cloudAshur, hands on: Encrypt, share and manage your files locally and in the cloud

Cloud storage and collaboration services like Dropbox are convenient, but not every business is comfortable with the level of security provided. If employees are sharing files with customer information or details of your next product launch, how do you make that more secure? You can hope that employees use a strong password and don't get phished; you can hope that they use multi-factor authentication (MFA); or you can use an identity service like Okta or AzureAD that wraps those services in a single sign-on system and enforces MFA.

Or if you want to be a bit more hands-on about it and get more control over where and when employees can work on cloud files, iStorage's cloudAshur (pronounced 'assure') is a 99 (ex. VAT) rugged hardware key for PCs and Macs that stores encryption keys (AES-ECB or AES-XTS 256-bit) and authenticates the computer when you plug it into a USB port (USB-B rather than USB-C).

Give each employee a key and the cloudAshur software, and both local files and files stored in the cloud and shared with colleagues via cloudAshur can be encrypted. They can only be viewed or edited after the physical key is placed into a USB port, a 7-15 digit PIN typed in on the keypad, and a username and password entered into the cloudAshur software to sign into the cloud account. An attacker who successfully phishes for the cloud storage credentials will only see encrypted .IST files that they can't open or even preview -- and so will the user until they plug in the USB key, enter the PIN and sign in.

The inconvenience of having to do all that just to get some work done is balanced by the way cloudAshur brings together files from different cloud services. You see an extra cloudAshur drive in Explorer or the Finder with virtual folders for each cloud service you use, with the files that have been shared with you, and you drag files you want to encrypt into the folder.

The PIN-protected cloudAshur USB dongle from iStorage lets you share enrypted files with other users -- so long as they have matching devices and have logged into the client app.

You can use cloudAshur individually, to protect your own files, and set it up yourself. But if you want to share encrypted files with colleagues, they need their own cloudAshur that's been provisioned with the same encryption key as yours. That means buying the iStorage KeyWriter software, which uses one cloudAshur as the master key and clones the encryption keys to more cloudAshur devices for other people to use.

You can clone cloudAshur dongles from a master device using the KeyWriter software.

If you do that, your organisation can also use the iStorage cloudAshur Remote Management Console (RMC) software to manage users and devices. This gives an admin much more control: you can see who is using the devices and where they are, (including a log of times and files accessed) and if you see unauthorised use you can disable the cloudAshur remotely. You can also set the times and physical locations where the keys can be used, if you want to limit them to business hours and business locations. You can only set one location , using a postcode and a radius around it, which isn't convenient if you want to allow people to work from your different office locations but not from home (and there are no exceptions for VPN connections).

You can also add extra security with the cloudAshure RMC software; encrypting file names so they don't give away any clues, blacklisting known bad IP addresses (annoyingly, you can only do that individually, rather than by specifying the far shorter list of IP addresses you want to allow) and blocking specific file types. The latter is referred to as 'blacklisting', which is confusing when it's next to the IP control setting; we'd also like to see iStorage join other vendors in moving to less contentious terms like 'block' and 'approve'.

The cloudAshur Remote Management Console (RMC) lets you manage users and devices.

Getting the PIN wrong ten times in a row locks the device. You can use the RMC software to change how many wrong attempts you want before this brute-force protection kicks in, and you can use the admin PIN to create a new user PIN. You can also set a one-time recovery PIN that you can give a remote user so they can create their own new PIN. Getting the admin PIN wrong ten times in a row deletes the user PINs and the encryption key. You can't set up the device without changing the default admin PIN -- a fiddly sequence of pressing the shift and lock keys on the device individually and in combination and watching the three colour LEDs blink or turn solid. Even with the limitations of a numeric keyboard, this seems unnecessarily complex.

If someone loses a device or leaves the company without giving it back, you can remotely kill the cloudAshur hardware; you can also temporarily disable a key if it's misplaced (and having both options stops users delaying reporting a key they hope to track down because having to get it reset or replaced will be inconvenient). You can also reset and redeploy a key, so if someone leaves the company you can safely reuse their key (and at this price, you'll want to).

A security system isn't much use if it can be physically cracked open and tampered with. The cloudAshur packaging comes with security seals over both ends of the box, although we were able to peel them off carefully without leaving any marks on the packaging, so a really dedicated adversary who managed to intercept your order could replace them with their own security seal.

The case is extruded aluminium that would be hard to open without leaving marks: iStorage says the design meets FIPs Level 3 for showing visible evidence of tampering and the components are coated in epoxy resin so they can't be swapped out.

The number keyboard is polymer coated to stop the keys you use for your PIN showing enough wear to give attackers a hint. The keys have a nice positive action, so you know when you've pressed them, and the lanyard hole on the end is large enough to fit onto a keyring or security badge lanyard. There's an aluminium sleeve to protect the key from water and dirt -- the device is IP68 rated. The sleeve also stops the battery getting run down if the keypad gets knocked in your bag.

Using cloudAshur isn't particularly complicated, but it is a bit more work than just using a cloud storage service. There are drawbacks like the inability to see previews in the cloud site to check you're opening the right file, and not being able to work offline -- even with a cloud service that syncs files to your device. And any mistakes about the times and locations where people can work could inconvenience employees on business trips.

The biggest threat with cloudAshur may not be hackers but employees who find it too much extra work and just don't encrypt files. This means you'll need to explain why you're asking them to carry a dongle and jump through these extra hoops.

Overall, cloudAshur is fairly well designed and offers a useful security boost -- as long as you can persuade employees to actually use it.

RECENT AND RELATED CONTENT

diskAshur2 and datAshur Pro, First Take: Secure but pricey mobile drives

Kingston IronKey D300 encrypted USB flash drive gets NATO Restricted Level certification

IronKey D300: Ultra durable USB flash drive with built-in encryption

Enterprise companies struggle to control security certificates, cryptographic keys

Google Cloud sets out new encryption controls as it looks to grow in Europe