Risk
9/22/2006
04:43 PM
50%
50%

Quick, Encrypt Everything!

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices, encryption is gaining traction in more mainstream IT environments (you no longer have to be a three-letter government intelligence agency to justify the investment). That's OK, as long as you know how to properly manage it.

My story in the Sept. 25 issue of InformationWeek navigates you through the tricky process of managing encryption. For those of you who just can't wait until Monday, here's what you should know, along with some examples of what can go wrong.Encryption adds cost and complexity to IT systems that are already expensive and difficult to manage. Why would anyone do that? Simple: They can't afford not to. When the Veteran's Affairs Department in May had a laptop and hard disk drive stolen from an employee's apartment, this loss of data on about 26.5 million veterans and their spouses spurred a tumultuous couple of weeks that put VA Secretary James Nicholson in the hot seat. Calls were made for his resignation, and by the time the situation had calmed down, Pedro Cadenas Jr., the VA official in charge of information security, had announced his resignation and Deputy Assistant Secretary for Policy Michael McLendon had resigned. The VA then moved to sign Systems Made Simple to a $3.7 million contract to install mobile encryption software from GuardianEdge Technologies and Digital Trust on all its laptops by mid-September (a self-imposed deadline the department has subsequently missed, although it reports to be making "good progress").

Other federal agencies have avoided this sort of upheaval by long ago implementing encryption on mobile devices. The Justice Department has for the past four years been using encryption software from Pointsec Mobile Technologies and other vendors on all its laptops. To further contrast the VA's predicament, after the Commerce Department Sept. 21 admitted that 1,137 of its laptops have been "lost, misplaced, or stolen" since 2001, Commerce was quick to point out that it uses "access passwords, complex database software, systemic safeguards and/or encryption technology [to] significantly limit the potential for misuse of data on the laptops." This has kept outrage to a minimum and the focus on why Commerce hadn't reported this sooner, rather than on who's going to pay to provide the victims with free credit monitoring services. Nearly half of the absent laptops were from the Census Bureau, and 249 contained personally identifiable information.

So encryption (as part of a larger laptop security strategy) came to Commerce's rescue. "All of the equipment that was lost or stolen contained protections to prevent a breach of personal information, and we are moving to institute better management, accountability, inventory controls, 100% encryption, and improved training," Commerce Secretary Carlos Gutierrez said in a prepared statement. Since 2001, the Census Bureau has been adding encryption technology on a rolling basis for extra protection, and today all new laptops have encryption protection.

That's the sunny side of encryption as a policy. The dark side involves irretrievable data, networks and systems bogged down by devoting resources to encrypt and decrypt information, and the fact that many network security systems can't adequately inspect encrypted data packets.

Anecdotally, a couple of stories surfaced when I was researching my story that illustrate what can go wrong. One involves a company that had lost a copy of the decryption keys for the data they'd recently encrypted. While details weren't forthcoming regarding how these keys were lost, a source brought to my attention that without access to those keys, this company had essentially done the digital equivalent of shredding all the data it had encrypted.

In another situation, a company fearful of falling into the trap previously described decided it didn't need an automated means of retrieving decryption keys. Instead, it kept an unencrypted copy of the data it had encrypted, just in case something went wrong during the decryption process or its keys were lost. Kind of like locking your door and leaving the key under the doormat.

When it comes to encryption, you've got to be all in, or you might as well find some other way to protect your systems and data. For a more in-depth analysis of the benefits and challenges of properly managing encryption, check out my feature story in this week's issue.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-5084
Published: 2015-08-02
The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords, which allows physically approximate attackers to obtain sensitive information via unspecified vectors.

CVE-2015-5352
Published: 2015-08-02
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time ...

CVE-2015-5537
Published: 2015-08-02
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.

CVE-2015-5600
Published: 2015-08-02
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumptio...

CVE-2015-1009
Published: 2015-07-31
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!