R&S®Trusted Gate by Rohde & Schwarz Cybersecurity

Modern businesses are rapidly digitalizing, increasing the need to store, process, and exchange data securely amid regulatory demands, business continuity requirements, privacy obligations, and rising pressure to protect intellectual property. As infrastructures shift to cloud services, knowledge and critical content that once lived in internal databases is now spread across platforms such as Microsoft Teams and Office 365, Git, Jira, and ServiceNow, while legacy systems move to cloud-hosted IaaS. This dissolving of business boundaries and the move toward hybrid and multi-cloud environments makes communication and document exchange central to core processes—while simultaneously intensifying challenges around information security, compliance, data protection, and IP protection.

In risk terms, cloud environments must be treated as “not trustworthy,” even without assuming provider malice: passive compromise, malicious insiders, and jurisdictional access by state bodies can expose sensitive data. Traditional cybersecurity focused on securing networks, systems, and endpoints is increasingly insufficient in perimeter-less environments where organizations do not control infrastructure. A paradigm shift toward data-centric security is proposed: protect the payload itself so the processing infrastructure becomes irrelevant, assumed potentially hostile, and incapable of revealing meaningful content.

The key challenge is achieving strong protection without breaking usability—especially collaboration and search. Rohde & Schwarz Cybersecurity’s R&S® Trusted Gate exemplifies this approach for Office 365, SharePoint, Teams, and public clouds. It intercepts platform storage interactions, leaving only stub “virtual files” with limited metadata in the SaaS platform while encrypting, partitioning into chunks, and storing content across configurable software-defined storage backends (cloud and/or on-premises). This supports governance, data residency, resilient multi-cloud strategies, secure partner sharing, and even secure full-text search via a dedicated secure index, while keeping end-user workflows largely unchanged.

• Cloud infrastructures must be assessed as “not trustworthy” within a risk assessment framework.
• Data protection can be compromised passively or covertly within cloud environments.
• Malicious actions can be performed from inside a cloud by a malicious administrator or employee.
• State bodies in some jurisdictions can be granted extensive access to data in cloud infrastructures under criminal prosecution justifications.
• R&S® Trusted Gate leaves only stub versions of files with limited metadata in the collaboration platform’s native storage.
• The actual document payload is encrypted, split into chunks, and stored in one or more storage systems defined by the organization.
• Chunks are incomplete by design and cannot be decrypted separately; recombination is required before decryption and access.
• R&S® Trusted Gate can be deployed as a reverse proxy for Office 365/SharePoint or via an add-in that exposes features such as secure search.
• Storage systems can be added, removed, or configured at runtime.
• Secure full-text search in encrypted documents is enabled through a dedicated search engine that creates a secure index.

• “The question of how to secure data in an increasingly perimeter-less IT between on-premises environments, the cloud and anywhere in between is getting more and more important.”
• “This calls for a comprehensive paradigm shift, because infrastructures that are neither self-operated nor managed cannot be adequately protected.”
• “Instead, the focus is on the data itself, i.e. the payload, so that the infrastructure processing it becomes irrelevant from a data security perspective.”
• “As a premise, this infrastructure is postulated as potentially compromised, dangerous and populated by actors to be regarded as hostile, so the information itself must be technically and conceptually safeguarded even in this insecure environment.”
• “The crucial challenge is to provide the highest level of security without compromising the usability of applications.”
• “Without further protective measures, this opens undreamt-of possibilities to obtain access to information that is to be regarded as internal and secret.”
• “End users (employees, partners, communication partners of all kinds) continue to interact with the native cloud or collaboration platform without any friction.”
• “A specific strength of the solution is the fact that it avoids typical shortcoming of traditional encryption solutions, where encrypted data is rendered unusable at rest.”
• “Unlike traditional encryptions solutions which turn e.g. SharePoint into a mere data dump for encrypted data blobs, R&S® Trusted Gate implements a full text search in encrypted documents.”
• “We recommend including R&S® Trusted Gate into the evaluation process when designing and implementing reliable protection, access control and governance for sensitive data in public clouds and collaboration environments like Microsoft Office 365, Teams and SharePoint.”