https://americansecuritytoday.com/protecting-data-internets-things-benefits-encryption-hsms/
Five Keys to Modern Data Security *By Tammy Waitt <https://americansecuritytoday.com/author/american-admin/> - * *June 25, 2016* * <http://www.facebook.com/sharer.php?u=https%3A%2F%2Famericansecuritytoday.com%2Fprotecting-data-internets-things-benefits-encryption-hsms%2F>* *Share on Facebook <http://www.facebook.com/sharer.php?u=https%3A%2F%2Famericansecuritytoday.com%2Fprotecting-data-internets-things-benefits-encryption-hsms%2F>* * <https://twitter.com/intent/tweet?text=Five+Keys+to+Modern+Data+Security&url=https%3A%2F%2Famericansecuritytoday.com%2Fprotecting-data-internets-things-benefits-encryption-hsms%2F&via=American+Security+Today>* *Tweet on Twitter <https://twitter.com/intent/tweet?text=Five+Keys+to+Modern+Data+Security&url=https%3A%2F%2Famericansecuritytoday.com%2Fprotecting-data-internets-things-benefits-encryption-hsms%2F&via=American+Security+Today>* *'Protecting Your Data from the Internet’s “Things”: The Benefits of Encryption and HSMs'* *By Peter DiToro, Vice President of Customer Services, Thales e-Security* *The practice of encrypting information and protecting encryption methods is almost as old as the written word. Hardware security modules (HSMs) are used to protect cryptographic keys both at rest and in use; they are designed according to rigorous standards, usually set by governments, because protecting data is that important.* *Over the life cycle of both cryptographic material and associated data, today’s digital HSM provides a secure platform for managing cryptographic keys and their use. However, even given the vast progress in crypto system design, power and flexibility, one factor remains painfully true: a breach of cryptographic keys destroys the integrity of any crypto system, no matter how elegant its implementation. The HSM has become the de facto standard for securing the foundation of any modern crypto system.* *The evangelists of the early days of modern, applied crypto could not have foreseen the importance cryptography has assumed in this era of IoT and BYOD. The number of “things” attached to and communicating over the Internet will reach 6.4 Billion in 2016 according to Garner Group, an Internet consultancy. Each of these “things” can assume an identity, secure a communications channel, gather up data on its environment and share that data widely. Clever cryptography will form the basis for establishing IoT identities and protecting the resulting flood of data. HSMs provide the highest level of trust and protection available when it comes to establishing and protecting the cryptographic infrastructure on which trust in a fully functional IoT depends.* *However, everything—and especially security—has its price. HSMs aren’t cheap. In addition, the niche and often arcane world of crypto is not well understood within the broader IT community. As cryptographic applications have surged into the mainstream, it can be tempting to cut corners, to deploy sensitive cryptographic operations without sufficient protection. A little over a decade ago, only about two percent of crypto was performed in an HSM. Until the recent explosion in crypto deployments and the concomitant surge in highly public breaches, little thought was given to securing the foundational aspects of key generation, key management and protection of core crypto applications. Things just had to work to pass first-level scrutiny.* *But when literally billions of things came online, all that changed. A smartphone, for instance, has to have an identity. It stores encryption keys and digital certificates. It can easily become a proxy for its owner’s identity in transacting over the Internet. Suddenly, we find ourselves transacting with countless things on the Internet, hoping to trust digital identities and the intent of their creators. Now, HSMs, the means by which trustworthy digital identities are secured, have become more pertinent. The risk of brand and identity damage caused by exploitation of a weak crypto system dwarfs the cost and hassle of HSM deployment. Shortcuts no longer make sense, even in the most parsimonious applications environments.* *If an organization creates devices that can connect to the Internet, those devices must have identities, most likely based on digital certificates issued by a Public Key Infrastructure (PKI). When an autonomous entity on the Internet, be it a help bot from a major retailer or your home security system, presents its credential and asserts an identity and associated trust level, you want to be able to rely on it. This means, as a first principal, that the cryptographic materials that underpin that identity cannot be forged or stolen. You want to trust that you are transacting with the intended entity and not some fraudulent man in the middle.