Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Standardising cloud encryption is key to improving security

The first problem that we lawyers have when we hear "data" and "cloud" used in the same sentence is that data is valuable, and the cloud concentrates that value

Article comments

Ah, the cloud. Much has been written about the benefits and drawbacks of storing massive amounts of corporate data in remotely located servers around the globe. As a lawyer who works with technology companies, I feel that one of the less appreciated disadvantages of the wholesale movement of data to the cloud is the extent to which it can cause lawyers to lose sleep (and hair).

The first problem that we lawyers have when we hear "data" and "cloud" used in the same sentence is that data is valuable, and the cloud concentrates that value. Having large amounts of business and consumer data stored on Internet-connected servers tends to attract the wrong sort of attention.

To paraphrase Willie Sutton, this happens because large storage providers are where the data is. Fortunately, the largest providers (like the banks that drew Sutton's interest) know this, and so they build strong walls and safeguards to secure the ever-increasing amounts of data they are contracted to store.

But as the amount of stored data increases, the law of large numbers predicts that the number of attempted and successful intrusions will rise as well. And so it has. For instance, from January 2009 to February 2012, there were approximately 300 publicly reported data breaches, and an unknown but likely larger number of unreported incidents. The Identify Theft Resource Center reported that hacking represented over 30% of the data breaches recorded during the first six months of 2012, on pace for a record year.

The second problem is that the damages from a data breach can be breathtakingly large. Even if a business merely suspects a security breach, the costs begin to pile up. First, the task of discovering the nature of the breach and the extent of the damage will require technical and legal experts and their associated fees. If the investigation requires critical servers to be taken offline, then any lost revenues will add to the total.

Further legal assistance will be required to evaluate the potential liability (especially if any sort of financial or healthcare data is involved), analyse mitigation strategies and navigate the patchwork of federal and state laws related to data privacy and security. Notification of customers and associated remedial measures, including arranging for data theft insurance for affected individuals, will also not come cheap.

Finally, there is the unquantifiable reputational damage from the publicity surrounding such an event - the affected business may need to undertake broad marketing campaigns to overcome the negative impressions and win back customers.

Faced with these two problems, lawyers asked to advise on a cloud-computing plan might be inclined to just say no rather than compromise their ability to get a good night's sleep. But balanced against these very real drawbacks are benefits that are just as real: the ease of use and lower cost afforded by cloud-based storage. Denied the option of saying no, the lawyers turn their attention to the cloud-computing contract and use it to assign responsibility and liability between the parties. In legal jargon, this task is known as "risk allocation."

Naturally, data security liability is often the subject of aggressive negotiations, especially in an environment where the background threat level is much higher than in the past. For obvious reasons, customers desire the best security possible for their data. Providers, for their part, will assume responsibility for their own failures but are keenly aware that hackers may penetrate even the best-defended system.

The argument about risk allocation tends to become an even louder argument about the provider "insuring" its customers against the risk of a data breach. After the shouting dies down, the parties are generally able to reach agreement after evaluating the types of data involved and the security measures to be used. One security measure, encryption, seems to be more effective at pacifying the parties than any other.

From a business perspective, encryption theoretically reduces the value to third parties of any data compromised in a breach, thereby mitigating the associated cleanup costs. From a legal perspective, this reduced value lowers the risk to be allocated and shifts the focus to the encryption techniques to be used.

As a bonus, encryption may provide data owners with a degree of control over the data that they otherwise would not have in cloud-computing environments. For example, document retention policies may be made more "cloud-compatible" with a combination of encrypted data and time-sensitive keys.

Of course, all technologies involve trade-offs. Encryption requires higher processor overhead at one or more levels of the storage chain (although Moore's Law should help with this). Customer-level encryption offers more control over the encryption techniques and key-handling procedures, but it may increase storage consumption requirements due to abandoned-data issues.

I will leave it to the experts to sort out the technical details regarding best practices, but my sense is that the standardisation of cloud-based encryption will help resolve a number of operational and legal challenges facing providers and customers (subject to the lawyers identifying new issues created by its implementation).

It may even leave more lawyers with a full head of hair.


More from Techworld

More relevant IT news


lhlrew said: Supporting a standardised security system is not to be recommended as 46 of security breaches take place by either employees or consultants employed by the CompanyCryptoexpress utilises multi-tiered encyption techniques to ensure all voice and data communications by a companys employees remain fully secured at all times irrespective of whether the communications are via PCs smartphones and tablets over the Cloud

Deb Taylor said: Thanks Brian for a coherent complete and dare I say amusing summation of the concerns many of our security clients have about the cloud encryption and ecurity issues you have outlined SJN Sales is a small company and many of our clients are as well It concerns our security clients and more than a couple of former lawyers at SJN that reviews of current legal and security issues relating to the cloud are being underplayed in the rush to join the very inexpensive cloud bandwagon

Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *