What is a Secure Enclave?
Secure Enclaves: The Powerful Way to Make Data Secure by DefaultExecutive Summary
A major threat to enterprise IT already exists inside your organization: insiders. While most enterprises already take steps to protect systems from end users, credentialed insiders with unfettered access are even more dangerous, and this is not limited to employees. Third parties, including employees at cloud providers, are often to blame for insider breaches. Nation-states and other bad actors, can also present credentials that make them look like insiders.
Current methods and technologies to prevent IT insider threats have had severe limitations. Now there’s a new approach being implemented by nearly every major hardware and cloud vendor. Secure enclaves provide a comprehensive, more secure solution that protects data, applications, and storage from insiders and third parties — on premises, and in both private and public clouds.
What is a Secure Enclave?
A secure enclave provides CPU hardware-level isolation and memory encryption on every server, by isolating application code and data from anyone with privileges, and encrypting its memory. With additional software, secure enclaves enable the encryption of both storage and network data for simple full stack security. Secure enclave hardware support is built into all new CPUs from Intel and AMD.
Insiders: The Threat No One Wants to Talk About
Until now, most cybersecurity efforts have focused on controlling network access by outsiders or end users. The greatest harm, however, is likely to come from insiders — system administrators, network architects, system analysts, developers, and site reliability engineers — who often have authorized access to data, networks, and applications. They may misuse or abuse their access to steal or damage sensitive data. Breaches may also occur unintentionally due to lax security protocols. It’s estimated that 43% of all breaches are committed by insiders — both accidental and intentional.
Probably one of the most infamous examples of intentional insider breaches is the case of Edward Snowden, a Booz Allen contractor working with the NSA. In 2013, Snowden, stole nearly 2 million intelligence files in what is considered one of the biggest thefts of US secrets in history. As a system administrator and architect, Snowden had unlimited access to NSA systems, and he was also able to access files from other sites, including those of other countries.2 The incursions continue to occur. In 2019, two Twitter employees were charged with spying for Saudi Arabia by accessing information on Saudi Arabian dissidents who used the Twitter platform.
In today’s environment, enterprises can never be sure all threats have been detected and handled in a timely manner. Moving to prevention changes the focus from chasing malicious acts that have already occurred to maintaining secure resources and networks.
To ensure enterprise security, protecting data and applications is not sufficient. Memory and networks need to be protected as well. This protection should include not only on-premises applications and data, but also operations that run in both private and public clouds. While today’s approaches protect data at rest and in transit, data in use has not been properly addressed, because it is the most complicated and difficult state to protect.
The Confidential Computing Consortium was founded in 2019, under the auspices of The Linux Foundation, to address this problem. The consortium’s goal is to define and promote the adoption of confidential computing — specifically to protect sensitive data within system memory. More than 20 industry leaders have joined the group, including Alibaba, Anjuna, ARM, Baidu, Facebook, Google Cloud, IBM, Intel, Microsoft, Oracle, Red Hat, Tencent, and VMware.
Secure Enclaves Deliver High-Level Hardware Security
Secure enclaves (also known as Trusted Execution Environments or TEE) are at the core of confidential computing. Secure Enclaves are sets of security-related instruction codes built into new CPUs. They protect data in use, because the enclave is decrypted on the fly only within the CPU, and then only for code and data running within the enclave itself.
Introduced by Intel as Software Guard Extensions (SGX)6, secure enclaves are based on hardware-level encrypted memory isolation. AMD now offers similar functionality with its SEV technology, built into Epyc. By the end of 2020, secure enclaves will be supported by nearly every server and cloud platform, including Intel, AMD, Amazon AWS (with their new Nitro Enclaves)7, Microsoft Azure8, VMware, Google, Docker, and Red Hat.
Secure Enclaves Prevent Critical Threats
As a CISO, you face multiple threats to your enterprise–from stolen data to unauthorized access by systems administrators or SREs. Secure Enclaves can help you prevent a wide range of threats with a consolidated easily implemented approach.
The move to secure enclaves is gaining momentum. Secure enclaves will become standard security technology for the enterprise within the next few years. With the increased use of multiple computing environments — from on premises datacenters to public cloud to edge — now is the time to prepare to implement this level of protection for your operation.
Ask your team these questions:
How do you protect your sensitive applications in the public cloud?
What are your cloud providers doing to address this ongoing insider threat?
Do you have third party exposure? How do you protect your applications and data in untrusted geographies?
Are you concerned with the possibility a government subpoena might demand access to customer data?
Are you prepared to re-write applications to take advantage of secure enclaves?
How important will it be to have a solution that can automatically move applications into a secure environment?
To learn more about how Anjuna makes the deployment of secure enclaves simple and straightforward without the need to rewrite software, see the white paper Preventing Insider Threat.
Original Source Link: https://www.anjuna.io/what-is-a-secure-enclave
