How do I encrypt and protect sensitive data is certainly a question we get asked; I'm not sure we've got really good answers quite yet.
via storagebod.typepad.com
I read Bod's post having just delivered my Security session in Paris answering that exact question so the initial draft of this was very detailed.
It ended up in the Recycle Bin because it was an incredibly busy week and that’s how I roll.
Summarizing it at 5:00AM on a Friday morning, there isn't a single approach to Encryption that is correct but a lot of them that are incorrect when used on their own. In recent memory the people in the market who said they had a one size fits all solution were vendors who wanted you to put a crypto box in front of everything. I found such devices to be buggy, unstable and far more trouble than they were worth, indeed they were so awful they no longer exist as a market segment.
But lets forget about those monstrosities and break it down. Encryption for data at rest can be deployed at five points.
-
In the Application. Data being created, modified and destroyed but always encrypted.
- At a Database or File level. Data being encrypted when it’s stored in a logical structure. This goes to to heart of Bod’s NAS question, files on NAS should be secured on a per file basis so the encryption travels as the file does.
- On the Host. Here’s where encrypted file systems, HBAs and I/O encryption ensure nothing leaves that Host in the clear.
- In the network. Clear text comes out of the source but cipher text arrives at the destination. Somewhere in between an ASIC in a switch has done the translation.
- In the storage platform. It’s clear right until it hits something external to the host which reads and writes data to physical media and only then is it encrypted.
Here’s the bad news. The level of overall protection decreases as you move from 1 to 5, 1 being the most secure, but the level of overall implementation complexity increases as you go from 5 to 1. 5 being the least complex to introduce.
Application level security may require code be written to ensure every operation is encrypted, but every operation will then be encrypted as it occurs. Platform level security could be a checkbox next to the usual host access commands and if you’re using data reduction techniques the encryption can happen after the data has been reduced but before it’s written to disk. But the data is open to being compromised at any level above the platform itself.
Now lets say you have a larger environment and you’ve deployed some or all of the above. You’ll need a Key Management System to generate keys, securely deliver them with as little human interaction as possible, Vault them in case they’re needed later down the line, Expire & Roll them over when required and Monitor & Audit their usage.
The upshot is all of this is it gets as complex as you need it to be. People go looking at encryption with the idea they need to encrypt everything but then back away when they realise how complex things will get.
That’s a sign that not everything needs to be encrypted, only some of it needs to be encrypted. The first step to a successful deployment is to sit down and decide at which of the five levels should the encryption occur considering the level of protection required.
