Government Cloud Authors: Pat Romanski, Elizabeth White, Dana Gardner, Liz McMillan, Gopala Krishna Behara

Related Topics: Cloud Security, @CloudExpo, Government Cloud

Cloud Security: Blog Feed Post

Cloud Encryption and PCI Thoughts

The tricky issues of PCI compliance, encryption and key management in the cloud are soluble

There is a lot of guidance and expertise on achieving PCI compliance. In virtualized and cloud computing environments it is trickier, yet a lot of expertise is building up there as well. Witness the venerable PCI Security Standards organization and its guideline for virtualization, which includes a section on cloud computing as well.

Yet in some areas, answers are still sketchy. Some of the most important is cloud encryption and key management.

Cloud encryption is obvious – or is it?

Everyone understands that achieving PCI DSS requires encryption or tokenization of sensitive data, such as credit card numbers or personal details. This is even true in physical data centers; it is certainly true for virtualized and cloud computing environments.

So cloud encryption is an obvious necessity. Case closed.

But it is not so simple.

One issue is that any encryption scheme requires encryption keys; and keeping those encryption keys secure in the cloud is not easy.

A second point is that servers working in the cloud (and providing a service) have memory in the cloud. Data in memory also needs to be secured.

Cloud key management

Where to save encryption keys? The best practice for securing encryption keys available today is split-key management. This means that every encryption key is split in two; the first part, a “master key” remains the sole possession of the application owner and is unknown to anyone else. The second part is different for each data object and is stored by a dedicated cloud key management service (read more about it on this white paper).

Such techniques provide a solution to securing the encryption keys, which provides security on a par with physical data centers.

Memory protection and users permissions is critical in the cloud

Protecting the RAM of a server is something that is (almost) never seen as an issue in physical data centers. In the cloud, it is increasingly discussed.

The best modern clouds allow memory access to be tightly controlled. Here are some tips on how to control access to memory.

First and most basic rule: by default, no human has permission to do anything in memory. In practical terms, this means there is no access at all to the virtual box. In techie terms, this means protocols like SSH or RDP are disabled by default.

Starting from that, you add on permissions in a very limiting way. There are three classes of people worth considering: “super” administrators, regular administrators, and end-users of the system.

“Super” administrators need not always exist (analyze your own system to decide if you need them). If they do, they should be very few, and ideally only two people together (for example, each of them knows one half of a password). “Super” admins, if they exist, can make major changes in permissions of the system. Make sure you trust them.

Most of the everyday technical work on a system is done by regular administrators. These essential people should not be all powerful. In fact, in some important ways they should be “weaker” than end- users. In particular:

  • They do not have any master passwords or “root” user access; rather they access systems with admin rights which are limited in scope
  • Some of the important limitations: they cannot change permissions on the system (including their own permissions), they cannot see any end-user data (e.g. in a database system, they cannot do regular ‘select’ statements)
  • Every access is logged and audited
  • The logging and auditing sub-system is not accessible to them (and cannot be changed by them); typically the logging and auditing sub-system will be under ”root” control, and these users do not have root access

End-users, on the other hand, do have access to their own data. In that sense they are more powerful than admins. But they do not have any access to the virtual server “box”, only to the application. They are purely application users.

The tricky issues of PCI compliance, encryption and key management in the cloud are soluble. Feel free to contact us for a deeper discussion.

The post Cloud Encryption and PCI thoughts appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

IoT & Smart Cities Stories
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to impr...
The challenges of aggregating data from consumer-oriented devices, such as wearable technologies and smart thermostats, are fairly well-understood. However, there are a new set of challenges for IoT devices that generate megabytes or gigabytes of data per second. Certainly, the infrastructure will have to change, as those volumes of data will likely overwhelm the available bandwidth for aggregating the data into a central repository. Ochandarena discusses a whole new way to think about your next...
The hierarchical architecture that distributes "compute" within the network specially at the edge can enable new services by harnessing emerging technologies. But Edge-Compute comes at increased cost that needs to be managed and potentially augmented by creative architecture solutions as there will always a catching-up with the capacity demands. Processing power in smartphones has enhanced YoY and there is increasingly spare compute capacity that can be potentially pooled. Uber has successfully ...
Chris Matthieu is the President & CEO of Computes, inc. He brings 30 years of experience in development and launches of disruptive technologies to create new market opportunities as well as enhance enterprise product portfolios with emerging technologies. His most recent venture was Octoblu, a cross-protocol Internet of Things (IoT) mesh network platform, acquired by Citrix. Prior to co-founding Octoblu, Chris was founder of Nodester, an open-source Node.JS PaaS which was acquired by AppFog and ...
The deluge of IoT sensor data collected from connected devices and the powerful AI required to make that data actionable are giving rise to a hybrid ecosystem in which cloud, on-prem and edge processes become interweaved. Attendees will learn how emerging composable infrastructure solutions deliver the adaptive architecture needed to manage this new data reality. Machine learning algorithms can better anticipate data storms and automate resources to support surges, including fully scalable GPU-c...
Predicting the future has never been more challenging - not because of the lack of data but because of the flood of ungoverned and risk laden information. Microsoft states that 2.5 exabytes of data are created every day. Expectations and reliance on data are being pushed to the limits, as demands around hybrid options continue to grow.
JETRO showcased Japan Digital Transformation Pavilion at SYS-CON's 21st International Cloud Expo® at the Santa Clara Convention Center in Santa Clara, CA. The Japan External Trade Organization (JETRO) is a non-profit organization that provides business support services to companies expanding to Japan. With the support of JETRO's dedicated staff, clients can incorporate their business; receive visa, immigration, and HR support; find dedicated office space; identify local government subsidies; get...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO and DXWorldEXPO are two of the most important technology events of the year. Since its launch over eight years ago, @CloudEXPO and DXWorldEXPO have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, we provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading...