Protecting sensitive data is crucial in the face of growing cyber-attacks, meaning robust security measures are necessary. While backup and disaster recovery (BDR) play a significant role in data protection, other technologies such as volume encryption offer additional protection against a broader range of threats, especially unauthorized disclosure of sensitive information. This can include confidential customer information, financial data, intellectual property, and other confidential information stored in the cloud that could be valuable to competitors, hackers, or other malicious actors.
Data protection refers to security measures and processes put in place to secure and protect data from unauthorized access, use, disclosure, alteration, or destruction. Volume encryption helps to ensure data confidentiality and privacy, protecting data residing on a storage device by encrypting it using a mathematical algorithm, making it extremely difficult (if not impossible), for unauthorized users to access the data, even with physical access to the device.
Things to consider with Volume Encryption:
Key Management:
Proper key management is critical to the security of encrypted volumes. Encryption keys like SSH keys and server TLS/SSL certificates must be stored securely and protected against unauthorized access.
Algorithm Strength:
The strength of the encryption algorithm used is important in determining the security of encrypted volumes. Strong encryption algorithms are recommended.
Compatibility:
Encryption software should be compatible with the operating system and hardware being used.
User Access:
Encryption should be designed to allow authorized users to access encrypted data while denying access to unauthorized users.
Futureproofing:
Encryption technology and standards are constantly evolving, and it is important to ensure that the encryption solution is able to adapt to future changes and advancements.
Compliance:
Encryption may be subject to legal and regulatory requirements, and it is important to ensure that the encryption solution meets any relevant compliance standards.
Understanding the Threats to Businesses
In the third quarter of 2022 there was a sharp increase in data breaches after a slower pace in the first half of the year. Surfshark reported that data breaches rose by 70% compared to the previous quarter, totalling 108.9 million affected accounts.
Considering the real risks involving threats, whether internal or external, the encryption of data volumes is something that should be considered. To maintain compliance, proprietary hardware or software solutions can be used, but it inevitably ends up increasing costs, making the investment unfeasible, in addition to generating vendor lock-in and incompatibility with administrative tools.
In addition, it is necessary to ensure that, when removing a volume, considering that cloud infrastructures share storage resources, the data present in the volumes are unreachable, thus guaranteeing a safe disposal process. Volume encryption is a critical component in a comprehensive data security strategy across any business vertical, regardless of enterprise size. By encrypting the volumes, confidential information is protected, thereby complying with data protection regulations, and reducing the risk of breach.
Making Volume Encryption feasible using Open-source Technologies
Open-source solutions have demonstrated for decades to be able to provide a robust solution for most use cases and are the foundation of some of the biggest global cloud infrastructures.
The Linux operating system provides a layer of encryption (Linux Unified Key Setup (LUKS)), and it is commonly used for full disk encryption. LUKS is a vendor-independent tool, which also ensures compatibility and interoperability among various other tools while also guaranteeing a secure and well-documented password management implementation, in contrast to most proprietary volume encryption solutions which utilize diverse, non-compatible, and undocumented formats.
Conclusion
By encrypting volumes in Apache CloudStack, service providers and enterprises can reduce the data breaches’ risk, ensuring that sensitive customer information remains confidential, and help comply with data protection regulations such as the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
This new feature is a part of the Apache CloudStack 4.18 release.
—————————–
[1] https://surfshark.com/blog/data-breach-statistics-2022-q3
Marco Sinhoreli is a seasoned Technical Marketing Manager at ShapeBlue, with over 25 years of IT experience. As an Apache CloudStack expert and committer, he specializes in creating and delivering technical marketing content that bridges the gap between technology and business. Marco has consulted major companies on implementing IaaS solutions with CloudStack, focusing on delivering cloud infrastructure that supports both immediate and long-term business needs. When he’s not diving into cloud solutions, Marco loves playing guitar, exploring new places, and staying updated on politics.
