Data Ownership & Encryption in the Cloud

New advancements in encryption technology can help businesses keep their data secure and private even when it is stored with a cloud provider.

A US federal court recently ruled that Microsoft had to give up a clients data stored in one of its databases in Ireland. The decision adds a new element to putting data in the cloud: Cloud providers could be forced to give up their clients data, even if the data is stored in another country, and they have no obligation to notify the client. If thats the case, then clients putting their data in the cloud are essentially giving up control of their data and trusting the cloud provider to advocate for the protection and privacy of that data, says Elad Yoran, the CEO of Vaultive, a provider of data encryption solutions for cloud adopters.

Normally when the government serves a subpoena for a companys data, the companys legal department will try to protect as much data as they can. At the minimum, they will ensure that only data directly related to the subpoena is handed over, explains Yoran, who will be speaking about data encryption in the cloud at Interop in New York City next month.

But if Microsoft gets a subpoena for your data, they have to hand [the data] over, and you dont get a seat at the table, he adds.

[Learn more about the Internet of Things at Interop's Internet of Things Summit on Monday, September 29.]

Losing control over company data in this fashion could understandably make organizations hesitant about cloud adoption. But new advances in encryption technology can help companies keep control over their data even when it resides in the cloud, he says.

Traditionally, data encryption meant encrypting the data when it was in transit or at rest. But in order for the data to be used, it had to be decrypted. For instance, if a company is using a cloud provider for email, then the data has to be decrypted for employees to search their messages. However, new advancements in encryption technology now allow data to be encrypted even when it is in use, which could keep control of the encrypted data in the hands of the client as the data never has to be decrypted on the server.

[For more on data encryption in the cloud: Making the Cloud Secure for Sensitive Data]

The important thing for businesses is that, even if their data is encrypted in use, they have to keep control of the encryption keys, he shares. In that case all the cloud provider can hand over to the government is encrypted data. The government still has to go to the client and ask for the keys, and then they can go through the standard legal process, he explains. Before the provider needed the encryption keys to decrypt the data so that it could be used. Now with encryption in-use, thats no longer the case.

This kind of complete control over important data can be important, particularly for financial services firms when dealing with compliance, since regulators have begun to focus on data privacy and security. One financial services client that works with Vaultive had previously dismissed using cloud-based Office 365, because it knew that having the data decrypted by Microsoft could raise concerns among its regulators, Yoran says. But once the people in that company found they could encrypt the data in-use, they were able to adopt Office 365. They can also tell their auditors that they have complete control over their data in the cloud, he adds.

View original post here:
Data Ownership & Encryption in the Cloud