Best Security Never

Blogger: Trent Henry

Last week, security.itworld.com ran a piece talking about attacks against encryption.
Specifically, they raised the danger of attacks against data-at-rest (i.e., stored data) encryption.

This is something we pointed out in our VantagePoint TeleBriefing last year. (Score one for our prognostication.) We called it "Best Security Never" and warned our clients that increased use of encryption brings increased requirements for strong key management.

Personally, I think a greater risk is poor key archival. When an employee gets hit by a bus, you don't want to lose critical information encrypted on a local hard drive. However, attacks against key management infrastructure itself are also a legitimate concern. If bad guys are able to access individual keys (or, gasp, master keys), a company’s information confidentiality can be written off. If an adversary damages keys, information availability can be written off as well. These scenarios pose issues similar to today's stored keys in Kerberos servers or Active Directory instances. Enterprise-wide key management simply further exacerbates risk aggregation.

This means security teams need to take oh-so-careful measures to protect their central key stores. But this protection is by no means the whole story. When Burton Group talks about encryption, we discuss the entire "supporting cast" of requirements: proper user authentication, cipher implementation, administrator controls, etc. So although key management--and potential attacks against keys--is an important consideration, it's just one of many things that a well-architected enterprise encryption solution should address....