Defined Categories of Service 2011 - Cloud Security Alliance

Category #8: Encryption
CLOUD SECURITY ALLIANCE SecaaS | DEFINED CATEGORIES OF SERVICE 2011
Description: Encryption is the process of obfuscating/encoding data (usually referred to as
plain text) using cryptographic algorithms the product of which is encrypted data (usually
referred to as ciphertext). Only the intended recipient or system that is in possession of the
correct key can decode (unencrypt) this ciphertext. In the case of one-way cryptographic
functions, a digest or hash is created instead.
Encryption systems typically consist of an algorithm(s) that are computationally difficult (or
infeasible) to break, along with the processes and procedures to manage encryption and
decryption, hashing, digital signatures, certificate generation and renewal, key exchange, etc.
Each part is effectively useless without the other, e.g. the best algorithm is easy to “crack” if an
attacker can access the keys due to weak processes.
Class: Protective
CORE FUNCTIONALITIES
Data protection (at rest and in motion)
Data validation
Message Authentication
Message/data integrity
Data Time-stamping (digital notary)
Identity validation (certificates to identify IT
assets/endpoints)
Code Signing
Forgery detection
Identity validation (digital signatures)
Digital Fingerprinting
Forensic protection (hashing of log files and evidence)
Pseudorandom number generation
Data Destruction (throw away the key!)
Key/certificate generation and management
OPTIONAL FEATURES
Searching encrypted data
Sorting encrypted data
Identity based encryption
Data integrity
Mechanism to ensure secure removal of customer data when
term / contract terminated
Identity assurance (e.g., the parties involved are who they
claim to be)
CHALLENGES
Risk of compromised keys
Searching and/or sorting of encrypted data
Continued on the following page…
SERVICES
Includes: VPN services, Encryption
Key Management, Virtual Storage
Encryption, Communications
Encryption, Application Encryption,
Database Encryption, digital
signatures, Integrity validation
Related Services: VM Architecture,
Hardware protection, Software-based
protection, remote access validation
Related Technologies and Standards:
FIPS 140-2, IPSEC, SSL, Hashing, and
algorithms , Symetric and Asymetric
Cryptography
Service Model: PaaS, SaaS, IaaS
CSA Domains (v2.1): 11
THREATS ADDRESSED
Failure to meet Regulatory
Compliance requirements
Mitigating insider and external
threats to data
Intercepted clear text network
traffic
Clear text data on stolen /
disposed of hardware
Reducing the risk or and
potentially enabling crossborder
business opportunities
Copyright © 2011 Cloud Security Alliance 22