Encryption Essays

Why We Encrypt

Russian translation

Encryption protects our data. It protects our data when it’s sitting on our computers and in data centres, and it protects it when it's being transmitted around the Internet. It protects our conversations, whether video, voice, or text. It protects our privacy. It protects our anonymity. And sometimes, it protects our lives.

This protection is important for everyone. It's easy to see how encryption protects journalists, human rights defenders, and political activists in authoritarian countries. But encryption protects the rest of us as well. It protects our data from criminals. It protects it from competitors, neighbours, and family members. It protects it from malicious attackers, and it protects it from accidents.

Encryption works best if it’s ubiquitous and automatic. The two forms of encryption you use most often – https URLs on your browser, and the handset-to-tower link for your cell phone calls – work so well because you don't even know they're there.

Encryption should be enabled for everything by default, not a feature you turn on only if you're doing something you consider worth protecting.

This is important. If we only use encryption when we’re working with important data, then encryption signals that data's importance. If only dissidents use encryption in a country, that country's authorities have an easy way of identifying them. But if everyone uses it all of the time, encryption ceases to be a signal. No one can distinguish simple chatting from deeply private conversation. The government can't tell the dissidents from the rest of the population. Every time you use encryption, you're protecting someone who needs to use it to stay alive.

It's important to remember that encryption doesn't magically convey security. There are many ways to get encryption wrong, and we regularly see them in the headlines. Encryption doesn’t protect your computer or phone from being hacked, and it can't protect metadata, such as e-mail addresses that need to be unencrypted so your mail can be delivered.

But encryption is the most important privacy-preserving technology we have, and one that is uniquely suited to protect against bulk surveillance – the kind done by governments looking to control their populations and criminals looking for vulnerable victims. By forcing both to target their attacks against individuals, we protect society.

Today, we are seeing government pushback against encryption. Many countries, from States like China and Russia to more democratic governments like the United States and the United Kingdom, are either talking about or implementing policies that limit strong encryption. This is dangerous, because it's technically impossible, and the attempt will cause incredible damage to the security of the Internet.

There are two morals to all of this. One, we should push companies to offer encryption to everyone, by default. And two, we should resist demands from governments to weaken encryption. Any weakening, even in the name of legitimate law enforcement, puts us all at risk. Even though criminals benefit from strong encryption, we're all much more secure when we all have strong encryption.

Categories: Computer and Information Security, Privacy and Surveillance

(Editor’s note: It is axiomat­ic that wider use of data encryp­tion would help stem data breach­es. In this guest essay, John Grimm, senior direc­tor of prod­uct mar­ket­ing at Thales e-Secu­ri­ty, exam­ines the nuances.)

By John Grimm, Spe­cial to ThirdCertainty

The Anthem breach result­ed in the expo­sure of up to 80 mil­lion records, includ­ing birth­days, address­es and Social Secu­ri­ty numbers—everything an iden­ti­ty thief could hope for. Many of the head­lines that cov­ered the news includ­ed the fact that Anthem did not encrypt its inter­nal data. Accord­ing to one report, Anthem was active­ly “con­sid­er­ing encrypt­ing its inter­nal data­base as well as tak­ing oth­er steps to improve its secu­ri­ty” at the time of the attack.

To sug­gest that Anthem sim­ply need­ed to encrypt the per­son­al health infor­ma­tion it was stor­ing in the cloud is an over­sim­pli­fi­ca­tion. Most prac­ti­tion­ers today will agree that encryp­tion is one of the best ways to pro­tect data. How­ev­er, although many regard encryp­tion itself as being black and white—data is either encrypt­ed or not—the real­i­ty is that there are sev­er­al degrees of sep­a­ra­tion between prop­er­ly imple­ment­ed encryp­tion and poor­ly imple­ment­ed (and eas­i­ly exploitable) encryption.

Much of the vari­ance comes down to the qual­i­ty of the cryp­to code itself, and the key man­age­ment prac­tices used. The end result may look the same, but the net lev­el of secu­ri­ty varies enor­mous­ly. Encryp­tion must be imple­ment­ed prop­er­ly using best prac­tices and well-under­stood tech­niques like buffer over­flow pro­tec­tion, prin­ci­ples of least priv­i­lege, .etc—or in today’s world, you’re tak­ing your chances.

Secu­ri­ty & Pri­va­cy Week­ly News Roundup:Stay informed of key pat­terns and trends

Sys­tems that process pay­ments, per­son­al­ly iden­ti­fi­able infor­ma­tion (PII), and oth­er sen­si­tive cus­tomer and cor­po­rate data must be trust­ed to do so secure­ly. They must be in com­pli­ance with gov­ern­ment, indus­try and cor­po­rate reg­u­la­tions and must min­i­mize the impact on oper­a­tional per­for­mance. There are numer­ous solu­tions on the mar­ket that employ cryp­tog­ra­phy to pro­tect data end-to-end while in use, in tran­sit and in stor­age. But what about the secu­ri­ty of the cryp­to­graph­ic keys used with­in these cryp­to sys­tems? Their foun­da­tion of trust relies on prop­er safe­keep­ing and man­age­ment of the keys—and that can prove to be the ulti­mate Achilles heel.

Once attack­ers have access to pri­vate encryp­tion keys, they can decrypt past, present and future encrypt­ed data—meaning key pro­tec­tion from the moment of gen­er­a­tion, and then ongo­ing man­age­ment through­out the life­time of the key, is essen­tial. How­ev­er, not all busi­ness appli­ca­tions and data sets require the same lev­el of pro­tec­tion. Orga­ni­za­tions should con­duct a prop­er risk assess­ment of crit­i­cal sys­tems to help deter­mine which appli­ca­tions (and asso­ci­at­ed data) need the high­est lev­els of pro­tec­tion. Cer­ti­fied pro­tec­tion of cryp­to­graph­ic keys may be nec­es­sary using spe­cial­ized hard­ware secu­ri­ty mod­ules (HSMs) that remove keys from the host serv­er envi­ron­ment and pro­vide a safe place to gen­er­ate, store and man­age the most sen­si­tive keys.

It’s a safe bet that Anthem soon will have a strong inter­nal encryp­tion strat­e­gy and an oppor­tu­ni­ty to safe­guard PII data and win back the trust of its cus­tomers. Com­pa­nies seek­ing to avoid breach­es like this one would do well to locate and encrypt the most sen­si­tive data with­in their net­work envi­ron­ments and pro­tect and man­age encryp­tion keys like their data depends on it—because it does.

More on emerg­ing best practices
Encryp­tion rules ease retail­ers’ burden
Track­ing priv­i­leged accounts can thwart hackers
Impen­e­tra­ble encryp­tion locks down Inter­net of Things

Posted in Data Privacy, Data Security, Guest Essays

0 Replies to “Encryption Essays”