[Music]
so let's talk about cloud encryption
services and specifically how we're
going to encrypt information or data and
the reason we do that is obviously to
protect it so in other words it provides
us with keys to how we're dealing with
information so we hold a key
and we're able to unlock the information
for our own purposes but other people
can unlock the information and it's a
common security mechanism because if
we're putting something in a public
cloud and we're concerned about other
people accessing the information and
reading it obviously encryption is kind
of a first line of defense in making
that happen but there's different types
of encryptions out there
so in the world of encryption algorithms
there's
symmetric or secret key encryption
there's asymmetric or public key
encryption and those are really kind of
the two
things you need to know we can talk
about different desk encryption and
different bit rate encryption and
different encryption performance
management mechanisms and things like
that but the reality is that we're
dealing with cloud security we just have
to deal with the notion of encryption
that encryption is available to us those
services are able to
add information to the data or have a
key which allows us to protect the
information from anybody who's able to
read it
so
under symmetric or secret key encryption
we have des which you'll hear about a
lot is which is type of encryption
that's able to encrypt data and then we
have the other one which is rsa so this
is basically
i think when you're dealing with cloud
security about as much as you need to
know in terms of how encryption works
and the different types of encryptions
out there so you deal with rsa based or
desk-based you know that it's symmetric
versus asymmetric and it's dealing with
seeking encryption versus public key
encryption and that's the way in which
we divide the algorithms up
so we have two types of encryption as we
mentioned in some of the previous slides
we have encryption at rest and
encryption and flight and obviously they
work together encryption at rest means
that we're encrypting information that
is physically stored in a cloud-based
database and so in other words
either we're doing
encryption of the information as it's
laid down within a storage system such
as s3 or we're encrypting it as it moves
in and out of a database and encryption
can be either dynamic or it can be
static in other words we encrypt
everything that moves in and out of a
database and we do so through one single
batch process which may occur on a
nightly basis and that's kind of static
in nature because we're really not doing
it in a dynamic way we're doing it on an
incremental basis as the need and so as
we put lots of information into a
database we may run an encryption
algorithm which encrypts the database
but does so say on a nightly basis and
that's old school new school
is we do dynamic encryption so as
information is put onto a storage system
or within a database
it's encrypted and it's de-encrypted as
it's consumed
and it's encrypted as it's placed into
the particular storage system or
database the other notion is encryption
in flight and that's pretty easy to
understand because what we're doing is
encrypting things that move down the
wire there's lots of folks that leverage
encryption
at rest but they may not leverage
encryption in flight and what that means
is that as information is transmitted
to the data store and
information
is consumed from the data store that is
exposed so in other words if people have
a network sniffer and can look at the
wires which is fairly easy to do can see
the information as it moves across and
obviously if that's pii information
that can be a real problem so what we'll
do is basically
do encryption in flight
where information is encrypted before
it's sent down the wire to the consumer
and as it's looked at and sent back to
the database or back to the data store
that exists on the cloud it's encrypted
as well so people who
are using network sniffers or other
things to monitor the network and see if
they can get some juicy data off the
network won't be able to because
ultimately it's going to be encrypted
either whether it's on the wire or at
rest when it's on the database or data
store
[Music]
you