All About Cloud Encryption

Cloud computing — the delivery of services and resources such as servers, storage, databases, networking, software and analytics over the internet — has taken center stage. Organizations of all sizes have increased their adoption of on-demand applications and infrastructure.[1] The benefits are clear: the cloud offers companies a foundation for improving efficiencies and remote access to networks and services. The cloud can also help deliver value quickly by enabling organizations to respond to changing market conditions with more agility while cutting costs and reducing maintenance concerns.[2],[3]

When a company relies on its computing services to be “off premises” or in the cloud, ensuring data security is critical. Last year, 36 billion records were exposed through nearly 3,000 publicly reported data breaches, and “most data breaches occurred due to hacking, with 77.5% of events originating outside of the victim organization.”[4] To help solve this security challenge, cloud encryption technology, which encodes data traveling to and from the cloud, can provide effective protection for organizations. Indeed, when dealing with cloud storage, encryption is essential.

What Is Cloud Encryption?

Cloud encryption is one of the strongest forms of protection for companies using cloud services. Put simply, cloud encryption is the process of encoding or transforming data before it is transferred to cloud storage. Mathematical algorithms turn the data from plaintext into an indecipherable format that can only be unlocked with an encryption key, thereby preventing it from being read by unauthorized users.[5]

Because most organizations cannot easily separate their most valuable or sensitive data when using cloud resources,[6] one benefit of cloud encryption is its ability to protect all of the data in transit to the cloud. It’s one of the most straightforward methods of data protection — and helps ensure that the data cannot be breached by bad actors. In fact, all of the major cloud storage providers today offer some form of cloud storage encryption services for their customers.

How Does Cloud Encryption Work?

Cloud storage providers offer their customers cloud storage encryption as a service. In addition, customers who take advantage of cloud applications and infrastructure may opt for additional encryption protection. In either case, an encryption platform takes the customers data (which exists as plaintext) and transforms it into what’s called ciphertext. This ciphertext cannot be read unless converted back into plaintext with an encryption key (and an algorithm then transforms the encoded text back into its original form).[7]

A cloud encryption platform can encrypt the data whenever it is sent to or from a cloud-based application, storage, or to the system’s authorized remote users. The data then exists in an encrypted format on the cloud servers. In this way, cloud encryption prevents any unauthorized individuals or bots from reading the data or files.

Authorized individuals can read the data in its original form only if they have the encryption key. Many of the large cloud storage providers offer services that handle all of the cloud storage encryption processes (encryption, key exchange, decryption) in the background when an individual logs in using their authentication and access protocols.[8]

What are the Types of Cloud Encryption?

When working with a cloud provider, an organization must decide which level and type of cloud encryption they wish to use. These are the three main types of cloud data encryption:

• Data-at-rest encryption: This refers to the encryption of data once it is stored, ensuring that an attacker who gains access to the physical infrastructure or hardware cannot read the data or files. The encryption can be handled on either the cloud provider side (“server side”), the client side, at the disk or file level (or some combination of the three).[9] Server-side encryption is cloud storage encryption that occurs after the cloud service receives the data, but before the data is stored. Most cloud providers offer this option. Client-side encryption occurs before data is sent to a cloud application or cloud storage. The organization (or client) is responsible for encrypting and decrypting the data, maintaining direct control and management of encryption keys (although some cloud storage providers will offer this, too, as a service). Client-side encryption can enable companies to secure only their most sensitive data, which can keep costs down. Many companies use client-side encryption in addition to server-side encryption.
• Data-in-transit encryption: This is encryption that secures data when traveling from your organization’s computers to the cloud provider. The cloud provider’s server exchanges encryption files with the client company’s computers, creating a secure tunnel through which the data travels.
• Data-in-use encryption: This emerging type of encryption is designed to protect data as it is being used. While not yet widely adopted, approaches include “confidential computing,” which offers real-time encryption at the computer chip level and “homomorphic encryption,” which employs an encryption algorithm that only allows certain kinds of computation to be performed on the data.

