As Dropbox tries to appease irate customers after the weekend debacle where it accidentally turned off passwords to all user accounts, debate rages about the security of the encryption scheme used to protect data on cloud services.
It’s not "surprising" that companies embrace online storage solutions such as Dropbox because they are very convenient and allow companies to expand storage capacity easily, Bassam Tabbara, CTO and co-founder of online storage company Symform, told eWEEK. However, the Dropbox incident should act as a reminder for organizations to "carefully evaluate" how safe their data really is.
Tabbara recommended that data should be encrypted before it leaves the enterprise. Dropbox relied on server-side encryption, which meant the files were encrypted in the cloud, not locally. Even though the file transfers themselves were encrypted as Dropbox used HTTP over SSL, having the keys on the server meant the cloud provider has ultimate control over the data, not the user.
Key management is "too complex" to push down to the end-user, Mushegh Hakhinian, a security architect at cloud provider IntraLinks, told eWEEK. "It sounds good on the surface for end users as they get full control but inevitably it means that they take on additional costs and responsibilities," Hakhinian said.
There needs to be a layered approach, where master keys are used to protect other keys used to encrypt user data, Hakhinian said. More importantly, the company has to ensure those keys are securely stored in a data center.
Wuala, an online storage service provided by external storage company LaCie follows a layered approach advocated by Hakhinian. "Encrypting your files before they are sent to the cloud makes Wuala inherently more secure than solutions that rely on server-side encryption," Luzius Meisser, CTO of Wuala, wrote on the company’s blog June 21. However, Meisser shies away from claiming this system is "100 percent secure."
"If the user chooses an easily guessable password like ‘12345,’ security is somewhat limited," Meisser told eWEEK.
