Randy Battat

Cloud Services Are Vulnerable Without End-To-End Encryption

End-To-End Encryption

The growth of cloud services has been one of the most disruptive phenomena of the Internet era.  However, even the most popular cloud services (including Yahoo, Gmail, Microsoft Outlook 365, and Dropbox) are vulnerable to attack because their servers operate on unencrypted data.

The move to cloud-based services offers enormous benefits compared with managing these services in-house.  The cloud is scalable, cost-effective, easy to manage, and accessible to a wide range of devices anywhere.

But because cloud services represent a centralized repository of information, they are tempting targets for attackers.  If an attacker is successful in breaching a single user’s computer or phone, that user’s information will be compromised.  But if an attack targeting a server is successful, information forall users on that server can be leaked.  For example, Yahoo recently disclosed that over a billion user accounts were compromised.

Accordingly, the security industry has invested heavily in technologies and processes to protect cloud servers.  Many of these – such as firewalls, threat detection and analysis, and administrative processes – amount to “building taller walls” around the server.  But despite great effort and investment, attackers continue to prevail.

Assume the server is breached

What if the problem is turned around?  Instead of figuring out how to protect the server, what if the focus is on protecting the data whether or not the server has been compromised?  This can be achieved with end-to-end encryption, which means user data is decrypted only on computers or phones; never on the server.  Therefore, if the server is breached an attacker will only be able to access encrypted data, which is unintelligible.  Unfortunately, end-to-end encryption is rarely used.

Many cloud providers tout their use of encryption for security, but the term “encryption” can mean many things.  Most services use something called ­encryption-in-transit.  To show how this works, we’ll consider a generic cloud-based email service.

As shown in the diagram above, encryption in transit uses encryption to secure a message when it is being transmitted from a phone or computer to a server, often using technologies like SSL (Secure Sockets Layer) or TLS (Transport Layer Security).  This prevents an attacker from watching Internet traffic and gleaning the contents of communication.  The decrypted message is available at both the device and the server.  This makes the server vulnerable to attack, because a successful breach of the server gives the attacker access to all the decrypted messages.

In attempt to address this problem, some cloud services also use encryption-at-rest, as shown below:

Encryption-at-rest means that data is encrypted in the storage media on cloud servers when not being used.  Encryption-at-rest could prevent an attacker from accessing information on physical disks that were stolen from a data center — although such physical attacks are exceedingly rare.  Encryption at rest still cannot prevent an attack on the server from leaking valuable user data because the server can still “see” the decrypted information.  If the server can access the raw data, so can an attacker.

End-to-end encryption can solve the problem by adding the missing link – encryption-in-use –  as shown below:

With end-to-end encryption, the server never has access to decrypted data.  The message is encrypted in the device of the sender, and it’s not decrypted until it reaches the device of the recipient.  Thus, a server attack will not compromise any user information.  An attacker may attempt to breach a single user’s device, but such an attack affects only that user – not everyone on the system.

What about Gmail, Outlook 365, and Dropbox?

Unfortunately, most major cloud service providers do not use end-to-end encryption – including Gmail, Outlook, Dropbox, Yahoo, and many others.  This is because these services rely on servers to process emails and files.  The servers absolutely must have access to user data.

In conclusion, a different approach to cloud security is needed – one that simply assumes that attackers will breach servers, so everything stored on the server must be encrypted, and decryption only occurs in users’ devices.  It’s important that the server never has access to the unencrypted data or the encryption keys to this data. If the server can ever see the unencrypted data, then attackers could see it too. In the end, only a well-designed end-to-end encryption system that assumes the server will be breached can afford stronger protection in the cloud.

By Randy Battat

Randy Battat

Randy Battat is Founder, President and CEO at PreVeil, a Boston cybersecurity company that provides end-to-end encrypted email and file sharing.

