When to encrypt?

[DPKJ]

Recently we have seen huge growth in data encryption and related policies in industry. Two of the most important driving factor in this are,

1. Cloud services
2. GDPR and related compliance

Encryption of data is good thing. But sometime due to lack of knowledge or by blindly following norms, we end up creating encryption overhead.

Some examples of this are,

• Encrypting communication inside server
• Creating encrypted database on encrypted disk storage
• Double encrypting

I think, we must understand encryption before we start using it. It has hidden cost on performance of product.

I would like to hear about bad encryption norms that you all have seen. It can help us learn, "when to encrypt, and when to avoid".

[Matt Doar]

I think it's helpful to think about what is mostly trusted and what is not trusted. For us at the moment that's something like

Not trusted:

1. Network to your Jira server
2. Network to your load balancer
3. Network from load balancer to Jira Data Center nodes

Mostly trusted

1. In memory jvm process contents
2. Physical access to servers
3. ssh access to servers

Encrypted databases are commonly not used, but may be more in the future I think

[DPKJ]

Well said @Matt Doar 

"Trust" should be one of the important part when we decide for encryption.

[Metin Savignano]

This is an interesting point of view. I often see companies encrypting their internal (in-house) client/server connections using https/tls, while at the same time not caring about confidential information being sent via unencrypted email. 

However, in my experience, the problems are usually not about too much encryption, but rather not enough encryption. 

[DPKJ]

@Metin SavignanoI liked your point of view.

What are your views on performance vs encryption?

[Metin Savignano]

It is difficult to outweigh one against the other. Is it okay to reduce security for a better performance? I don't think so. If you need encryption, then you must pay for it with reduced performance and/or increased hardware requirements.

I see your point that unnecessary encryption generates unnecessary costs (or performance degradation), but I am having problems to find an example for unnecessary encryption.

For example, I once thought that it is overdone to encrypt internal connections, but I had to learn that it it makes perfect sense to protect such connections from attacks within the network. Therefore, I hesitate to consider any type of encryption useless.

[Martien Verbruggen]

We generally try to find a balance between security and performance and convenience in our cloud platform, but we lean towards as much security as is affordable. As always, trade-offs are hard, and you should never just assume it's one or the other.

The way we approach the problem is to simply switch on security if we can pay for it with extra hardware. Then we optimise hardware use if it's too much. For example, we generally use AWS encryption of data at rest, and TLS on pretty much all network end points. We also sign a lot of our communication payloads cryptographically, and optimise the cache-ability of those signatures.

We don't just switch on encryption without first considering the performance cost though. A good example of that is that we built our own global encryption decryption mechanism on top of AWS KMS to handle secrets and personal data at the scale we need to handle it. We presented this solution at AWS summit Sydney (note, AWS asks you for quite a bit of your information, but you can just fill in fake information if you don't want them to have it).

[DPKJ]

@Martien VerbruggenI have seen the talk, and I appreciate this in-depth answer.

Way to go Atlassian!!!