We recently received a request for help. An enterprise had been trying to secure their data on the “process level” and gotten into some difficulties. They asked us to jump in and help them out.

What is a “process”?
If you know a bit about software and operating systems (OS), you’ve heard about “processes”. Modern operating systems, such as Linux or Windows, will run your software applications inside separate processes. This is an OS technique for isolating different software. For example you can make sure that whatever your web server is doing – it cannot touch the memory of your database server; and vice versa.

This sounds like a good thing for security, and it is. It is also essential for reliability and stability. Bugs in one software application will less often cause trouble in other software applications, even if they are running simultaneously in the same physical memory, due to being separated into different “processes”.

Any software developer will tell you the above is a simplistic explanation. But it’s enough to go on for the purposes of this blog.

What is “process-level control”, and why do you care?
Your OS allows you to have a different “owner” for each process. Usually you do not know about this, since it is handled by default when software is installed or configured. For example, if you have installed Apache on a Linux server, chances are the default “owner” is called “www-data”; while the MySQL database may have a default “owner” called “mysql”.  Details will vary according to OS flavor and version. It’s geeky stuff.

Your system administrator cares about this because it is helpful for controlling your data and ensuring proper ownership and security. For example, if somebody hacks one process – perhaps your web server – then process-level ownership is one more layer of protection. In this example, the “www-data” owner cannot immediately read the “mysql” files, which makes life just a bit harder for the hacker.

How did we help?
The right way is to “fit in” with the operating system. The Porticor approach is to integrate deeply with the built-in mechanisms of Linux, Unix and Windows, so the ownership concept of these OS-s is transparently passed to whatever data is saved (or retrieved) from a Porticor-encrypted storage.

Typical benefits can be illustrated by repeating the example above. Suppose Porticor has set up a couple of encrypted disks. As always in Porticor, they are encrypted automatically and without hassle, using different keys for each disk. Now suppose the Apache server regularly saves files in disk 1, with owner “www-data”; and the MySQL database regularly saves records and tables in disk 2, with owner “MySQL”. Porticor will make sure that OS ownership rules are enforced, so that a “www-data” user cannot possibly look into a file or directory owned by “mysql”, or vice versa.

The same thing is true also on the Windows operating system, of course.

This is done by integrating smoothly with the OS, so it just works. We find our customers like the approach.

The post Cloud encryption and process-level control appeared first on Porticor Cloud Security.