1.1 Introduction
Cloud computing is the delivery of computing services such as servers, storage, databases, networking, and software over the internet, allowing organizations to access resources on demand without maintaining extensive physical infrastructure (Mell & Grance, 2011). The increasing adoption of cloud computing has transformed the way organizations store, process, and manage information by providing flexibility, scalability, and cost savings. In the banking industry, cloud technology supports digital banking operations, improves service delivery, and enables efficient management of customer information. However, the growing reliance on cloud services has also increased concerns about the security and confidentiality of sensitive data stored in cloud environments. Data confidentiality is one of the fundamental principles of information security and ensures that sensitive information is accessed only by authorized users. One of the most effective methods of protecting cloud data is encryption, which converts readable information into an unreadable format that can only be decrypted using the correct encryption key (Stallings, 2017).
As a prelude to other parts of this study, this chapter will discuss the background upon which this study was initiated, the statement of problems that led to this study, the aim and objectives of the study. Others are significance of the study, scope of work, research hypothesis and questions, limitation of the study and definition of terms.
1.2 Background of Study
Cloud computing has become one of the most important technological innovations in the modern digital era because it provides organizations with convenient access to computing resources such as servers, databases, storage, networking, and software through the internet. According to Peter Mell and Timothy Grance (2011), cloud computing is a model that enables convenient, on demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort. The widespread adoption of cloud technology has transformed the way organizations conduct business by reducing infrastructure costs, improving operational flexibility, and enhancing service delivery. As organizations continue to migrate sensitive information to cloud platforms, concerns regarding the protection of confidential data have also increased.
Data confidentiality remains one of the fundamental objectives of information security because organizations handle valuable information that must be protected from unauthorized access and disclosure. According to William Stallings (2017), data confidentiality ensures that information is accessible only to authorized individuals or systems. In the same vein, Bruce Schneier (2015) asserted that protecting confidential information is essential for maintaining trust, preventing financial losses, and preserving organizational reputation. Cloud environments store large amounts of sensitive information, including customer records, financial transactions, business strategies, and personal data. The increasing sophistication of cyberattacks has made the protection of confidential information more challenging, thereby requiring organizations to adopt stronger security mechanisms capable of preventing unauthorized access.
Encryption has become one of the most effective techniques for protecting sensitive information stored in cloud environments. According to Stallings (2017), encryption converts readable information into an unreadable format that can only be restored through the use of the correct cryptographic key. Similarly, the Cloud Security Alliance (2022) reported that encryption significantly reduces the risk of unauthorized disclosure even when cloud infrastructure is compromised. Moreover, European Union Agency for Cybersecurity (2021) stated that strong encryption strengthens data protection by ensuring that confidential information remains inaccessible to attackers who do not possess the required encryption keys. Although encryption provides a high level of security, its effectiveness depends largely on the proper management of encryption keys throughout their operational lifecycle.
Encryption keys are the foundation of every encryption system because they determine who can encrypt or decrypt protected information. According to the National Institute of Standards and Technology (2020), encryption key lifecycle management involves the generation, storage, distribution, usage, rotation, backup, archival, revocation, and secure destruction of cryptographic keys. Likewise, the Cloud Security Alliance (2022) affirmed that ineffective key management weakens encryption regardless of the strength of the cryptographic algorithm being used. Furthermore, Niels Ferguson and Bruce Schneier (2003) contended that poorly managed encryption keys expose organizations to unauthorized access, insider threats, and data breaches. These observations demonstrate that encryption alone is insufficient without a comprehensive lifecycle management strategy that protects keys throughout their entire lifespan.
The rapid digital transformation within the global banking industry has increased dependence on cloud-based technologies for financial operations and customer service delivery. According to International Data Corporation (2023), financial institutions continue to expand their investment in cloud infrastructure to improve scalability, operational efficiency, and innovation. Correspondingly, IBM (2023) reported that financial institutions remain among the primary targets of cybercriminals because they process highly valuable customer and financial information. Building on this perspective, the World Economic Forum (2023) stated that strengthening cybersecurity has become a strategic priority for organizations operating within the global financial sector due to the increasing frequency of cyber threats.
Nigeria's banking industry has experienced significant technological advancement through the adoption of digital banking, mobile banking, internet banking, and cloud-enabled financial services. According to the Central Bank of Nigeria (2024), financial institutions are expected to implement effective cybersecurity measures that protect customer information and strengthen confidence in digital financial services. Supporting this position, the Nigeria Data Protection Commission (2023) reported that organizations handling personal information must implement appropriate technical and organizational safeguards to ensure data confidentiality.
Guaranty Trust Bank (GTBank) has established itself as one of Nigeria's leading financial institutions by embracing digital transformation and modern banking technologies. The increasing use of cloud-enabled applications has enabled the bank to improve customer experience, enhance operational efficiency, and support continuous service availability. However, the migration of sensitive financial information to cloud environments also introduces new security challenges associated with unauthorized access, key compromise, insider threats, ransomware attacks, and evolving cyber risks. According to IBM (2023), the financial impact of data breaches continues to rise, particularly within industries responsible for managing confidential customer information. Corroborating this assertion, the Cloud Security Alliance (2022) reported that inadequate encryption key management remains one of the most significant security weaknesses affecting cloud environments despite advances in encryption technologies.
This study is set against the backdrop of the increasing adoption of cloud computing in the banking sector, the growing sophistication of cyber threats targeting financial institutions, the critical importance of protecting customers' confidential information, and the need for a structured cloud encryption key lifecycle management approach capable of strengthening data confidentiality in GTBank, Lagos State.