Before PreVeil, Randy was President and CEO of Airvana from 2000-2014, growing the company from a two-month old startup to a 400-person global corporation. Airvana became the #2 supplier of wireless broadband infrastructure software for the CDMA standard used by operators like Verizon and Sprint, and the #1 supplier of femtocell access points used to provide great wireless coverage inside homes. Randy spent the first thirteen years of his career at Apple, including five years as Vice President of Worldwide Product Marketing and three years as Vice President of the PowerBook Division. After Apple, Randy joined Motorola to run its Wireless Data Group and later became Senior Vice President of Motorola’s Internet and Networking Group, responsible for businesses such as cable voice and data communications, enterprise networking equipment, and wireless content servers.

View Website

CONTRIBUTORS

How Brands Can Use IoT and Wearables to Enhance Customer Experience

How Brands Can Use IoT and Wearables to Enhance Customer Experience

Using IoT and Wearables as Part of the Customer Experience The IoT and wearables are on the verge of completely ...
Identity and Access Management: Advancing to Meet the Changing Needs of Passwords and Governance

Identity and Access Management: Advancing to Meet the Changing Needs of Passwords and Governance

Identity and Access Management The identity and access management market continues to grow in a wide variety of industries of ...
DELUSIONS OF ADEQUACY: WHY PRESIDENTIAL POLICY DIRECTIVE 41 FALLS SHORT

DELUSIONS OF ADEQUACY: WHY PRESIDENTIAL POLICY DIRECTIVE 41 FALLS SHORT

Delusions of Adequacy President Obama’s recent policy directive on cybersecurity was eight years in the making. Unfortunately, its proposed actions ...
Introducing and Implementing Voice Biometrics in Call Centers

Introducing and Implementing Voice Biometrics in Call Centers

Voice Biometrics in Call Centers It wouldn’t be wrong to say that voice biometrics is the way of the future, ...
Four Trends and Realities Confronting Security Today

Four Trends and Realities Confronting Security Today

Realities Confronting Security Today, the number of attempted data breaches, cyber attacks, and other bad behavior by bad actors continues ...
Cyber Security Tips For Digital Collaboration

Cyber Security Tips For Digital Collaboration

Cyber Security Tips October is National Cyber Security Awareness Month – a joint effort by the Department of Homeland Security ...
blockchain

The Global Cloud: Blockchain Could Decentralize SaaS

Blockchain SaaS As the prevalence of SaaS continues to grow, so too does the cloud. You know this because you ...
How Artificial Intelligence Is Revolutionizing Business

How Artificial Intelligence Is Revolutionizing Business

Artificial Intelligence Revolution 84% of respondents say AI will enable them to obtain or sustain a competitive advantage. 83% believe ...

NEWS

OVH Announces New Hosted Private Cloud Offerings for US Market

OVH Announces New Hosted Private Cloud Offerings for US Market

OVH delivers next-generation services for hosted private cloud, disaster recovery, and hybridity leveraging industry-leading solutions RESTON, VA--(Marketwired - Nov 20, ...
Cloud Security Alliance Issues New Code of Conduct for GDPR Compliance

Cloud Security Alliance Issues New Code of Conduct for GDPR Compliance

EDINBURGH, Scotland, Nov. 21, 2017 /PRNewswire-USNewswire/ -- The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices ...
EU privacy regulators to discuss Uber hack next week

EU privacy regulators to discuss Uber hack next week

BRUSSELS (Reuters) - European Union privacy regulators will discuss ride-hailing app Uber’s [UBER.UL] massive data breach cover-up next week and ...

SPONSORS

Hybrid IT Matures Just In Time To Tackle Complex Challenges

Hybrid IT Matures Just In Time To Tackle Complex Challenges

Tackling Complex IT Challenges Today’s sophisticated business environment demands a dynamic and robust IT infrastructure which is a far cry ...
Scale your Windows Azure application

Help Your Business Improve Security By Choosing The Right Cloud Provider

Choosing The Right Cloud Provider Security issues have always been a key aspect of business planning; failure to properly protect ...
The Skill & Training Mandates of Big Data

The Skill & Training Mandates of Big Data

Big Data Mandates For some years a dearth of data scientists and analysts has caused concern, with McKinsey expecting a ...