Risk
9/22/2006
04:43 PM
50%
50%

Quick, Encrypt Everything!

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices, encryption is gaining traction in more mainstream IT environments (you no longer have to be a three-letter government intelligence agency to justify the investment). That's OK, as long as you know how to properly manage it.

My story in the Sept. 25 issue of InformationWeek navigates you through the tricky process of managing encryption. For those of you who just can't wait until Monday, here's what you should know, along with some examples of what can go wrong.Encryption adds cost and complexity to IT systems that are already expensive and difficult to manage. Why would anyone do that? Simple: They can't afford not to. When the Veteran's Affairs Department in May had a laptop and hard disk drive stolen from an employee's apartment, this loss of data on about 26.5 million veterans and their spouses spurred a tumultuous couple of weeks that put VA Secretary James Nicholson in the hot seat. Calls were made for his resignation, and by the time the situation had calmed down, Pedro Cadenas Jr., the VA official in charge of information security, had announced his resignation and Deputy Assistant Secretary for Policy Michael McLendon had resigned. The VA then moved to sign Systems Made Simple to a $3.7 million contract to install mobile encryption software from GuardianEdge Technologies and Digital Trust on all its laptops by mid-September (a self-imposed deadline the department has subsequently missed, although it reports to be making "good progress").

Other federal agencies have avoided this sort of upheaval by long ago implementing encryption on mobile devices. The Justice Department has for the past four years been using encryption software from Pointsec Mobile Technologies and other vendors on all its laptops. To further contrast the VA's predicament, after the Commerce Department Sept. 21 admitted that 1,137 of its laptops have been "lost, misplaced, or stolen" since 2001, Commerce was quick to point out that it uses "access passwords, complex database software, systemic safeguards and/or encryption technology [to] significantly limit the potential for misuse of data on the laptops." This has kept outrage to a minimum and the focus on why Commerce hadn't reported this sooner, rather than on who's going to pay to provide the victims with free credit monitoring services. Nearly half of the absent laptops were from the Census Bureau, and 249 contained personally identifiable information.

So encryption (as part of a larger laptop security strategy) came to Commerce's rescue. "All of the equipment that was lost or stolen contained protections to prevent a breach of personal information, and we are moving to institute better management, accountability, inventory controls, 100% encryption, and improved training," Commerce Secretary Carlos Gutierrez said in a prepared statement. Since 2001, the Census Bureau has been adding encryption technology on a rolling basis for extra protection, and today all new laptops have encryption protection.

That's the sunny side of encryption as a policy. The dark side involves irretrievable data, networks and systems bogged down by devoting resources to encrypt and decrypt information, and the fact that many network security systems can't adequately inspect encrypted data packets.

Anecdotally, a couple of stories surfaced when I was researching my story that illustrate what can go wrong. One involves a company that had lost a copy of the decryption keys for the data they'd recently encrypted. While details weren't forthcoming regarding how these keys were lost, a source brought to my attention that without access to those keys, this company had essentially done the digital equivalent of shredding all the data it had encrypted.

In another situation, a company fearful of falling into the trap previously described decided it didn't need an automated means of retrieving decryption keys. Instead, it kept an unencrypted copy of the data it had encrypted, just in case something went wrong during the decryption process or its keys were lost. Kind of like locking your door and leaving the key under the doormat.

When it comes to encryption, you've got to be all in, or you might as well find some other way to protect your systems and data. For a more in-depth analysis of the benefits and challenges of properly managing encryption, check out my feature story in this week's issue.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5426
Published: 2014-11-27
MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message.

CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?