Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/22/2006
04:43 PM
50%
50%

Quick, Encrypt Everything!

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices, encryption is gaining traction in more mainstream IT environments (you no longer have to be a three-letter government intelligence agency to justify the investment). That's OK, as long as you know how to properly manage it.

My story in the Sept. 25 issue of InformationWeek navigates you through the tricky process of managing encryption. For those of you who just can't wait until Monday, here's what you should know, along with some examples of what can go wrong.Encryption adds cost and complexity to IT systems that are already expensive and difficult to manage. Why would anyone do that? Simple: They can't afford not to. When the Veteran's Affairs Department in May had a laptop and hard disk drive stolen from an employee's apartment, this loss of data on about 26.5 million veterans and their spouses spurred a tumultuous couple of weeks that put VA Secretary James Nicholson in the hot seat. Calls were made for his resignation, and by the time the situation had calmed down, Pedro Cadenas Jr., the VA official in charge of information security, had announced his resignation and Deputy Assistant Secretary for Policy Michael McLendon had resigned. The VA then moved to sign Systems Made Simple to a $3.7 million contract to install mobile encryption software from GuardianEdge Technologies and Digital Trust on all its laptops by mid-September (a self-imposed deadline the department has subsequently missed, although it reports to be making "good progress").

Other federal agencies have avoided this sort of upheaval by long ago implementing encryption on mobile devices. The Justice Department has for the past four years been using encryption software from Pointsec Mobile Technologies and other vendors on all its laptops. To further contrast the VA's predicament, after the Commerce Department Sept. 21 admitted that 1,137 of its laptops have been "lost, misplaced, or stolen" since 2001, Commerce was quick to point out that it uses "access passwords, complex database software, systemic safeguards and/or encryption technology [to] significantly limit the potential for misuse of data on the laptops." This has kept outrage to a minimum and the focus on why Commerce hadn't reported this sooner, rather than on who's going to pay to provide the victims with free credit monitoring services. Nearly half of the absent laptops were from the Census Bureau, and 249 contained personally identifiable information.

So encryption (as part of a larger laptop security strategy) came to Commerce's rescue. "All of the equipment that was lost or stolen contained protections to prevent a breach of personal information, and we are moving to institute better management, accountability, inventory controls, 100% encryption, and improved training," Commerce Secretary Carlos Gutierrez said in a prepared statement. Since 2001, the Census Bureau has been adding encryption technology on a rolling basis for extra protection, and today all new laptops have encryption protection.

That's the sunny side of encryption as a policy. The dark side involves irretrievable data, networks and systems bogged down by devoting resources to encrypt and decrypt information, and the fact that many network security systems can't adequately inspect encrypted data packets.

Anecdotally, a couple of stories surfaced when I was researching my story that illustrate what can go wrong. One involves a company that had lost a copy of the decryption keys for the data they'd recently encrypted. While details weren't forthcoming regarding how these keys were lost, a source brought to my attention that without access to those keys, this company had essentially done the digital equivalent of shredding all the data it had encrypted.

In another situation, a company fearful of falling into the trap previously described decided it didn't need an automated means of retrieving decryption keys. Instead, it kept an unencrypted copy of the data it had encrypted, just in case something went wrong during the decryption process or its keys were lost. Kind of like locking your door and leaving the key under the doormat.

When it comes to encryption, you've got to be all in, or you might as well find some other way to protect your systems and data. For a more in-depth analysis of the benefits and challenges of properly managing encryption, check out my feature story in this week's issue.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Vulnerability Disclosure Programs See Signups & Payouts Surge
Kelly Sheridan, Staff Editor, Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15216
PUBLISHED: 2020-09-29
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revisio...
CVE-2020-4607
PUBLISHED: 2020-09-29
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.
CVE-2020-24565
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25770
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25771
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...