SaaS Encryption

As the news around NSA information collection and Edward Snowden continues to dribble out, something that is grabbing the attention of enterprises around the world the topic of “lawful interception”.  The lawful intercept topic has cruised under the radar for a number of years (I was surprised  to see the variety of vendor products enabling interception when I googled “lawful interception”), but Mr. Snowden brought it to the fore. Companies around the globe are rethinking security of their data in light of security and data sovereignty issues raised by the NSA Prism program.

What is lawful interception? While it sounds like a term used in American football, it is a serious issue of concern to most enterprises. National governments can request service providers (think Google, Yahoo, Amazon, etc) to provide customer information for analysis or investigation in the name of national security.  There are various legal vehicles – The US has various laws including the Foreign Intelligence Surveillance Act (think of National Security Letters), the UK has its Regulation of Investigatory Powers Act, etc.  The basic concept is the same – your friendly national government can knock on the service provider’s door and request information relevant to a national security issue.  The service provider holding your information could be compelled in the name of national security to hand it over to the authorities.

Service providers are legally compelled to respond while not informing customers that their information is being provided to the government.  If you are an enterprise with your information in the public cloud, the service provider could hand over your information to the authorities pursuant of an investigation without your knowledge.  Enterprises typically want to know if their information is being handed over by their service providers so they can prepare themselves.

How does encryption play in this?  You would think that if your cloud data is encrypted, is is safe from prying eyes.  Not necessarily. This is a tricky issue that hinges on a few variables:

1. Who holds the encryption keys?

2. Where is the encrypted data stored?

3. Who controls the server hardware?

With those variables in mind, below are a few potential scenarios to consider:

Infrastructure-as-a-Service with IaaS encryption/keys- Enterprises with sensitive data in the cloud can secure their data with encryption, but that data is open to lawful interception if the service provider holds the encryption keys.  One example of this is Amazon S3 encryption – Amazon holds the keys and could be compelled to hand the data and keys to the authorities.

IaaS with enterprise-controlled keys – an enterprise could deploy their own encryption and keys to the cloud, while keeping those keys stored in their enterprise office. However, this provides a false sense of security. Authorities could still request encrypted data and a snapshot of memory from the Cloud Service Provider and parse that memory to get the encryption keys for the data at rest.  Unless you are securing not only the data-at-rest, but also the data-in-use (memory), the authorities could access your data unbeknownst to you.

Gateway Encryption for Software-as-a-Service – For SaaS environments, the enterprise typically needs to rely on their SaaS provider to secure data.  However, gateway encryption solutions can encrypt or tokenize SaaS data at the enterprise edge so that the SaaS provider is only dealing with ciphertext and not clear text.  If the authorities come knocking, they have to knock on the enterprise door to access the data.

What are questions you should be asking internally or of your service provider when it comes to lawful interception?

• Is my cloud data encrypted?  Encrypting sensitive data in the cloud is a best practice.  If it is not encrypted, then accept that a lawful intercept request could occur and your information could be provided to the authorities without your knowledge. If your cloud SaaS data is encrypted at the enterprise gateway, the authorities have to knock on your door to access it.  If the cloud IaaS data is encrypted, then you need to ask the next question.

• Where are the encryption keys?  Do I hold them or does the cloud service provider hold them? If the CSP holds the keys, your data can be compromised without your knowledge.  The CSP could be compelled to deliver the data plus keys to decrypt the data.  If the enterprise holds the keys, the authorities will have to knock on the enterprise door and say “Give me the keys” and unlock the cloud data.   the data is more secure but could still be compromised; the authorities would need to jump through some hoops to do so (decrypting data using keys parsed from memory).

• Is my server memory secure?  If the memory is not secure, the authorities can ask for the encrypted data-at-rest as well as a snapshot of the data-in-use (memory) and parse that memory for the encryption keys.

Lawful intercepts are the flip side of unlawful intercepts.  You might want to know if the authorities are sniffing at your data so you are fully informed, but you also will want to know if some malicious insider within the CSP might be compromising your data.  Considering the lawful intercept issue also addresses the rogue insider problem.