1.3 Statement of Problems
Investigation revealed that many organizations using cloud computing still face challenges in protecting sensitive information because encryption keys are not properly created, stored, shared, rotated, or destroyed throughout their lifecycle. In the banking sector, where customers' financial records are stored electronically, weak key management practices reduce the effectiveness of data encryption and expose valuable information to cyber threats (National Institute of Standards and Technology [NIST], 2020). On the other hand, despite the use of cloud security technologies, improper handling of encryption keys remains a major concern that affects data confidentiality.
Furthermore, although cloud encryption has been widely adopted, limited attention has been given to developing practical key lifecycle management approaches that specifically strengthen data confidentiality in Nigerian banking institutions. Additionally, there is a need to examine an effective approach that ensures encryption keys remain secure throughout their entire lifecycle. It is against this backdrop that this study seeks to develop a cloud encryption key lifecycle management approach to strengthen data confidentiality in the cloud using GTBank, Lagos State, as a case study.
1.4 Aim and Objectives of Study
The aim of this study is to develop a cloud encryption key lifecycle management approach to strengthen data confidentiality in the cloud using GTBank, Lagos State, as a case study. The specific objectives of this study are to:
- Examine the existing encryption key lifecycle management practices adopted by gtbank for protecting cloud data confidentiality.
- Identify the challenges affecting effective encryption key lifecycle management in gtbank's cloud environment.
- Determine the relationship between encryption key lifecycle management and cloud data confidentiality in gtbank.
- Evaluate the effectiveness of the current cloud security measures used to protect encryption keys in gtbank.
- Develop an improved cloud encryption key lifecycle management approach for strengthening data confidentiality in gtbank.
1.5 Research Questions
The study came up with research questions so as to be able to ascertain the above stated objectives. The following research questions will guide this study:
- What are the existing encryption key lifecycle management practices adopted by GTBank for protecting cloud data confidentiality?
- What challenges affect effective encryption key lifecycle management in GTBank's cloud environment?
- What relationship exists between encryption key lifecycle management and cloud data confidentiality in GTBank?
- How effective are the current cloud security measures used to protect encryption keys in GTBank?
- What improved cloud encryption key lifecycle management approach can strengthen data confidentiality in GTBank?
1.6 Research Hypotheses
In order to pursue the objective of this study, the following generalized statements have been designed to guide and aids in obtaining the result for the experiment to be conducted. For this work, the null hypothesis will be represented with H0 while the alternative hypothesis will be represented with hypothesis H1.
Hypothesis One
- H0: There is no significant relationship between encryption key lifecycle management and cloud data confidentiality in GTBank.
- H1: There is a significant relationship between encryption key lifecycle management and cloud data confidentiality in GTBank.
Hypothesis Two
- H0: The existing encryption key lifecycle management practices do not significantly improve cloud data confidentiality in GTBank.
- H1: The existing encryption key lifecycle management practices significantly improve cloud data confidentiality in GTBank.
Hypothesis Three
- H0: The challenges affecting encryption key lifecycle management do not significantly influence cloud data confidentiality in GTBank.
- H1: The challenges affecting encryption key lifecycle management significantly influence cloud data confidentiality in GTBank.
Hypothesis Four
- H0: The current cloud security measures used to protect encryption keys do not significantly strengthen cloud data confidentiality in GTBank.
- H1: The current cloud security measures used to protect encryption keys significantly strengthen cloud data confidentiality in GTBank.
Hypothesis Five
- H0: The proposed cloud encryption key lifecycle management approach does not significantly strengthen cloud data confidentiality in GTBank.
- H1: The proposed cloud encryption key lifecycle management approach significantly strengthens cloud data confidentiality in GTBank.
1.7 Significance of Study
The outcome of this research will provide useful knowledge on managing encryption keys securely throughout their lifecycle to reduce cloud security risks. The study outcome will also help management understand effective encryption key lifecycle practices that support the protection of customer information stored in cloud systems.
Furthermore, the study outcome will contribute to improved protection of personal and financial information by encouraging stronger cloud security practices. It will also support agencies responsible for banking and data protection in promoting better cybersecurity standards among financial institutions.
Lastly, the study outcome will serve as a reference material for future studies related to cloud encryption, key management, and data confidentiality.
1.8 Scope of Study
This study focuses on the development of a cloud encryption key lifecycle management approach to strengthen data confidentiality in the cloud using GTBank, Lagos State, as a case study. The study covers encryption key generation, distribution, storage, protection, rotation, revocation, destruction, cloud key management systems, and security practices used to protect sensitive information.
The study is limited to GTBank operations in Lagos State and focuses on employees involved in information technology, cybersecurity, and cloud-based banking services.
1.9 Limitations of the Study
During the course of this study, there were some problems encountered which stood as limitations to the research work. Some of the limitations include:
- Delay from respondents was experienced during the collection of questionnaires and responses because some participants had limited time due to their official duties.
- Financial and time constraints were also limitations because they affected the extent of resources available for conducting the research and completing the study within the planned period.
1.10 Definition of Terms
Cloud Computing:
Cloud computing refers to the delivery of computing services such as storage, servers, databases, networking, and software through the internet instead of relying only on local computer systems.
Cloud Encryption:
Cloud encryption is the process of converting data stored or transmitted within cloud environments into an unreadable format to prevent unauthorized access.
Encryption Key:
An encryption key is a mathematical value used by encryption algorithms to secure and unlock protected information.
…