Businesses put their faith in core technologies like blockchain, encryption, multi-party or distributed strategies, zero trust access, and more, and with good reason. But, at the same time, businesses are hiding the keys under a figurative doormat, and this could compromise all of these safeguards.
When an insider or attacker can take control of the private keys that protect it, strong encryption is of little use. This vulnerability exists when keys have to be processed on servers. Bits and bytes can be secured by encryption while they are in storage or transit, but when they have to be executed on a CPU, they are “in the clear” to conduct necessary computation. They are, therefore, accessible to malicious insiders, threat actors, and external parties like consultants, partners, or even providers of the hardware or software used in data center infrastructure.
Although encryption offers good security for transit and storage, the process has a weakness when it comes to execution, which is always necessary for code, data, or digital assets to be usable or to facilitate a transaction.
For their initial creation, the decryption or encryption necessary for key exchange, some aspects of key management, like handling expired public keys and the process of digital signatures, private keys need to be executed using a CPU. Certain Multi-Party Computation (MPC) and blockchain tasks fall under the same general principle—the requirement for execution in the clear on a CPU. More generally, since CPUs need code and data to be “in the clear,” even the simple act of executing encrypted application data or code exposes them.
Also Read: Blockchain – Appreciate the Human Minds Behind the Success of the Technology
Understanding the Exposure and the Risks
CIOs must regularly communicate with their teams to assess this potential exposure and understand the risk, and formulate plans to address it.
Fortunately, recent breakthroughs have been able to close this encryption gap while still providing complete protection for private keys. Leading CPU vendors have incorporated security hardware into their advanced microprocessors, preventing unauthorized access to data or code during execution or later in what remains in memory caches. Most servers, particularly those used by public cloud vendors, now have chips that use a technology known as confidential computing.
This secure enclave technology bridges the encryption gap and secures private keys, but it has necessitated changes to IT processes and code that can be time-consuming. It is unique to a particular cloud provider and complicates future code or operational process changes. Fortunately, new technology eliminates the requirement for such changes and may offer multi-cloud portability on an infinite scale. In other words, the technical disadvantages have been nearly eliminated.
Securing Private Keys
CIOs should communicate with their management leads and teams about how private keys are safeguarded and what exposure gaps may exist during processing. The same is true for executing encrypted data and code at rest and in motion. What potential gap or exposure does data or code have?
Businesses that use proprietary application code along with a secret key must consider how the secret key is protected and the risks it may face. If it uses Machine Learning or AI in applications, the algorithms it has developed are likely to be extremely valuable and sensitive.
Addressing the Execution Gap
The execution gap does not stop with the public cloud. On-premises data centers and private clouds both face similar challenges. CIOs must determine whether and how the gap is being bridged. It may seem counterintuitive, but using confidential computing in the public cloud may be the most secure location for executing algorithms, code, and data. If an enterprise is not currently using the public cloud due to concerns about the potential exposure of proprietary or regulated data, it may be time to reconsider.
Also Read: Strengthening Enterprise Cybersecurity to Combat Rising Cyber Attacks
Businesses usually know and can control who has access to what in private clouds and on-premises data centers by combining network, physical, and application security, monitoring or logging, and zero trust access. Concerns about the public cloud have revolved around how to prevent third parties, unauthorized insiders, various software or hardware components from third parties, and attackers from gaining access. With confidential computing, those concerns may be completely eliminated.
CIOs must challenge popular and widespread notions of encryption being completely secure and the certainty of blockchain and MPC. Because private keys are so crucial, leaders must ensure that they are safeguarded using the best practices and technologies available.
For more such updates follow us on Google News ITsecuritywire News. Please subscribe to our Newsletter for more updates.
