By Saaher Muzafer, Chief Sales Officer at Securstore Online Backup
April 20, 2012

Securstore Online Data Backup Expert Tips: The Problem of Securing Data Encryption Key

Data that is transmitted to remote servers in the cloud is often encrypted by the cloud backup software to prevent unauthorized hijacks of information. These cloud service providers use complex 128 bit or 256 bit encryption algorithms that may or may not be certified by third party certifying agencies. They make a claim that their algorithm is bank grade or military grade and has been vigorously tested and is incapable of being broken.

Significantly, all encryption algorithms require a key for the encryption and decryption process. This key may be automatically generated by key generation software and stored securely by the service provider or the customer.

Management experts insist that enterprises may create written policies and procedures for key management using the COBIT, IT governance framework. They suggest that the key should be maintained on a computer that is not accessible to anyone who is not authorized to access the system.

HIPPA (Health Insurance Portability and Accountability Act) in their breach notification rule insists that the encryption and decryption key should be stored in a location that is separate form the data which they encrypt or decrypt.

The Sarbanes Oxley Act requires enterprises to use dedicated key storage devices and applications following the COBIT framework.

The Federal Information Processing Standard (FIPS) 140-2 Level 3 requires the storage of the encryption key in physically secure systems with two part authentication, audit logs and encrypted communication protocols.

It is apparent from the above discussion that the encryption key storage is crucial to the use of cloud services and all kinds of IT services, where data breaches can create problems. A quick review of cloud service providers and their take on key management is revealing. A few cloud service providers insist that a copy of the key will be retained by them in their data base to guard against any loss of key by the customer. This could be a dangerous practice. The customer has no means of knowing who has access to that specific database at the service provider’s end. Other cloud service providers categorically refuse to have anything to do with the encryption key. They warn the customer that it is their responsibility and that no copy of the key is available with the service provider. They specify that the loss of the key will mean the loss of access to information that is stored on their servers.

So, if you have subscribed to the cloud, what is your service provider’s take on key management? How are you securing your key? Is the security protocol in compliance with all the legal mandates that have been discussed above?

Securstore provides a bespoke offsite backup solution catered for customers who have both mission-critical data and non-critical data i.e. it provides customers with a secure & efficient backup and recovery solution which is sustainable over time. This coupled with agentless technology and advanced support for all environments and applications makes it suitable for any type of business, data centre provider or reseller.

Watch Securstore video – guided tours here:

About the Author: Saaher Muzafer is Chief Sales Officer at Securstore, an Asigra based cloud backup provider certified by British Standards Institute for ISO 27001 and ANAB. Established in 1991, Securstore provides businesses and enterprise customers a technically advanced solution in UK, Europe, USA, Africa, Asia and the Middle East.

General Tags: online backup, online file storage, software as a service, online backup companies, online backup news, online backup reviews, SaaS, online file backup, online backup providers directory, data storage, top rated online backups, backing up online, compare online backups, online data backup, cloud computing, data security, CEO interviews, online backup services

Like us on Facebook

Do you like this post? Subscribe to our RSS feed ===========================


Related posts:

  1. Securstore Online Data Backup Expert Tips: Range of Encryption Algorithms – The Choice is yours
  2. SecurStore Online Data Backup Expert Tips: Securing Backed up Data
  3. SecurStore Online Data Backup Expert Tips: Compression and Encryption – The Challenges of Storage
  4. Securstore Online Data Backup Expert Tips: Symmetric Key Encryption for Cloud Computing
  5. SecurStore Online Data Backup Expert Tips: Encryption/Decryption Algorithms – Is your Data Really Safe?
  6. Securstore Online Data Backup Expert Tips: What to Look for While Selecting a Cloud Backup Service
  7. SecurStore Online Data Backup Expert Tips: Maintaining Control Over the Cloud
  8. SecurStore Online Data Backup Expert Tips: Maintaining Control Over the Cloud
  9. SecurStore Online Data Backup Expert Tips: Secure Data Destruction and Cloud Computing
  10. Securstore Online Data Backup Expert Tips: Asigra V12 Snapshots

Tags: , , ,