https://tmp.bearblog.dev/disk-encryption-aws-is-close-to-useless-and-potentially-harmful/ Mellow Root About Blog RSS Email Disk encryption in AWS is close to useless and potentially harmful 09 Dec, 2022 Encrypting data at rest has wasted so much of my time I have to vent my frustrations, welcome to the show. Old-school compliance requires your data to be encrypted, which is great in case someone steals your disk. This compliance has followed to the cloud even though you don't even own the disk, instead you check a box in the AWS web interface and now your data is encrypted. But what problems does it solve? Are you worried about someone breaking into the AWS data center, stealing the specific disks your data is stored on, and restoring and analyzing the disk data to target your organization? Just imagine how much effort such an attack would take. What is much more likely to happen is the attacker tries to: * Bribe AWS employees * Bribe someone at your company * Find a vulnerability in your application * Phish someone with access to the data Doing a mission impossible type of thing is probably the last thing they'll try. Now that we've established cloud encryption is close to useless, let's look at some problems with it. Problems caused by encryption Encrypting data this way can be very cumbersome and makes some things harder, or (depending on the configuration) impossible. * Backing up to a different AWS account + You used the AWS default key to encrypt a database? Too bad, you can't store backups in a different AWS account then. Why? Because it's impossible to share the default key with a different AWS account. And no, AWS Backup won't help either. * Delete the key and your data is gone + If you delete the key to the key, your data is gone. Not very surprising of course, but it might be a problem since you can't backup these keys. In their defense, they have a 7-30 day retention time. * Re-encrypting is a pain + If you forgot to encrypt something, you'll need to start from over (you need to take a snapshot and start from that), which is very time-consuming and may require downtime. And don't forget to encrypt it with the right key or you'll have to do it all over again! * Double trouble with access + Not only do you need to configure IAM correctly (which isn't always the easiest) you also have to give the right key access. That's right, KMS has its own permission system on top of IAM, and you need both. This makes it twice as fun debugging permission errors! Edge cases I know there are cases where this encryption helps, that you can use customer-provided CMKs, and that if your IAM access configuration is bad your KMS access configuration might save you, etc. But I still consider disk encryption in the cloud mostly snake oil, but snake oil we need to fulfill compliance requirements. Spend time elsewhere I suggest spending your time on IAM permissions, backups, disaster recovery, appsec, or pretty much anything else instead. Focusing on cloud encryption is probably one of the last things to focus on unless you have some urgent compliance requirements. Trying to exploit an unencrypted drive is not worth it for an attacker. Compliance is a tool to make sure organizations have a baseline for security, but forcing people to spend a lot of time on this crap is counter-productive. That time could instead be spent on other, more relevant, security mitigations. That means working on this actually reduces security (in terms of lost opportunities.) I don't blame AWS I just want to point out that I don't blame AWS for most of these things. This is a compliance requirement and AWS tries to make it as easy as possible for you to be compliant. Even though I only mention AWS in this post, there are similar problems with other cloud providers. The UX of AWS is sometimes questionable of course, but it's not the root cause of the annoyance. --------------------------------------------------------------------- Follow my blog: [ ] [ ] [Subscribe] or RSS #rant #aws #security [23710 ] [ ] ^ Toast this post - 6 toasts Made with Bear ?**?