Cloud encryption - client-side vs server-side

The uncertainty over whether to transition to the Cloud seems to be dwindling as predictions by Gartner¹ estimate 60% of server workloads will be virtualized by 2014. How secure our data is, and what measures can we take to protect our files, are now the questions at hand.

Security configurations operated by either the client² or the server³ ensure the protection of data in both storage and transit by encrypting the uploaded files. Encryption of data is an essential security tool for organizations using the cloud. But there are significant differences between these two configurations, which could put your data at risk.

Server-side encryption manages your encryption key along with your data, encoding the information once it is uploaded to the provider. In comparison to client-side encryption, this method limits the complexity of the network environment whilst maintaining the isolation of your data. However the key material to encode and decode is stored together with the information it is employed to protect, leaving the data vulnerable to anyone trying to access it. Providers may agree to keep your data confidential, but can use the data for their own use, for example to improve search results or deliver advertisements. For this reason, some servers will resist to use client-side encryption. The Cloud Security Alliance reported management operated from cloud providers hosting the data prevents providers from unauthorized disclosure of customer data, and advised customers to retain complete control. This can be achieved by using client-side encryption methods.

"Zero-knowledge service", known as client-side encryption, allows you to maintain the keys (passwords) without the management of the server. The ability to decrypt files is only possible using the key created by the individual user. Data is therefore protected against law enforcement requests, as providers do not have access to the encrypted files. With individual-user power comes also responsibility; good key management and data backup should be implemented, as passwords cannot be retrieved when lost (in most cases).