Runtime data no longer has to be vulnerable data

Today, the security model utilized by nearly all organizations is so weak that the mere act of creating new data comes with the immutable assumption that such data will become public and subject to theft or misuse.

The issues related to data access

The industry has been the proverbial slow-boiling frog when it comes to data security. From the time computing systems were first able to store large amounts of data, individuals with no right to that data have accessed it. When connectivity and breaches were rare, nobody cared.

But as more people and computers became connected, waves upon waves of cybersecurity solutions and procedures have sprung up to help organizations keep their data out of reach of threats. Yet, despite the layers of security and processes implemented by IT, hackers and unauthorized insiders are still successful. If attackers gain access to a data center or network, they gain access to data.

That’s because all data—and the software security solutions that try to protect that data—are subject to a fundamental flaw that comes from the era of limited connectivity but persists today: data cannot be simultaneously used and secured.

The reason is simple to understand. All data, including applications, algorithms, and cryptographic keys, must sit exposed and unencrypted in memory so that the CPU can use them. This means anyone or any process that can get access to the host—including administrators, bad actors, or malware—can get full access to this data. This unprotected memory, which often holds decrypted encryption keys, can be easily and covertly “dumped” by using commonly available tools. With keys revealed, stored data that is encrypted can be accessed.

Data breaches continue to grow in number and severity. Today, algorithms and the results of data analytics often have even greater value than raw data, which makes their theft even more devastating. No amount of security software or IT processes can every attacker, and because data is fundamentally defenseless and insecure, data overexposure, breaches, and incursions are bound to happen sooner or later. Yes, expensive new layers of security might make a data breach harder to accomplish, but data exposure is still inevitable.

Many CISOs and business owners may not realize that this flaw can cost their enterprises opportunities. Data insecurity is one of the most often cited reasons for not migrating IT completely to the cloud, which is an option that can significantly reduce IT costs and data risks.

Secure enclave technology: An gold standard for secure data access

Feeling the heat, the IT industry has moved to implement a long-accepted solution for this fundamental data flaw: secure enclaves, in which an encrypted and isolated segment of host memory is rendered inaccessible to any other process outside of the enclave itself.

Secure enclave technology implementations are now featured in virtually every server being developed today. Cloud and CPU vendors supporting enclaves now include Intel, AMD, ARM, AWS, Azure, and others.

In 2019, a group of cloud and software vendors formed the Confidential Computing Consortium, chartered to define and promote the adoption of confidential computing and the use of secure enclaves to create a fully trusted data processing environment in the public cloud that should virtually impervious to a data breach. More than 20 industry leaders have joined the group, including chip manufacturers such as Intel, ARM, and AMD, cloud service and virtualization providers such as AWS, Google Cloud, Alibaba Cloud, and VMware, and secure enclave software providers such as Anjuna Security.

Industry adoption has been broad. Secure enclave-enabled infrastructure is now available around the globe and being deployed by every major cloud service provider.

Market adoption has been limited

With all of these security advantages, you might think that CISOs would have quickly moved to protect their applications and data by implementing secure enclaves. But market adoption has been limited by a number of factors.

First, using the secure enclave protection hardware requires a different instruction set, and applications must be re-written and recompiled to work. Each of the different proprietary implementations of enclave-enabling technologies requires its own re-write. In most cases, enterprise IT organizations can’t afford to stop and port their applications, and they certainly can’t afford to port them to four different platforms.

In the case of legacy or commercial off-the-shelf software, rewriting applications is not even an option. While secure enclave technologies do a great job protecting memory, they don’t cover storage and network communications – resources upon which most applications depend.

Another limiting factor has been the lack of market awareness. Server vendors and cloud providers have quickly embraced the new technology, but most IT organizations still may not know about them. Some simply have not heard of secure enclaves and how they close the gap in data security. Others might assume that hardware-based security is going to be disruptive and difficult.

CISOs and software to the rescue

Simplifying and focusing on secure enclave solutions is now the domain and responsibility of a group of new and emerging secure enclave software vendors. These vendors are now focusing on taking the raw silicon-level capabilities implemented by hardware and cloud providers and transforming them into something that is simple to adopt and use – without the need to rewrite software. There are several companies targeting IoT, enterprise, and other more specialized use cases.

Targeted enterprise enclave solutions will deliver key features that fill out enclave capabilities and make them usable by enterprises both on-site and in the cloud. Foremost of these features is enclave technology independence, eliminating the need for multiple application rewrites. Another feature extends enclave protections to storage and networked communications, which will allow for broad application support without requiring modification.

This will further enable a clean “hop” (or “lift and shift”) from existing on-site infrastructure to an even more secure “confidential cloud.” Most importantly, this will result in the highest data security available, the rationalization of security layers for massive savings, and the next generation of exciting new applications to come in the future.