Risk
9/22/2006
04:43 PM
Connect Directly
RSS
E-Mail
50%
50%

Quick, Encrypt Everything!

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices, encryption is gaining traction in more mainstream IT environments (you no longer have to be a three-letter government intelligence agency to justify the investment). That's OK, as long as you know how to properly manage it.

My story in the Sept. 25 issue of InformationWeek navigates you through the tricky process of managing encryption. For those of you who just can't wait until Monday, here's what you should know, along with some examples of what can go wrong.Encryption adds cost and complexity to IT systems that are already expensive and difficult to manage. Why would anyone do that? Simple: They can't afford not to. When the Veteran's Affairs Department in May had a laptop and hard disk drive stolen from an employee's apartment, this loss of data on about 26.5 million veterans and their spouses spurred a tumultuous couple of weeks that put VA Secretary James Nicholson in the hot seat. Calls were made for his resignation, and by the time the situation had calmed down, Pedro Cadenas Jr., the VA official in charge of information security, had announced his resignation and Deputy Assistant Secretary for Policy Michael McLendon had resigned. The VA then moved to sign Systems Made Simple to a $3.7 million contract to install mobile encryption software from GuardianEdge Technologies and Digital Trust on all its laptops by mid-September (a self-imposed deadline the department has subsequently missed, although it reports to be making "good progress").

Other federal agencies have avoided this sort of upheaval by long ago implementing encryption on mobile devices. The Justice Department has for the past four years been using encryption software from Pointsec Mobile Technologies and other vendors on all its laptops. To further contrast the VA's predicament, after the Commerce Department Sept. 21 admitted that 1,137 of its laptops have been "lost, misplaced, or stolen" since 2001, Commerce was quick to point out that it uses "access passwords, complex database software, systemic safeguards and/or encryption technology [to] significantly limit the potential for misuse of data on the laptops." This has kept outrage to a minimum and the focus on why Commerce hadn't reported this sooner, rather than on who's going to pay to provide the victims with free credit monitoring services. Nearly half of the absent laptops were from the Census Bureau, and 249 contained personally identifiable information.

So encryption (as part of a larger laptop security strategy) came to Commerce's rescue. "All of the equipment that was lost or stolen contained protections to prevent a breach of personal information, and we are moving to institute better management, accountability, inventory controls, 100% encryption, and improved training," Commerce Secretary Carlos Gutierrez said in a prepared statement. Since 2001, the Census Bureau has been adding encryption technology on a rolling basis for extra protection, and today all new laptops have encryption protection.

That's the sunny side of encryption as a policy. The dark side involves irretrievable data, networks and systems bogged down by devoting resources to encrypt and decrypt information, and the fact that many network security systems can't adequately inspect encrypted data packets.

Anecdotally, a couple of stories surfaced when I was researching my story that illustrate what can go wrong. One involves a company that had lost a copy of the decryption keys for the data they'd recently encrypted. While details weren't forthcoming regarding how these keys were lost, a source brought to my attention that without access to those keys, this company had essentially done the digital equivalent of shredding all the data it had encrypted.

In another situation, a company fearful of falling into the trap previously described decided it didn't need an automated means of retrieving decryption keys. Instead, it kept an unencrypted copy of the data it had encrypted, just in case something went wrong during the decryption process or its keys were lost. Kind of like locking your door and leaving the key under the doormat.

When it comes to encryption, you've got to be all in, or you might as well find some other way to protect your systems and data. For a more in-depth analysis of the benefits and challenges of properly managing encryption, check out my feature story in this week's issue.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.