Encryption

Encryption is the process by which we take information and convert it into a state that can only be read or modified by designated parties. Encryption relies on keys that are used for encrypting and decrypting information. Sometimes, a single key is used (symmetric encryption), and sometimes, multiple keys are used (asymmetric encryption). Encryption has become very popular in modern security practices and it is used for many purposes beyond the ability to hide information. Through the use of encryption, we can enable several security mechanisms, including:

• Information privacy To keep others from reading data and communications

• Information integrity To ensure no one changes data and communications without our knowledge

• Non-repudiation To make it more difficult for parties to refute electronic actions

Encryption is the prevalent means of securing communications and for securing data as it sits on a laptop, workstation, and server. It is also commonly used for performing stronger levels of authentication, and for securing access to Web sites via mechanisms like SSL and HTTPS.

Trusting Encryption

There are many different levels at which encryption can secure information; unfortunately, the actual level of protection offered by different encryption solutions is fairly difficult to derive. For example, we commonly hear about the strength of encryption solutions as related to the length of the keys used. Encryption based on 128-bit keys is considered strong protection, whereas encryption based on 56-bit keys is not. This, however, is an over-simplification in assessing encryption-based security.

The level of security offered by encryption is affected by many factors beyond key length. The quality of the algorithm, the method used to create the key, the range of variations available in key generation, and the mechanism used to protect the key are also extremely important to the safety of encrypted data. If, for example, we use a 128-bit key, but the 128 bits are limited to standard letters and numbers, our key is very weak. Or, if we have the greatest key and algorithm in the world, but the key is protected by a simple secret, like a bad pass phrase, our data is not going to be very secure.

The point here is that the protection of data through the use of encryption involves numerous components, each of which could introduce a flaw or weakness that exposes information. Microsoft's Point-to-Point Tunneling Protocol (PPTP), for example, has been plagued with serious vulnerabilities due to bad choices in the encryption decisions made by the developers. Simply because we choose the 128-bit grade of PPTP encryption does not mean that a hacker can't break it with a few hours of work.

It is very important when we use encryption for protecting sensitive information to perform some research. Many major encryption products and processes have serious flaws that have been documented by security experts. Take some time to search for such issues and make sure you understand the degree to which the encryption product will protect your information. Be sure to choose an algorithm that is not based on secrecy (Open Source), and be sure to only use encryption mechanisms that have been successfully used by others for at least several months.

Managing Keys

The protection of an encrypted piece of data or transaction ultimately comes down to the security of the encryption keys. Keys are normally long and complex, which forces us to store them on our drives, in computer memory, or in hardware devices like smart cards. This introduces a problem since we now have to worry about protecting these keys. Why would a hacker spend time cracking an algorithm when he or she can simply try to obtain keys from a hard drive? Dealing with keys should cause an organization to consider many questions, such as:

• What if someone steals a key and gains access to the data?

• What if someone loses a key and data cannot be accessed?

• What if keys need to be changed, but data is already encrypted with an older key?

• What happens when other objects need to use the keys, such as virus scanners, email servers, and other devices?

• How do we keep track of all the keys within an environment?

These issues have been a big problem when integrating encryption solutions within the average organization. Introducing keys is usually much more difficult than introducing passwords into an environment. To avoid disaster, encryption keys must be managed through a well thought out and tested process. The Rule of the Three-Fold Process should be referenced at all times. Key management usually involves third-party software products from companies like Entrust. This introduces a whole new layer in managing IT as we move into topics like public key infrastructure (PKI). Before embarking on any major encryption initiatives, it is important to understand exactly what the organization is getting into.

Diminishing Security via Encryption

For encryption to work properly, no one should be able to decrypt information outside of the intended recipients. According to the Rule of Least Privilege, this means that no person or device other than the end-user should have the power to decrypt the data. This, however, makes it impossible to perform security checks on encrypted information. There is no way for an email scanner, for example, to check for a virus within an encrypted message. To do this, the email system would have to have the decryption key, which defeats the purpose of encrypting in the first place. All too often, we implement encryption and then make so many minor adjustments that we end up with a very low level of security.

The Rules of Encryption

To implement encryption safely, it is best to understand how it works, to what degree it is protecting the information, and how it relates to the security rules.

Identify the Weakest Link

With encryption, the Rule of the Weakest Link is of great importance. There are many components in the average encryption process, any of which could be the weak link that causes an exposure:

• Encryption algorithms, practices, and products oftentimes have weaknesses. This information can usually be researched on the Internet.

• With any encryption process, focus should be placed on key management. How can the end-users interact with their keys? Can they be exported and saved to a disk? What are the mechanisms in place to protect the keys?

• Keep track of where keys exist and how access can be obtained. Some products like email servers and firewalls offer end-user key storage so that users can monitor encrypted transactions. This can be dangerous, especially if the system hosting the keys is ever compromised.

Rule of Least Privilege

Keys should be treated as extremely sensitive objects and should be guarded through the Rule of Least Privilege. No person or device should be granted access to a key unless it is absolutely required and the key can be properly handled. Products such as email servers and firewalls that offer to store secret keys should be heavily scrutinized, and mechanisms should be put in place to protect such systems from giving unauthorized access to the keys.

Rule of the Three-Fold Process

Encryption is another prime example of where the Rule of the Three-Fold Process must be observed. Large-scale encryption projects are usually complex in design and implementation. Maintenance and monitoring usually end up being even more complex than implementation. Before implementing encryption, thought should be given as to how keys will be created, verified, stored, aged, revoked, and otherwise managed. Providing adequate maintenance for encryption keys is often a major hidden cost for wide-scale deployments.

Secretless Security

Secretless security is of great importance when considering the process of encryption. Most encryption algorithms are based on similar forms of mathematical logic and include unique variations that enhance security. The most popular encryption algorithms like 3DES are Open Source and can be freely downloaded and tested. As such, these algorithms have been scrutinized by good and malicious hackers around the world and have proven their strengths and weaknesses. We can thus be reasonably sure of their ability to protect information.

An encryption algorithm or mechanism that bases its security on secrecy can never be trusted as much as an Open Source algorithm tested by the public. This is an important consideration when determining which products and algorithms to implement.