Benefits of Cloud Encryption

Technology and cybersecurity experts consider encryption one of the most effective approaches to secure data — whether organizations are using the cloud or not. Among the key benefits of cloud data encryption are:

• Proven effectiveness: Using cloud encryption along with secure key management, companies can ensure that unauthorized users are unable to read their data. Even when data, files or hardware are lost or stolen, the data is unreadable and, therefore, useless.
• Compliance benefits: Organizations look to cloud encryption to help them meet stringent regulatory requirements for data protection such as Sarbanes-Oxley Act (U.S. financial reporting), General Data Protection Regulation (EU privacy protection), Health Insurance Portability and Accountability Act (HIPAA, for healthcare organizations) and the Payment Card Industry Data Security Standard (PCI DSS, for e-commerce and retail organizations).
• Customer and employee benefits: Cloud encryption can provide peace of mind for customers and employees who know their data is encrypted and secured.

Challenges of Cloud Encryption

While earlier implementations of cloud data encryption could be cumbersome for users, most modern cloud encryption services are streamlined, easy-to-use and (in many cases) virtually invisible to the end user. However, there remain some common cloud encryption challenges that organizations should understand.[10]

• Increased costs: Any encryption beyond included server-side encryption can drive up the costs of cloud deployments and upgrades. (Although most organizations understand strong data security is its own return on investment.)
• Encryption key risks: The loss of encryption keys can put data at risk. Key management must be a priority.
• Implementation and configuration: Clients must ensure that any cloud encryption services they implement are configured and used properly in order to prevent any gaps in data security.

Best Practices for Cloud Encryption

If your company has used any form of encryption in the past, cloud encryption is likely very similar. The biggest difference is that the cloud provider, in many cases, is responsible for the cloud storage encryption. As a result, organizations must do their due diligence to ensure that the cloud encryption offered meets their security needs. Here are steps your organization should take when exploring and implementing cloud encryption:

• Determine your security needs for cloud deployments. Map out the data that will be moved to the cloud, as well as your security requirements for that data. Determine what data should be encrypted and when it needs to be encrypted (at-rest, in-transit, in-use).
• Understand the cloud provider’s encryption offerings. Take time to learn about the provider's data encryption technologies, policies and procedures to ensure they align with your requirements for the hosted data.
• Consider client-side encryption. When working with sensitive data, opt for on-premises encryption to ensure that the data is protected even if the provider is compromised.
• Invest in secure encryption key management. It’s critical to protect your own encryption keys and those provided by cloud vendors. Store them separately from encrypted data and keep backup keys offsite. Some experts also recommend periodically refreshing keys and implementing multi-factor authentication for keys and backups.

The Bottom Line

As more organizations embrace the cloud, data encryption can provide the level of security required to protect sensitive information and meet regulatory requirements. Companies that take time to understand their own cloud encryption needs, research cloud provider approaches and securely maintain their encryption keys can take full advantage of the benefits of the cloud while mitigating the risks of data breaches.

[1] “Gartner Says Four Trends Are Shaping the Future of Public Cloud,” Gartner

[2] “Top cloud trends for 2021: Forrester predicts spike in cloud-native tech, public cloud and more,” TechRepublic

[3] “The 7 Major Benefits of Cloud Computing for Small Businesses,” The Blueprint

[4] “36 Bn Records Exposed in Data Breaches in 2020,” CISO Mag

[5] “Definition: cloud encryption,” Search Storage

[6] “Lessons from Forrester’s ‘Best Practices: Cloud Data Encryption’ Report,’” Fortanix blog

[7] “Definition: ciphertext,” WhatIs.com

[8] “Definition: cloud encryption,” Search Storage

[9] “Which Data Encryption Mechanism Should You Use?” BuiltIn Expert Contributor Network

[10] “Definition: cloud encryption,” Search Storage