- It's the applications, stupid
- Will a whitelist save personal computing?
- Thousands of Web sites under attack
- To solve the unsolvable problem
- Re-thinking the security of virtual machines
- Security Development Lifecycle trumps code complexity
- Is your Web site FIPS compliant?
- Computer security: Why have least privilege?
- Strategic security: Get a handle on authentication
- Control user installs of software
April 12, 2006 | Comments: (0)
More feedback on ny hard disk encryption column
More information, and guestions, from readers regarding my encryption column,
Encryption for All http://www.infoworld.com/article/06/03/31/76920_14OPsecadvise_1.html
--------------
From: Albert
Roger,
I heard a year or two ago about on hard disk manufacturer, Seagate http://www.pcworld.com/news/article/0,aid,121522,00.asp that was incorporating hardware encryption capabilities into it's notebook hard disks. I assumed at the time that other manufacturers would follow and government customers especially would be enthusiastic buyers.(Including me.)
About the same time NSA was demonstrating it's classified solution for USB hard disk enclosures and desktop full disk encryption products (encrypts in-line on the IDE bus - transparent to the operation of the disk from the motherboard).
I assumed that the NSA capability would be incorporated in the hard disk controller electronics on the drive. I haven't heard any more about it.
We are now in the market for some drives. Any idea where I can get some encryption capable disks?
--------------
Readers??
--------------
From: Victor Roberts
Your column is directed toward computer professionals. Therefore, I do wonder about your suggestion that the free version of PGP is an option for your readers. You state:
"If you need commercial support, PGP Corp. provides products for Windows, Mac, and BlackBerrys."
However, support is not the only issue. The free versions of PGP are licensed only for use in non-commercial environments. It would be a violation of the license agreement for Free PGP to use these products in any commercial business. Since most of your readers probably work for a commercial business, this limitation should have been mentioned.
Victor Roberts, Ph.D.
Roberts Research & Consulting, Inc.
-----------------
From: Dooley, Patrick M
There are federal guidelines for the use of Federal Data. I would at least advise folks to use encryption that is compliant with NIST 140-2.
http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf
http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf
Patrick M. Dooley
Wisconsin Department of Revenue
---------------------
From: Calkin, Warwick
Roger,
I agree with everything in your article however archiving of encrypted email actually causes complications in the compliance equation.
A problem which we are currently grappling with is that if an email is encrypted at the desktop (encrypting away from the desktop is not an option) and then archived, indexing becomes a lot less meaningful.
Using the smime header we are able to index the to, from, and subject.
However in the event of a "discovery event" where we need to recover large volumes of mail (usually based on something in the content which we can't see), this lack of indexing becomes a real overhead and almost forces us into a position where we need to recover all encrypted emails,de-encrypt all, and index all. Obviously this creates several compromises.
Your views on how others are tackling this problem would be appreciated.
---------
This has got to be a common issue. Readers??
Posted by Roger Grimes on April 12, 2006 10:44 AM
RATE THIS ARTICLE:
-
- COMMENTS
Warwick,
On the email archiving issue - there are new technologies which allow this particular case (clear archiving and retrieval e.g. SEC 17A4) to be accommodated. Identity Based Encryption (IBE) for example facilitates this yet retains the ability for a secure email end to end. If you have a look at the commercial offerings from Voltage Security you can see what I mean. A lot of organisations are using IBE for this purpose due to its flexibilty and ability to support complex compliance requirements better than the older PGP or X509 PKI approaches which are problematic in this regards.
Mark
Albert said: "We are now in the market for some drives. Any idea where I can get some encryption capable disks?"
Secure Systems Limited can provide such a product.
You can contact me on 408 627 4052 or email on animaus88-ssl (at) yahoo.com (dont worry about strange email, trying to avoid spam).
Regards Paul
Posted by: Paul F at April 20, 2006 03:36 PMMy company has been doing a lot of work with a couple of products from Mobile Armor. I've got a couple of presentations on my personal site available at:
http://www.smartchive.com/information-security/disk-encryption/mobile-armor-overview.html
And and overview of the OMB Mandate on Data Encryption here:
http://www.smartchive.com/federal/security/omb-mandate-on-data-encryption-overview.html
Posted by: Paul Misner at October 22, 2006 11:23 PM
