Implementations of Business Cryptography
Transport Layer Security (TLS) encryption uses cryptographic techniques to ensure that communications between two points or two parties are authenticated and secure. Many organizations use TLS for secure communications, including Internet applications and virtual private networks (VPNs). When remote access employees need to access specific tools over the Internet, TLS may be used to secure the transmission of data both through Internet applications and VPNs.
Cryptography can be used for encrypting data at rest and data in motion for various business requirements. Examples of cryptography for business purposes are:
- Encrypting hard drives as a preventive measure in case a laptop or other mobile device is stolen. An organization may choose to encrypt the hard drive to ensure that if the hard drive is removed, the data cannot be read. The organization may choose to require a password during bootup as well. This ensures that the data cannot be read without authenticating the user of the device.
- Encrypting removable devices such as universal serial bus (USB) drives. To remove data or read data that are located on a removable drive requires authentication from the owner of the USB drive.
- Encrypting instant messaging communication that occurs with users inside or outside of the network. This ensures that any information that is shared via this mode of communication cannot be read by an attacker.
- Encrypting file transfers within and outside of the network. This protection secures the data when transmitting outside of the network. It will also provide an extra layer of security even if the network is considered secure.
- Encrypting highly sensitive data such as customer data, credit card information, Social Security numbers, or any data that can cause harm when in the wrong hands.
- Encrypting information on mobile devices, such as smartphones and tablets, which are highly susceptible to loss or theft.
There are many different standards that businesses can follow. The Payment Card Industry Data Security Standard (PCI DSS), for example, requires the protection of consumers’ credit card data. One of the PCI DSS requirements is to encrypt the data or file share on which the information resides.
Cryptography is used in businesses for securing email, TLS, and Internet Protocol Security (IPSec). One example of securing email is Secure/Multipurpose Internet Mail Extensions (S/MIME), a standard for encrypting and digitally signing email. S/MIME also provides secure data transmissions by encrypting emails and their attachments. MIME is the official standard used to define how the body of an email is structured. The MIME format allows email to contain attachments via MIME-compliant mail systems. These attachments can be audio or video clips, enhanced texts, graphics, and so on. MIME provides no security; therefore, S/MIME was proposed.
NOTE
Encrypting an email protects data as they travel between the sender and the receiver.
The use of S/MIME is illustrated in the following example, in which Alice is preparing an email for Bob. Alice wants to encrypt and digitally sign the email, so she performs the following steps:
- Alice generates a secret key for one-time use. This key can also be referred to as a “session key.”
- Alice uses the session key to encrypt the email that she intends to send to Bob.
- Alice encrypts the session key with Bob’s public key.
- Alice digitally signs the email and sends the email package to Bob.
- Bob receives Alice’s email and decrypts the encrypted session key with his private key. He uses the session key to decrypt Alice’s encrypted email.
In order to send digitally signed and/or encrypted email, valid, appropriate certificates must be loaded into the email client.
Distribution
Distribution of keys within an organization is a vital part of key management. You need to ensure the keys are safe and distributed securely. Some organizations choose to outsource these services. The risk associated with not using the correct resources or not implementing the correct system controls is sometimes left to providers who specialize in the technology. However, outsourcing is not always a good option because of the expense involved, especially if there are many systems, communication paths, or files that need to be encrypted within an organization.
In-House Key Management Versus Outsourced Key Management
Determining whether key management should be done in-house or outsourced requires much consideration. There is a large amount of risk associated with key management in terms of security, quality, and availability of resources; cost; and other factors. Some considerations regarding in-house versus outsourced key management are:
- Total cost associated with IT resources and knowledge. Can an organization afford to manage the infrastructure by itself? Will there be appropriate resources available locally to hire, and can the organization afford this resource? Is an organization willing to take on this risk and able to afford to keep training personnel and managing development as the organization grows?
- Managing the keys in-house requires an organization to manage the service level agreements with various business units. Can in-house management ensure the system will be running and functioning correctly 24/7? If disaster occurs, does an organization have the appropriate means to recover in-house?
- Can an organization trust an outsourced key management provider? Does this provider have the appropriate resources on-site? Has the provider done necessary background checks on its employees? How can an organization be sure the provider’s employees will not provide unauthorized access to resources at the provider’s facility?
- What level of support can the outsourced entity provide? Can it grow with the organization? Can the outsourcer provide appropriate help desk support? Is the outsourcer willing to work with the organization in all situations?
NOTE
Organzations may choose to outsource key management or manage keys internally. While internal key management provides a greater degree of control over key distribution, outsourcing may have significant financial benefits.
Choosing the appropriate resources from in-house or outsourced key management services is a risky process. Some organizations are uncomfortable with managing such a vital part of security in their own infrastructure. Some feel that leaving this responsibility to providers who know the technology and specialize in its capabilities is more beneficial to them no matter what the cost. Others may feel the opposite and decide that leaving such an important security measure in someone else’s hands is not worth the risk. Both options are correct for various types of businesses. The process should be carefully planned because changing direction after initial implementation can cause problems.