From fragmented encryption chaos to uniform data protection

Encryption is so critical to enterprise security that it’s almost like air: It’s a necessity, it’s everywhere, and we can’t live without it.

On the surface, having encryption everywhere seems like a great idea. However, in many ways the drive to achieve ubiquitous data security has undermined itself. That’s because often the only way to approach ubiquity is by combining a variety of point systems, vendors, and technologies to cover data in a dizzying combination of various states and potential locations (on site, in the cloud, in use, at rest, and in motion).

This is not only inefficient, but it also increases complexity—a known enemy of security. Multiple, separate encryption systems can cause confusion or obscure what asset in which location area is protected, as well as which data, in which states, are subject to specific policies and management. This hodgepodge of encryption systems prevents knowing with all certainty what is encrypted in each data state—resulting in a data perimeter potentially riddled with holes or expensive overlaps.

There are many accounts of data breaches in organizations that assumed encryption would protect their data when stored or transmitted. In reality, encryption was either not being applied in the way expected, or it was subject to rules or conditions that didn’t provide the desired level of security. In other words, encryption complexity resulted in dangerous gaps.

Furthermore, because of the inability to count on the ubiquity of underlying protections, applications often build in additional security controls that overlay other encryption mechanisms used throughout an organization. Leaving data security to the application adds to the complexity—requiring many per-application encryption instances to be deployed and managed. This results, again, in potential gaps, inconsistency of policies or coverage, and limitations in scale across enterprise application portfolios.

The most significant issue with piecemeal encryption is that it often covers only stored or transmitted data. Today virtually no organizations extend encryption to the processing or execution of data at runtime, where it is especially vulnerable to bad actors or software. Leaving data in the clear in memory—the default in virtually all computer hosts today—is akin to only locking some doors on a building but not bothering to lock all the others. A central tenet of security is that an entity is only as secure as its weakest link. Many organizations assume that their data is fully protected. They aren’t even aware of the vulnerability that exists in unencrypted memory at runtime. Lack of data-in-use encryption undermines all other encryption controls.

This data-in-use security gap also weakens all other encryption schemes. Encryption keys are often continuously held in memory, which means they are continuously exposed as they are continuously used. Attackers know how to get these and how to essentially defeat these encryption systems simply by dumping and sorting through unencrypted memory. To continue the analogy, this problem is like locking the front door but leaving the key under the door mat.

Encrypting data during runtime has only recently become feasible. This type of technology is built directly into the current generation public cloud infrastructure (including clouds from Amazon, Microsoft, and others), ensuring that runtime data can be fully protected even if an attacker gains root access. The technology shuts out any unauthorized data access using a combination of hardware-level memory encryption and/or memory isolation. It’s a seemingly small step that paves the way for a quantum leap in data security—especially in the cloud.

Unfortunately, this protection for runtime data has limited efficacy for enterprise IT. Using it alone requires each application to be modified to run over the particular implementation for each public cloud. Generally, this involves re-coding and re-compilation—a fundamental roadblock for adoption for already stressed application delivery teams. In the end, this becomes yet another encryption/data security silo to manage—on each host—adding to the encryption chaos.

Enterprise IT needs a single uniform software construct for securing data that covers all states of data anywhere that eliminates potential gaps and complexity. From a technical perspective, this security construct could extend across providers and clouds delivering a continuous perimeter of protection that could also be centrally managed. This security facility should not only make data security easier to manage but also allow workloads to be processed virtually anywhere, protected by security enhanced hardware—found in public cloud facilities located in even in untrusted geographies.

This contiguous and ubiquitous implementation creates another opportunity to drive security into the infrastructure and away from the complexity of implementing in “application space.” By enhancing the operating environment, overhauling applications to leverage the underlying hardware-level and hardware-grade security facilities becomes unnecessary. Perhaps even more powerfully, it subsumes those capabilities as a service of the underlying software stack, creating a singular, transparent, and impenetrable data perimeter that virtually eliminates data attack surfaces, even in multi-cloud environments.

The bottom line is, yes, encryption everywhere is a great thing. But when implemented in a piecemeal way, it introduces gaps and complexity that organizations don’t want or need. Implementing encryption as a seamless, integrated system across public cloud infrastructure will enable organizations to dramatically improve data security while reducing management complexity and costs.