N100FN100F
Published on

Encryption is not enough

Almost everything is encrypted by default today, and data still leaks. Real protection depends on who controls the keys, on knowing which data is sensitive and where it is, and on decrypted access being watched as closely as the encrypted kind.

Service line Cybersecurity

'Everything is encrypted'

It is one of the most reassuring answers in a security review, and one of the least informative. Cloud providers encrypt almost everything by default. But if anyone with access to the database can read it decrypted, the encryption protects against very little: against somebody stealing the physical disk from the data centre.

The three questions that matter

Three questions beyond encryptionClassification, key control and access to decrypted data, with what usually goes wrong in each.SECURITY · DATAThree questions beyond encryption1Which data is sensitive and where is it?Classification: public, internal, confidential, personalWhat usually goes wrong: personal data copied into testing2Who controls the keys?Keys managed, rotated and with every use loggedWhat usually goes wrong: the same person administers keys and data3Who reads the decrypted data?Specific roles, reads logged, periodic reviewWhat usually goes wrong: 'the whole team' has read access Default encryption only protects the physical diskN100F · n100f.com

Which data is sensitive, and where is it? With no classification, everything is protected the same way: either too little or too much. Classifying (public, internal, confidential, personal, for instance) lets you apply more controls where it genuinely matters, and know where each kind of data lives (as in data first).

Who controls the keys? For the most sensitive data, the keys are better managed by the organisation (not only by the provider's default), with periodic rotation, separation between whoever administers the keys and whoever administers the data, and a log of every use of every key.

Who can read the decrypted data? It is the most important question and the most forgotten. Access to confidential data is granted by specific roles, every relevant read is logged and who holds it is reviewed periodically (with the logic of least privilege).

When data leaves

Data also gets copied: to test environments, to analytics tools, to files somebody downloads. Every exit is a leak point:

  • Test environments do not use real personal data without anonymising it.
  • Exports are logged and limited to whoever needs them.
  • Backups have the same protection as the original, because they contain the same thing.

With data protected inside the cloud, one case remains that almost every organisation has and few solve well: securely reaching whatever lives outside it.

How we apply it: Cybersecurity.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk