1. Azure Encryption Anthony Turner anthturner.com
Azure encryption session
Going to discuss how to keep your data secure in the cloud using Encryption and tools provided by Microsoft/azure
will be discussing why encryption is important, how it can help you, and how it works.
will be showing how to use some of the SDK’s and tools to actually encrypt your data easily
Anthony Turner
anthturner.com

2. {in-krip-shən} encryption
[to change information from one form to another especially to hide its meaning]
Introduction

3. Why Do I Care?
“I’m only one person on a planet of over 7 billion; no one is looking at me.”

4. Commercial Data Breaches
These are becoming more common; each year, the number and severity of commercial and governmental data breaches is on the rise
Can be used for corporate espionage, personal revenge, or identity theft

5. http://www. informationisbeautiful
Anthem – 2nd largest medical insurer in the states – 2015
Private details on 79 million people were stolen, in each case plenty of information to facilitate identity theft
Mexican Voter Database – (April 14th)
93 million records on voters in Mexico discovered sitting unsecured and publicly available on an Amazon AWS server in the United States, despite strict data governance laws that make it a crime to move this data outside of Mexico.
US Voter Database – late last year
300gb of government data was discovered sitting unsecured on the web by a researcher named Chris Vickery – it contains information on every registered voter in the united states, around 200 million people (around half of all people in the US). Unclear where it came from, or how it was left exposed. User error.
Snapchat

6. It’s not just companies!
“Celebgate” was the release of the private data of high-profile celebrities in late 2014
Came from a combination of social engineering, phishing, and brute-force guessing answers to security questions
Partially due to a lack of multi-factor authentication to iCloud
Rise of “RATs” (Remote Access Trojans)
Viruses that can read files, view a user’s screen, and access an attached webcam
Generally more individually-targeted but sometimes gathered with broader browser- based exploits

7. Governments can even store your data…
NSA $1.5B data center in Utah, completed construction in May 2014
Architected to support storing 1 Yottabyte of data
1 Yottabyte is over 5700x the annual hard drive production of Seagate
Designed to store complete contents of e- mail, cell phone calls, Google searches, and personal data trails

8. … but can they protect it?
Edward Snowden
Released around 1.7 million NSA documents to the media in 2013
Office of Personnel Management
Hackers stole personally identifiable information for over 4 million government employees
SF-86 form stolen in OPM leak

9. https://cybermap.kaspersky.com/
Your home and/or work PC are probably under attack right now!
- Average survival time of a brand new install of an operating system without patches is 13 hours according to SANS

10. Encryption can limit, mitigate, or prevent data leaks for everyone.
Why Do I Care?
Encryption can limit, mitigate, or prevent data leaks for everyone.

11. Types of Algorithms
Ok, lets take a quick look at the two broad categories of encryption algorithms

12. Symmetric Asymmetric Encrypt and decrypt with the same key
Encrypt with one key, decrypt with another
Cryptographic algorithms fall into two broad categories.
Symmetric
Key also known as a shared secret
Asymmetric
- Public private key encryption, or certificate based encryption
AES | Blowfish | 3DES
RSA | ECC | Diffie-Hellman

13. Symmetric-Key Algorithms
Extremely fast conversion of data to cipher text
If data is ever cracked the key is obtained, and all other encrypted
data using this key can be deciphered. May be mitigated with
salting techniques.
Due to speed, often used for large amounts of data.

14. Asymmetric-Key Algorithms
Sort of
Easy to compute in one direction, difficult in the opposite direction
Allows flexibility in key management
Algorithm:
Easy to compute in one direction, but extremely difficult to compute in the opposite direction without special information.
Well, sort of easy – relative to symmetric algorithms the encryption is still computationally expensive. You don’t want to encrypt huge amounts of data with these algorithms.
Masterlock analogy (with a real lock!)
Key behavior:
Flexibility in key management. You can encrypt data without being able to decrypt it, or you can decrypt it without being able to encrypt it.
Two person masterlock analogy?
Stefan opens the lock and holds the key, but hands the open lock to Anthony. Anthony uses the open lock to lock a box with a message in it and sends the locked box back to Stefan who can now open it. The key never left Stefan’s hand, so it could never have been intercepted by someone who could then access all future messages.

