How Does Amazon Web Services Use Encryption?

Depending on your personality, using a contractor for data storage might be a weight off your mind or a giant source of anxiety. Putting all your company’s information in another company’s hands, storing it on a cloud server that you’re not allowed to walk in and inspect, may raise some well-founded concerns in your mind. These worries can be particularly acute if you contract with a large company, like Amazon Web Service’s Simple Storage Service arm, known to the company as AWS S3. Last year, at Amazon’s annual security conference, some of those questions were answered. Here’s a brief rundown of how Amazon Web Services uses encryption and physical security to protect client data.

How do I know no one is accessing my data on the server?

When you first contract with AWS, you will decide who will have access to your company’s data. You can give individuals access only for a specific action. Anyone who has access receives a unique encryption key which allows them to dis-encrypt the data. If no one else ever gains access to your encryption key, then even if someone gains access to the Amazon storage facility and walks away with your data on a disk, they will not be able to do anything with it.

So how does the server-side encryption work?

Amazon offers a few different options for how to manage your data encryption. You can control all encryption keys, or let Amazon manage them. And you can provide your own encryption or let Amazon do that, too. In the latter case, Amazon uses a 256-bit Advanced Encryption Standard (AES), a powerful block cipher.

What about when I access my data? Is it safe then?

When you request data, your PUT request goes through a server at Amazon’s facility that processes it. During this process, you own all security keys — not only the encryption key, but your username and password. If your credentials are MFA-protected, changed regularly, and protected in all the other ways your IT person keeps telling you about, then this process is perfectly safe.

How is my data placed on the server safely?

For large-scale data transfers, Amazon uses what it calls “the snow family” — Snowcones, Snowballs, and Snowmobiles. These are low-tech and high-security options. Amazon will simply ship you a data storage device or, in the case of Snowmobile, a truckload of storage devices, and you can back up your data on them and either sync them with an Amazon server or ship them to the cloud storage center. For smaller-scale services, you will be able to set up a secure wire transfer from your device to the cloud server. If you don’t like the thought of your data going over an Amazon-controlled wire, you can always set up your own VPN to encrypt the data while it’s uploading to the cloud.

How can I verify that Amazon storage facilities are secure?

This is a question people tend to have about AWS specifically. They don’t permit customers to inspect their facilities, so how can you guarantee that this arm of a giant international corporation is paying enough attention to your data? What if the warehouse burns down or is burglarized? While clients aren’t allowed in, third-party inspectors regularly go through the cloud storage facilities and make sure they are up to code in security and compliance concerns. You can also audit your stored data at any time with the S3 Inventory tool, in case you ever find yourself anxious about whether it’s really all there.

For more advice on how to manage your company’s data responsibly, keep reading our blog, or visit our website to browse our suite of business services. For inquiries, don’t hesitate to contact us.