Cryptography in the Cloud: Protecting Data at Rest and Transit

In a cloud-native landscape, robust cryptography is the primary defense mechanism for ensuring the confidentiality and integrity of sensitive information. As data traverses virtual networks and resides in managed storage services, it must be shielded against unauthorized disclosure and tampering.

Without a rigorous cryptographic framework, even the most sophisticated infrastructure remains vulnerable to data breaches and regulatory failures. This guide explores how to align your cloud infrastructure with international standards like ISO/IEC 27001:2022 Annex A.8.24 and PCI DSS v4.0.1.

Securing Data at Rest: The AES-256 Gold Standard

Protecting stored data is a foundational requirement. All data classified as Confidential should be rendered unreadable through application-layer encryption to prevent exposure in the event of unauthorized logical access.

The Gold Standard: AES-256

Utilize AES-256 encryption—the industry gold standard—across your serverless architecture. For SaaS providers handling payment data, a “no-persistent-storage” approach for Primary Account Numbers (PAN) is a powerful strategy. Instead of storing PAN, focus cryptography on securing ephemeral session identifiers during a short authorization window (e.g., 120 seconds).

Failsafe: Time-to-Live (TTL)

In environments like AWS DynamoDB, use encryption at rest by default. To ensure data minimization, a 120-second TTL acts as a cryptographic failsafe, automatically purging ephemeral sensitive data if primary deletion fails.

Critical Assets to Protect

According to standard Data Management Policies, the following assets require cryptographic protection:

• Personally Identifiable Information (PII): Data identifying natural persons.
• Authentication Credentials: Secrets, private keys, and account passwords.
• Technical Information: Source code, vulnerability reports, and risk data.
• Transient Data: Sensitive Authentication Data (SAD) encrypted temporarily during the processing window.

Note: Protection extends to mobile assets. All company laptops must have Full Disk Encryption (FDE) and be configured to lock automatically after five minutes of inactivity.

Securing Data in Transit: TLS 1.2+

Information in motion is susceptible to interception. To mitigate this risk, enforce strict requirements for network traffic protection:

• Encryption Protocols: All communications between in-scope systems must utilize TLS 1.2 or higher or SSH encryption.
• Prohibited Protocols: The use of legacy protocols like SSL or early TLS is strictly prohibited.
• Public Networks: Strong cryptography is mandatory for any sensitive data transmitted over public networks. Sending sensitive data over unauthorized channels like email, chat, or SMS is prohibited.

Cryptographic Key Management

A cryptographic system is only as secure as its keys. Employ a rigorous key lifecycle management process anchored by tools like AWS KMS and secure credential managers.

Key Management Best Practices

Conclusion: A Multi-Layered Defense

Cryptography is not a standalone tool but a fundamental layer of the broader Information Security Management System (ISMS). By integrating AES-256 at rest, enforcing TLS 1.2+ in transit, and maintaining rigorous key management, you ensure a multi-layered defense that builds trust with clients and satisfies global regulators.