15. Two Part Key Public Key Private Key
Allows encryption but not decryption
Can be safely shared without compromising encrypted data
Often publicly indexed as “fingerprints” for people to search for others
In the common use case of encryption, a two part key is used.
- Because public keys can be shared so broadly, having an index of key hashes (fingerprints) is necessary
Private Key
Allows decryption but not encryption
Kept secure

16. Combining Speed and Security: The Envelope Technique
A single-use, symmetric, very long/complex Content Encryption Key (CEK) is generated and used to encrypt the data
A (potentially) multi-use, asymmetric, Key Encryption Key (KEK) is used to encrypt the CEK
The encrypted CEK is stored with the encrypted data in storage
The KEK is stored somewhere safe, and used to decrypt the CEK for future data access
KEK doesn’t *have* to be asymmetric, but it helps

17. This is Great, If You Do It Right
You do not want to come up with your own implementation
Very, very smart people have spent many, many years refining algorithms and implementation details to make them secure. The smallest mistake, from using the wrong random number generator, to padding data incorrectly, can (And will) make your data vulnerable.
These algorithms are based on math that is solid, but they only work if we don’t inadvertently introduce a weakness.
Your job is to identify your scenario, the level of security required, and to choose the best existing implementation to use. Then to use it correctly.
Rely on trusted implementations designed for your scenario

18. Make it Easy With The Right Tools
Client side encryption for Azure storage
Key management with Azure Key Vault

19. Client-Side Encryption with the Azure SDK
.Net and Java
Blobs | Tables | Queues
For blobs, the CEK and metadata are stored with the blob (Content Encrypting Key)
For Tables you specify which properties you want to encrypt, and two reserved properties are used to store the CEK and metadata
For queues, which are just strings, the library uses a custom json format which stores the CEK/metadata in a field along side the encrypted data.
The envelope technique is performed with a AES (CBC) encryption, and the CEK is then protected with your choice of KEK. (Key Encrypting Key)
Uses envelope technique

20. Azure Key Vault Managing your keys for secure access, anywhere
SDK sample left a big gap in keys, they were just randomly generated and had to be managed in some way.
Managing your keys for secure access, anywhere

21. Azure Key Vault
Hosted in Azure on dedicated systems and HSMs (Hardware Security Modules)
Powers most of the encryption-aware services provided by Azure
Available to developers for use in their own applications

22. Key Vault Storage Types
Keys
Secrets
RSA-compatible key material
Can encode/decode data
Can digitally sign/verify data
Hides key material from everyone – keys are generated and stored only in Key Vault
Supports time-window access
Any string up to 25KB
Developer can specify a Content Type to help identify the data scheme on retrieval
Supports time-window access

23. Authenticating to Key Vault
Azure Active Directory supports both user-based and app-based OAuth2 authentication
Key Vault access list entries need to be set up for one or the other
“new KeyVaultClient(GetKeyVaultAccessTokenCallback)”
Need to define a method like: private async Task<string> GetKeyVaultAccessTokenCallback(string authority, string resource, string scope)

24. Authenticating to Key Vault (cont’d.)
User Principal Authentication
Service Principal Authentication
private async Task<string> GetKeyVaultAccessTokenCallback(string authority, string resource, string scope) { return await Task.Factory.StartNew(() => var authContext = new AuthenticationContext(authority, TokenCache); var token = authContext.AcquireToken(resource, AADClientId, new Uri(RedirectUri), PromptBehavior.Auto); return token.AccessToken; }); }
private async Task<string> GetKeyVaultAccessTokenCallback(string authority, string resource, string scope) { var clientCredential = new ClientCredential(ClientId, ClientSecret); var context = new AuthenticationContext(authority, null); var result = await context.AcquireTokenAsync(resource, clientCredential); return result.AccessToken; }

25. CommandS Create or Update a Secret by Name Create a Key
await keyVaultClient.SetSecretAsync("ContosoUsers", "JaneDoe", "JanesPassword123!");
Create a Key
await keyVaultClient.CreateKeyAsync("ContosoKeys", "JaneDoe", "rsa");
Retrieve the Public component of the Key
await keyVaultClient.GetKeyAsync("ContosoUsers", "JaneDoe ");

26. Commands (Cont’d) Encrypt data using the Key
await keyVaultClient.EncryptAsync("ContosoUsers", "JaneDoe ", null, Microsoft.Azure.KeyVault.WebKey.JsonWebKeyEncryptionAlgorithm.RSAOAEP, <data>);
Decrypt data using the Key
await keyVaultClient.DecryptAsync("KeyIdentifier", Microsoft.Azure.KeyVault.WebKey.JsonWebKeyEncryptionAlgorithm.RSAOAEP, <encrypted data>);
Sign data using the Key
await keyVaultClient.SignAsync("ContosoUsers", "JaneDoe ", null, Microsoft.Azure.KeyVault.WebKey.JsonWebKeySignatureAlgorithm.RS256, <data>);
Verify data using the Key
await keyVaultClient.VerifyAsync("KeyIdentifier", Microsoft.Azure.KeyVault.WebKey.JsonWebKeySignatureAlgorithm.RS256, <data>, <signature>);

27. Key Vault Management Powershell C# SDK (Non-UWP)