* *Gaming consoles, smartphones, smart medical devices and more must receive digital certificates and keys from their manufacturers. All of these devices need to identify themselves. We assume, often wistfully, that the cryptographic infrastructure that underpins the integrity of these identity assertions is solid. Suddenly, the idea that one’s keys and PKI could get compromised and millions of devices could be put in jeopardy hits home. The scope of the business problem rises from an interesting niche problem set to one with existential implications for modern eCommerce.* It’s Happened Before *This is not a Chicken Little exercise; it has been borne out in the real world. The Heartbleed bug, a serious vulnerability in the popular OpenSSL cryptographic software library, provides an example of what can go wrong. Heartbleed acts like a guided missile looking for SSL keys. Once a hacker exfiltrates a copy of those keys, he or she can act as a man in the middle. But Heartbleed was a memory scraper; it works only if the organization is doing its crypto on the server, in which case the keys are in plain text in memory. However, if the organization is securing its SSL keys within an HSM, Heartbleed can’t see them.* *Another lesson can be drawn from Stuxnet, whose authors stole code-signing certificates and their associated private keys from a pair of unaware Taiwanese component manufacturers. This enabled the Worm to replicate itself across servers, quietly installing copies of itself using stolen code signing keys to mask its origin and intent. If those code signing keys had been maintained and used within an HSM, Stuxnet would have happened to someone else.* Five Keys to Modern Data Security *Without rock-solid key management systems and practices, cryptography cannot stand. For example, if the root key of a PKI is compromised, the entire system collapses. To avoid scenarios like Heartbleed and Stuxnet, follow these simple best practices:* · *Determine what data is important and find out where it is: To encrypt your data effectively, you have to know where it is, which means you have to begin the process of data categorization.* · *Encrypt what matters: Critical data must be treated as such; it’s too risky to leave data in the clear during any phase of its lifecycle.* · *Opt for an HSM: These devices offer a hardened, secure root of trust to enable a higher degree of security when deploying cryptographic technology.* · *Make the knowledge investments needed: Crypto is a tool; using that tool wisely implies understanding how the tool works. Invest in your people and in the basics building blocks of cryptographic technology. You’ll increase the probability of a secure deployment and scare off the majority of attackers.* · *Don’t be fooled by the false promise of software-based crypto: Make a vow that the keys will only be used within the parameters of an HSM.* *HSMs have been around for decades, but they’ve remained a niche player until now, when the Internet and its billions of connected things are creating a security challenge unlike any in history. Once considered too expensive to be practical, HSMs are now understood as being a critical component in safeguarding both data and company reputations. For organizations dealing with a high volume of keys, they are an essential component of the modern, hardened crypto system because they raise the probability of deploying cryptography in a secure and unbreakable fashion* <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=icon> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link> __._,_.___ ------------------------------ Posted by: "Beowulf" <[email protected]> ------------------------------ Visit Your Group <https://groups.yahoo.com/neo/groups/grendelreport/info;_ylc=X3oDMTJmcXRsOWk4BF9TAzk3MzU5NzE0BGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDdnRsBHNsawN2Z2hwBHN0aW1lAzE0NjY5NTk1OTk-> [image: Yahoo! Groups] <https://groups.yahoo.com/neo;_ylc=X3oDMTJlYzk4ZzJyBF9TAzk3NDc2NTkwBGdycElkAzIwMTk0ODA2BGdycHNwSWQDMTcwNTMyMzY2NwRzZWMDZnRyBHNsawNnZnAEc3RpbWUDMTQ2Njk1OTU5OQ--> • Privacy <https://info.yahoo.com/privacy/us/yahoo/groups/details.html> • Unsubscribe <[email protected]?subject=Unsubscribe> • Terms of Use <https://info.yahoo.com/legal/us/yahoo/utos/terms/> __,_._,___ -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
