The CDO Agenda - Data Security and Encryption
56
www.cdovision.com Moderator: Tony Shaw CEO, DATAVERSITY Speaker: Brian Sletten President Bosatsu Consulting, Inc. #CDOVision Sponsored today by:
-
Upload
dataversity -
Category
Technology
-
view
431 -
download
1
description
If you're not terrified, you're not paying attention. Every organization in the world, large and small, should be concerned about Data Security. Virtually every week there’s a well-publicized and embarrassing data breach that serves to remind how important it is to protect both customer and enterprise information. Tools and techniques exist to help, for managing identity, authentication, and authorization. Encryption is also an effective way of making it harder for people to steal your secrets. But it isn't magical, it isn't fool proof and, depending on how you are using it, may be completely useless. You don't have to understand the math (although that will help), but you do have to understand what encryption will and won't do for you. Data and web security today Protecting data in transit Protecting data at rest What advantage does Encryption provide? How can you build encrypted data protection into your software and systems? Are there business trade-offs? Implications for specific industries (financial, health)
Transcript of The CDO Agenda - Data Security and Encryption
www.cdovision.com
Moderator: Tony ShawCEO, DATAVERSITY
Speaker: Brian SlettenPresidentBosatsu Consulting, Inc.
#CDOVision
Sponsored today by:
CDO AgendaData Security and Encryption
Brian Sletten
! @bsletten 07/01/2014
Speaker Qualifications
Specialize in next-generation technologiesAuthor of "Resource-Oriented Architecture Patterns for Webs of Data"Speaks internationally about REST, Semantic Web, Security, Visualization,ArchitectureWorked in Defense, Finance, Retail, Hospitality, Video Game, Health Care andPublishing IndustriesOne of Top 100 Semantic Web People
·
·
·
·
·
2/55
Agenda
IntroEncryptionThe World We Live InSecure Systems
·
·
·
·
3/55
Intro
Whoever thinks his problem can be solvedusing cryptography, doesn't understand hisproblem and doesn't understandcryptography.
“
”
Roger Needham/Butler Lampson
CC BY-SA 3.0 (http://en.wikipedia.org/wiki/Scytale)
6/55
Shift Cipher
Et tu, Brute? PLAIN TEXT
Rg gh, Oehgr? CIPHER TEXT (ROT13)
7/55
Shift Cipher
Rg gh, Oehgr? CIPHER TEXT
Et tu, Brute? PLAIN TEXT (ROT 13)
8/55
CC BY-SA 3.0 (http://en.wikipedia.org/wiki/Caesar_cipher)
9/55
Effective Cryptography
ConfusionDiffusion
·
·
10/55
CC BY-SA 3.0 (http://en.wikipedia.org/wiki/Enigma_machine)
11/55
Recent Crypto Developments
1970s: Data Encryption System (DES)1970s: Diffie-Hellman(-Merkle) Key Exchange1980s: RSA1990s: Attacking DES2000s: Advanced Encryption System (AES)
·
·
·
·
·
12/55
Attacking Cryptography
CryptanalysisSocial EngineeringSide Channel Attacks
·
·
·
13/55
A cryptosystem should be secure even if the attacker knows all details about the
system, with the exception of the secret key. In particular, the system should be
secure when the attacker knows the encryption and decryption algorithms.
“
”
Auguste Kerckhoffs (1883)
Bulletproof SSL and TLS
15/55
Encryption
Understanding Cryptography: A Textbook for Students and Practitioners
17/55
Understanding Cryptography: A Textbook for Students and Practitioners
18/55
http://legacy.kingston.com/secure/XTSmostsecureencryption.asp
19/55
Symmetric Encryption
By Bananenfalter (Own work) [CC0], via Wikimedia Commons
20/55
Data Encryption Standard (DES)
http://en.wikipedia.org/wiki/Feistel_cipher
21/55
22/55
Triple DES
23/55
Advanced Encryption Standard (AES)
24/55
Asymmetric Encryption
By Bananenfalter (Own work) [CC0], via Wikimedia Commons
25/55
Diffie-Helman Key Exchange (DHKE)
First published asymmetric crypto scheme (1976)Influenced by work of Ralph MerkleDiscovered earlier at GCHQ but was classifiedAllows derivation of a secret key over public channelsBased upon the Discrete Logarithm Problem
·
·
·
·
·
26/55
http://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange
27/55
DHKE Uses
SSHTLSIPSec
·
·
·
28/55
29/55
30/55
31/55
32/55
33/55
34/55
35/55
Data at Rest and Encryption
ContextRegulatory ComplianceQueryingKey rotationArchival quality
·
·
·
·
·
36/55
The World We Live In
Known TLS Hacks
BEASTCRIMEBREACHLucky ThirteenHeartbleed
·
·
·
·
·
38/55
Dual_EC_DRBG
Dual Elliptic Curve Deterministic Random Bit GeneratorPRNG algorithm (ISO 18031 and NIST Standard)In 2007, concern about a backdoorRequired for FIPS 140-2BULLRUN revelations implicated Dual_EC_DRBGNIST recommends against useNSA reportedly paid RSA to make Dual_EC_DRBG default PRNGNSA requested RSA add TLS extension to expose more PRNG data
·
·
·
·
·
·
·
·
39/55
RdRand
Intel instruction for returning random numbers from on-chip RNG with its ownsource of entropyCompliant with NIST SP 800-90A, FIPS 140-2 and ANSI X9.82SP 800-90 requires CTR DRBG, Hash DRBG, HMAC DRBG and Dual_EC_DRBGNot pulled from LinuxPulled from FreeBSD
·
·
·
·
·
40/55
Secure Systems
The main objective of secure system design is to make breaking the system more
costly than the value of the protected assets , where the 'cost' should be
measured in monetary value but also in more abstract terms such as effort or
reputation .
“
”
Christof Paar and Jan PelzlUnderstanding Cryptography: A Textbook for Students and Practitioners
[Security Engineering] is about buildingsystems to remain dependable in the face ofmalice, error, or mischance.
“
”
Ross J. AndersonSecurity Engineering
Solutions
Principle of Least PrivilegeDefense in DepthBuild Security In
·
·
·
44/55
Security is an emergent property of yoursystem.
“”
Gary McGraw
Approach
Risk ManagementTouchpointsKnowledge
·
·
·
46/55
Requirements and Use Cases
Architecture and Design Test Plans Code Tests and
Test Results
Feedbackfrom
Deployed Systems
ExternalReview
47/55
Requirements and Use Cases
Architecture and Design Test Plans Code Tests and
Test Results
Feedbackfrom
Deployed Systems
CodeReview Risk
Analysis
PenetrationTesting
SecurityOperations
Risk-basedSecurity
Tests
ExternalReview
RiskAnalysis
SecurityRequirements
AbuseCases
122
3
4
5
6
7
48/55
Books
50/55
51/55
https://www.feistyduck.com/books/bulletproof-ssl-and-tls/
52/55
http://www.crypto-textbook.com
53/55
54/55
Questions?
! @bsletten
+ http://tinyurl.com/bjs-gplus
$ bsletten
