As organisations move to a cloud-first strategy, with applications and data workloads on cloud, there remain concerns over data security on cloud. Most organisations manage these security concerns by continuing to keep sensitive data on-premise while moving remaining workloads that require elasticity and scalability to cloud. The concern over security on cloud is not just against malicious cyber-attacks but also ensuring that their data cannot be accessed by non-authorised personnel including the cloud service providers (CSPs) and their employees.

This concern about security is one of the largest barriers towards moving sensitive data to the cloud. Confidential computing is an approach to address this and extend the benefits of cloud computing to such sensitive workloads, solidifying the shared responsibility model between CSPs and their customers.

This approach is a privacy preserving computation principle, which uses a hardware-based trusted execution environment (TEE) called an enclave, to protect the data being processed. This enclave is a secure area that runs a quarantined environment to isolate and protect both code and data integrity and security. This is a hardware-level isolation to ensure the data, including code, uploaded to cloud cannot be accessed nor tampered with by malicious actors, the CSPs and their employees. This is a service provided by the CSPs as well as by third party providers.

When looking at data security, we can consider data across its three states:

• Data at rest: encrypting data before storing or encrypting the storage resource
• Data in transit: encrypting the data transmission among networks
• Data in use: encrypting data while it is being used in memory

Most security models focus on the controls for data at rest and data in transit. But for organisations with sensitive data or in a highly regulated environment like government, banking and healthcare, such security models may not be sufficient to meet the security audits and get approvals to move such workloads to the cloud. Confidential computing aims to address this by providing end-to-end data protection through to data in use.

The benefits of confidential computing extends beyond ensuring unauthorised data access by the CSPs and their employees. If data in use is secured, we can expect other benefits, such as:

• Multi-party Data Collaboration

Multiple parties can now team up on cloud to combine data, perform analytics and execute machine learning (ML) algorithms while protecting the confidentiality of their dataset, allowing for more collaboration that otherwise may not be possible or would be too prohibitive to set-up.

• Protect Intellectual Property

Confidential computing can protect both code and data so logic, functions, proprietary machine learning algorithms and applications can all be protected alongside sensitive data. This enables the secured use of Intellectual Property (IP) without handing over proprietary code.

• Edge Computing

With the increasing number of IoT devices, advancement in edge computing and wireless networks such as 5G, more and more data processing are implemented at the edge closer to their data sources. TEE can also be created in edge devices to secure data processing and applications at the edge.

Factors to consider before implementation

While confidential computing can address cloud security concerns and enable placement of sensitive data on cloud, organisations should take into consideration a few factors in your assessment.

1. Performance trade-offs: Organisations should assess confidential computing performance by anticipating the level of data processing and the amount of sensitive data to be protected, to determine if there will be impact to system performance, and if so, what are the enhancements needed to mitigate the performance impact.
2. Cost: Confidential computing comes at an extra cost. As such, the economic benefits and risk impact need to outweigh the additional cloud operating costs. It is likely reserved for high-risk use cases that involve sensitive data.
3. Overall cloud security strategy of the organisation and its workloads on cloud: Organisations should assess how much marginal security improvements can confidential computing provide versus strengthening existing security controls. If there are other security requirements or data residency compliances that need to be met, implementing confidential computing alone may not be sufficient to lower the organisation’s risk assessment score necessary for migration of sensitive workloads to the cloud.
4. Experienced expertise: Confidential computing will require cloud security expertise to set-up and maintain. There is a general shortage of cloud security resources. The addition of confidential computing (a form of preventive control) could add further stress to an organisation’s IT operations that may already be struggling to manage their current operations on the cloud.

Confidential computing is a nascent field in cloud technology, and efforts are still underway to determine how it can be simplified and applied among cloud-native services. The growing interest in this area illustrates how cloud adoption is advancing across industries. Many organisations have migrated a lot of their application and data to the cloud, others have plans in place to do so. Forward thinking businesses are looking ahead to see how the most sensitive, protected and valued data and applications may also make the move to reap the benefits of cloud services.

E. Fang Yap Chief Architect and Partner, NEXT Cloud.