In the 2009 movie Cloudy with a Chance of Meatballs, food instead of rain begins to fall from the clouds. Today’s hybrid computing environment employs so many applications using cryptography that clouds are saturated with crypto keys, and you don’t want to find that yours are falling from the cloud into the hands of cybercriminals. In this blog, and in an accompanying blog from our strategic technology partner Cryptomathic, we explore the critical need for key management in the hybrid cloud, particularly among banking and financial applications.
According to MarketWatch:
Globally, the financial cloud market is expected to grow from USD 16.55 billion in 2018 to USD 46.03 billion by 2023, at a CAGR of 22.7%. Increasing digitalization across the globe and a growing number of financial institutions that demand advanced IT solutions to gain genuine competitive advantage rather than building and maintaining an expensive IT infrastructure are the key driving factors for the growth of the market.
However, financial services, for obvious reasons, is also one of the most heavily regulated industries. Virtually every regulation that covers the protection of personally identifiable information includes the financial services industry as do such widely applied regulations as PCI DSS, the European Union’s eIDAS and PSD2, the Monetary Authority of Singapore’s Guidance, the U.S.’s Gramm-Leach-Bliley Act, and many more around the world.
Consequently, as financial services organizations take advantage of the cloud to better serve their customers, they must keep in mind that loss, theft, or misuse of even a single critical key can have significant impact on their organizations, including the need to issue breach notifications, loss of revenue, falling share prices, and serious reputational damage.
The recently published Ponemon Institute Global Encryption Trends Study offers some insight into this challenge. The study of 6,457 security and IT professionals in multiple industry sectors across 17 countries found that the top use cases for encryption of sensitive data are associated with cloud adoption. Use of encryption with public cloud services grew 21% over the past four years, and encryption for containers – one of the main technologies accelerating cloud adoption – grew 18% in just the past three years. When asked what the main driver for using encryption was, 47% of respondents said it was to comply with external privacy or data security regulations and requirements. As noted above, banks and financial services organizations are more heavily regulated, and therefore demand more robust security to fulfil their auditing and compliance needs.
The market for encryption is growing, and with more encrypted data we have more encryption keys to manage. As cryptographic keys underpin the security of applications and data on-premises, in the cloud, and in hybrid environments, properly managing their lifecycle is fundamental. Encryption is only effective if you protect your crypto keys, and that is where hardware security modules (HSMs) come into play. HSMs protect critical cryptographic keys in a dedicated, hardened, hardware-based appliance that establishes a root of trust over your keys, your applications, and your data. Cybersecurity professionals consider the use of HSMs to be a best practice. Deployed on-premises or in the cloud, nShield HSMs deliver FIPS 140-2 Level 3 and Common Criteria EAL4+ certified key protection, access control enforcement, and secure code execution. Giving organizations the option to supplement or replace HSMs in their data centers, nShield as a Service enables users to extend cloud-based cryptography and key management across multiple clouds, align crypto-security requirements with organizational cloud strategy, and simplify budgeting for business-critical security while decreasing time spent on maintenance and monitoring.
The way forward
Interestingly, the Ponemon study also found that the top 10 HSM use cases in 2020 include public cloud encryption. Fifty-six percent of organizations surveyed in the study said they would own and operate HSMs on-premises, and access them real-time by the cloud-hosted applications. When asked if they would lease HSMs from public cloud provider hosted in the cloud, 42% said they had that on their plan for this year.
Perhaps most relevant to this discussion are the findings related to the importance of key management. The use of HSMs for encryption and key management has grown from 33% in 2013 to 64% today. So, more organizations are using hybrid cloud environments to store and process their data, but at the same time, they must comply with increasingly stringent regulations. Key management and HSMs are “key” to their success.
Your critical keys might not be falling from the clouds, but if not well protected, they can certainly fall into the wrong hands. Cryptomathic and Entrust address the key management challenges experienced by banks and financial institutions with a certified bank-grade key lifecycle management platform. To learn more, check out our on-demand webinar: Key Management for the Hybrid Cloud