Kevin’s Korner
Is it safe in the cloud?
Two interesting articles came across my desk in the last two weeks.
A report by the Cloud Security Alliance highlighted that 67% of the respondents hold sensitive data in the cloud but did not feel confident that they were protecting the information adequately.
Sensitive Data in the Cloud | CSA (cloudsecurityalliance.org)
This was followed the next day, although it was published in May, by a piece from the NCSC covering the misconceptions users have about the use of cloud based key management systems (KMS).
Mythbusting cloud key management services – NCSC.GOV.UK
Is the fear of leaving the keys to the kingdom in the cloud with the data outweighing the risk of a data breach?
Firstly the “cloud” is someone else’s computer, whichever way you look at it. And yes, all the best advice tells you not to store your encryption keys with the data. For the vast majority of cloud service providers keys are not stored on the same infrastructure as the data but are obviously accessible to it.
One of the key (pun intended) advantages of KMS is that the cloud service provider has the resources and skills to properly implement key management, to a lot more granular level that you have time to do yourself and ensure that the encryption protocol in use is up to date and as secure as it can be. Why give yourself the extra task and hassle of maintaining your own keys when it can be provided by a service with the skills to do it properly.
There is also the question of whether you generate your own keys, known as Bring Your Own Keys (BYOK) to be held in the KMS, rather than it generating the keys for you. But you will need to load those keys into the KMS from your environment, meaning there is a risk of them being intercepted and thereby become useless.
One thing you must do is ensure that the cloud service provides you with an audit log of all access to your keys. While the keys are provided by the service, they are still YOUR keys, so you need to ensure that you can demonstrate that you know when keys are changed, accessed, or removed.
Both articles are worth a read, but even if you already feel you are adequately protected, I encourage you to read the NCSC article.
Lynne’s Latest
Keeping Children Safe online
As we know, over the last few years many children have had to be schooled remotely due to the pandemic, meaning they needed to have access to devices and the internet. This then put pressure on parents to educate their children about the dangers they can face online. To do this it is important for parents to be educated themselves. Below is some great advice that can be applied ready for children going back to school and during the summer holidays.
There are three main categories that children face whilst online:
- Strangers
Many online games now allow your children to interact with other children, but unfortunately how do we know that the person on the game is actually a child and not a predator trying to catfish them and gain personal information, or worse…
- Peers
It is very easy for your children to be attacked by bullying or harassment from other kids on messaging apps. Some apps now have disappearing messages/images that only appear for a few seconds, so your child has no proof of what has been sent to show you as proof. This also means it’s easy for others to share information about your child or images with others online in this way.
- Themselves
Uneducated children online pose a risk to themselves. They might click buttons which installs software that could compromise their device and steal any personal information.
However, there are a lot of free information and resources out there for parents and children to help with online safety. These are just a few that I have found whilst doing some research that you should check out:
Parents and Carers – UK Safer Internet Centre
Keeping children safe online | NSPCC
Individuals & families – NCSC.GOV.UK
The above advice are just suggestions to keep children safe online, but we encourage parents to do their research and be cautious of what your children do online and who they talk to.