic intended for the cloud application through the CipherCloud Gateway, where policies are set to determine which data fields get encrypted or tokenized, and in what format. For example, if the organization is sending data to a cloud-based CRM application, it may choose to encrypt customer phones numbers, but leave the area code digits in the clear to facilitate operations such as searches and sorts.
As the example shows, an emerging trend with data security solutions is to preserve some data format so that operations can be performed on encrypted or tokenized data. This is critically important when users need to work with information within applications. Can you imagine trying to select a specific customer record in a CRM application if it’s impossible to search for it because the search field is completely encrypted or tokenized?
CipherCloud uses standard AES 256 encryption with a FIPS 197 certification. The solution also uses FIPS 140-2 cryptography, and supports the option for customers to use hardware security modules for encryption key generation, storage and the encryption process. Using format preserving encryption is a new area of cryptography and organizations can choose if they want to use it.
CipherCloud’s solution also offers the option of tokenizing data. That is, replacing real data with random characters that are not linked back to the real data by algorithms, as in the case of encryption. Tokenization is useful for structured text such as Social Security numbers or account identification values. It also helps an organization meet data residency requirements that dictate that sensitive data in any form — in the clear or as ciphertext — cannot leave the physical borders of a specific geographic region. Since tokens are random characters, it doesn’t matter if they cross borders in cyberspace.
Organizations need to take steps to secure data in the cloud. CipherCloud has a single solution that addresses security for practically any cloud application.
Linda Musthaler is a principal analyst with Essential Solutions Corporation. You can write to her at LMusthaler@essential-iws.com.
______________________________________________________________
About Essential Solutions Corp:
Essential Solutions researches the practical value of information technology, and how it can make individual workers and entire organizations more productive. Essential Solutions offers consulting services to computer industry and corporate clients to help define and fulfill the potential of IT.
