Elasticsearch: Data Security Gap and Portal26 Plugin

Enterprise search platforms such as Elasticsearch take in enormous amounts of data and index it in many different ways to enable high-performance search and analytics. The indexing supports full-featured search including prefixes, suffixes, wildcards and ranges. To make this work, data inside Elasticsearch is live rather than at rest in the underlying file system. Portal26 describes the platform as extremely powerful for search.

• Ingests and indexes large volumes of enterprise data
• Supports prefix, suffix, wildcard and range queries
• Holds live data in indexes rather than at rest

Portal26 states that Elasticsearch is vulnerable from a data security standpoint because if encryption is applied to its indexes, they can no longer support search. With search being the primary purpose of the platform, this presents a paradox for security teams. Underlying platforms can encrypt data at rest in the file system and in transit between nodes using internode TLS, but data inside the indexes themselves remains highly vulnerable. Portal26 identifies the index as the typical breach point, exposed to both external cyberattacks and insider attacks.

• Encrypting indexes breaks search functionality
• At-rest and internode TLS encryption leave index data exposed
• Indexes are the typical breach point
• Insider attacks are a risk alongside external attacks

Portal26 reports that enterprises have lost an unprecedented amount of data from vulnerable Elasticsearch clusters in recent years, with tens of billions of records of highly sensitive data exposed or stolen across financial services, healthcare, high-tech, retail and hospitality. Ransomware actors have exploited this tradeoff by seeking credentials into data-rich Elasticsearch environments or crawling the web for misconfigured or inadvertently exposed clusters. Once inside, they steal large volumes of data and proceed to extort victims. Portal26 notes elsewhere that some ransomware groups have shifted from encryption towards extortion based on exfiltrated data.

• Tens of billions of records exposed or stolen
• Affected sectors include financial services, healthcare, high-tech, retail and hospitality
• Attackers crawl for misconfigured or exposed clusters
• Stolen data used as leverage for extortion

Portal26 describes encryption as one of the best data security controls ever created, and the one mechanism capable of standing up to ransomware and other attackers by making stolen data unreadable. Its Elasticsearch approach extends protection beyond data-at-rest and data-in-transit to include data-in-use. Portal26 also lists data-in-use protection, or searchable encryption, as a key attribute for building cyber resilience against administrator compromise, so that privileged accounts never see clear text data.

• Covers data-at-rest, data-in-transit and data-in-use
• Exfiltrated data retains encryption
• Supports resilience against admin compromise

Portal26 provides a plugin that delivers NIST FIPS 140-2 validated searchable encryption-in-use for Elasticsearch. Sensitive data is preprocessed and encrypted before being indexed, queries are intercepted and reformulated to execute in encrypted form, and by default query results are released in encrypted form. For data in search platforms, Portal26 encrypts both the source data and the index, so that data queried or otherwise exfiltrated retains its encryption and cannot be used as leverage.

• Encrypt indexes with FIPS 140-2 encryption
• Full-featured search and analytics without decryption
• Release data in nine secure and private formats
• Protection of query parameters
• Clear text access granted on a least-privilege basis
• BYOK/HYOK deployment at any granularity
• Support for data protection requirements such as FedRAMP

The Portal26 plugin for Elasticsearch is described as NIST FIPS 140-2 validated. FIPS was developed by the Computer Security Division of the National Institute of Standards and Technology and sets data security and computer system standards tied to the Federal Information Security Management Act. FIPS 140 covers the security requirements for cryptographic modules, including algorithm execution, key creation, and the methods for validating and testing those modules. FIPS 140-2 defines four security levels, from Level 1 upwards.

• FIPS 140 governs cryptographic modules
• Standard maintained by NIST
• Four defined security levels under FIPS 140-2

Portal26 positions encryption-in-use for search platforms alongside its wider data security writing for CISOs. Its next-generation tokenisation offering is described as allowing rich search and analytics without detokenisation or decryption, extending protection beyond payment card data without losing processing capability. Related guidance on the site covers data security posture management, end-to-end encryption, FedRAMP certification and defence against specific ransomware groups.

• Next-gen tokenisation with search and analytics retained
• CISO guides on data security strategies and DSPM
• Ransomware guidance covering BlackCat, Daixin Team and BianLian