It's often said that in order for a cloud application to be secure, it must support multi-level security (MLS). Multi-level security is the next biggest hurdle to cloud adoption, and implementing encryption at the highest levels of your application is usually the most difficult part of securing sensitive information. However, once an organization determines to encrypt all of their sensitive information, having an appropriate encryption key management solution right from the beginning can be quite an important hurdle to overcome. Fortunately, there are a few steps you can take to make sure you choose the right cloud encryption key management solution and the one that best suits your needs. The first thing to look at is what encryption key management solution is being utilized by your cloud service provider. The level of encryption your company chooses will depend on many different factors, including how confidential your data is, what the cost of the encryption is, and what your needs are as a business. Generally, it's a good idea to spend some time consulting with an SSL specialist to gain a better understanding of which encryption technologies best suit your company's particular needs. It's also a good idea to get a third party to review your documentation and assist with choosing an appropriate cloud solution. While it's a good idea to do as much research into the various technologies and providers as possible, it's ultimately up to your CIO to make the final decision. If you're looking for a good general idea of what your IC cores should include, the Internet is a great place to start. Some of the most common questions to ask are how companies use encryption keys and why (if encryption is necessary) it's important to use multiple layers of encryption. You might also want to inquire as to what methods are typically used to create the cryptographic keys that secure sensitive data. It's also a good idea to ask about what the keys themselves will be protected against, such as through scrambling or locking, or what measures are employed to protect them once they've been created. As your company develops a key management solution, you'll undoubtedly have questions and comments to ask your chosen vendor or provider. This is the time to insist on answers from both parties before signing on the dotted line. Make sure to take notes and be prepared to ask questions later. Often, vendors will provide FAQs on their website. You can also find plenty of information online regarding the various technologies used by different vendors, as well as how your chosen vendor plans to meet your data security goals. Some larger companies may have IT staff that manage encryption keys across multiple locations. If this is the case, you may need to find a provider that uses a physical channel between various locations-an office network or an Internet-connected intranet. There are several advantages to a physical channel including reduced downtime, increased operational efficiencies, and better visibility of key management server logs. Physical channel key management solutions can also help prevent unauthorized access to servers and network locations. Depending upon your current key management solution methodology, you may choose to migrate your data between key stores using a hybrid or mSIP based transaction protocol. Transaction protocols are transport controls that provide security for a specific data type. Common transaction protocols include RLP (Reduced Linked Database) and RTCP (Real Time Data Protocol). The most popular open source RTP implementation is JMS. With this piece of software you can easily integrate your key store with your applications. This post: https://en.wikipedia.org/wiki/Key_management will help you understand the topic even better.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |