Industry voice: Why you need to encrypt data in the cloud

The move by large US cloud providers to upgrade their encryption levels speaks to the relevance of data encryption in the cloud for securing sensitive data and complying with data privacy regulations worldwide.

Encryption isn't a yes or no, cut and dry matter. Once you've committed to encrypting your data, you must then figure out how, to what extent and which data you must encrypt. Keep these guidelines in mind as you develop your cloud encryption strategy.

Not all your data will require encryption in the cloud, nor should it. That would be an expensive and ultimately counter-productive undertaking. Nor should all your data be encrypted in the same way.

What works for names may not work as well for social security numbers; for functionality's sake, credit card numbers may need their formats preserved in ways that mailing address information does not.

Because of these conditions, your cloud encryption solution should provide a variety of options, including:

But when it comes to data stored by a third-party cloud service provider (CSP), how can you truly know the life cycle of your data?

Uncertainties surrounding archive, backup and the timely deletion of data, either on your schedule or upon your request, make determining the life cycle of information stored in the cloud a difficult affair. To get around this issue, you need to make sure that no matter how long your data lives in the cloud, your organisation is the only one that holds the keys to it and therefore is the only one that can access it.

That way, when you've decided that the time has come to destroy your data, all you need to destroy is your key. Deleting that key will "digitally shred" your data, rendering it useless to prying eyes no matter how long it exists in the cloud.

As researchers discussed in the International Journal of Engineering and Advanced Technology, storing data in the cloud results in security risks since "the cloud data can be accessed by everyone."

It then notes that "a prevention measure is needed to secure the data from unauthenticated users or intruders." Encryption in the cloud alone may not fully mitigate these risks, either, since any CSP insider with the encryption key can access the data.

Originally posted here:
Industry voice: Why you need to encrypt data in the cloud