'Sealed cloud' promises better data security

German certification, auditing and advisory firm TÜV SÜD has set up a “Singapore Sealed Cloud” that it claims will offer enterprises a highly secure cloud storage service.

Powered by patented technology from Uniscon, a company that TÜV SÜD had acquired in 2017, the service allows data to be transferred and processed in encrypted form on the cloud, with both content and its associated metadata protected during data processing.

Andreas Hauser, director of digital services at TÜV SÜD Asia-Pacific, told Computer Weekly on the sidelines of an Industry 4.0 conference in Singapore that unlike public cloud services, data held at Singapore Sealed Cloud cannot be accessed by administrators and cloud service providers themselves.

“The point is simply that when you have critical applications or data, there’s typically an access point used by administrators to access the data. With this technology, cloud providers and administrators cannot access your data even if they wanted to,” said Hauser.

Noting that no system or cloud service is fully secure, Hauser said even if the Singapore Sealed Cloud was hacked, the perpetrators would only be able take off with one dataset, rather than an entire database, “because there isn’t a super-user who can access everything”.

And once a dataset has been breached, it will be deleted within seconds and a duplicate dataset can be restored from another server, he said, adding that there is also no way for anyone to access the data through rogue data processing.

Such safeguards will help to prevent large-scale data exfiltration attempts, such as the one that hit a Singapore public healthcare group in July 2018 when the non-medical information of some 1.5 million patients were stolen in a well-planned cyber attack.

Investigations into the attack by a government committee of inquiry revealed that the attackers had entered the healthcare group’s network through inactive administrator accounts, among other security lapses, including a server that remained unpatched for over a year.

Hauser said although TÜV SÜD is not aggressively selling the secure cloud service, which is being used by the likes of Deutsche Telekom, as well as hospitals and government agencies in Germany, the company is using it to process data for its smart healthcare showcase.

“We’re also about to work with a manufacturer to make sure their data is secure by integrating this service into their processes,” he added.