Cloud Security Questioned After Heartbleed Bug

Security teams at many companies are still dealing with the aftermath of the NSArevelations from Snowden when hit with another huge blow this week. SSL, theencryption layer for the Internet, was found to have a major bug that would allow anattacker easy access to usernames, password, and encryption keys. “These allegationsfurther question the security of all data crossing the Internet,” Adrian Sanderball, SecurityAnalyst at Actium Consulting.

A key question for many security professionals is whether encryption technology issecure, or even if cloud security can ever be truly achieved. Encryption was seen as theultimate tool for making sure data is secure when being transmitted online. Documentsleaked by Edward Snowden shows the NSA actively worked to undermine theeffectiveness of encryption in order to make data more accessible for mass surveillanceof Internet traffic.

Even encryption vendor RSA was brought into the mix when it was revealed thecompany may have received $10 million from the US government in exchange forinserting weaknesses into encryption technology the company sold to corporate andgovernment clients worldwide. Now, Heartbleed is calling into question SSL that is usedto protect data as it’s transmitted between companies and websites.

One of the biggest barriers to large companies adopting on-demand SaaS applications iscloud security. Even with SSL, many companies feel that cloud services are not doingenough to encrypt data when stored in the application. Now that data being transferred toand from the cloud, and even encryption keys themselves are vulnerable, many securityanalysts are recommending companies employ cloud encryption gateways to encrypt dataon premises behind the firewall before uploading to a cloud service.

By encrypting data and keeping control over the encryption keys, companies can ensurethat if there’s a breach or their data is accessed by a third party, it won’t be viewed by athird party. That step, say experts, is what’s needed before the largest companies willhave faith in cloud security.