On September 20, 2024 in All, Computing, General, Security by Steven Keeping
The internet is hosting a digital arms race. Each time engineers come up with a better solution to protect valuable data, hackers find a way in. Today’s best security tool is encryption—encoding data such that even if it’s intercepted, it will be practically impossible to access without a cryptographic “key.” That’s great in theory, but in practice the crooks exploit flaws in encryption management. These flaws expose data in the same way that locking up the house and then leaving the key under the mat makes your flat screen TV easy prey—by not properly securing the key. And once they have it, hackers will decrypt all the data and sell it to the highest bidder.
There are ways to address encryption security flaws, but most solutions demand skilled coders and a meticulous security process. These options can be beyond the resources of many companies who, as a result, just resort to hoping that hackers will leave them alone. But now these organizations can up their game—without taking on expensive coding resources—by deploying one or more hardware security modules (HSMs).
An HSM closes the door on hackers by providing a highly secure, tamper-proof, and isolated environment to look after a company’s most valuable cryptographic keys. Without the keys, hackers can intercept as much data as they like without posing a threat, because they’ll never be able to read any of it.
How Encryption Works
It’s relatively easy to hack into the data coursing its way through the internet. But if the information is unreadable, then the data becomes useless to hackers. By taking plain text and encoding it into a format called ciphertext, encryption achieves just that. The resulting message looks like a random collection of letters, symbols, and numbers, but the coding is purposeful. The cipher makes the underlying data retrievable to those with the knowledge of how the message was scrambled.
This knowledge is carried by cryptography keys. These keys are essentially a suite of algorithms running to defined rules that encrypt and decrypt the data, and each key is random and unique. Both sender and recipient need the key for the encryption to work as intended. The most popular encryption technique is the Advanced Encryption Standard (AES). It employs a 128-bit key and without it, cracking a modern ciphertext, even with the world’s most powerful supercomputer, is practically impossible.
Encryption Is Not Infallible
But hang on a minute. Currently, around 95 percent of internet traffic is encrypted,[1] and yet, there are headlines almost daily about cyberattacks on firms that thought they were safe. Last month, a cyberattack against a major transportation hub created significant risk exposure and was yet another example of the threats facing critical infrastructure.[2]
Hackers typically go after the key first and then use it to open the door to company data. Once a hacker has broken into the company’s intranet, the first place they look is in a database, a file system, or application configuration files, since these are the most common places to store keys. This approach can often be successful because some organizations are careless with their keys. Ironically, it’s like investing in the world’s best security system and then taping a copy of the alarm disarm code to the front door.
One defense is to encrypt the key with another key, thoughtfully named a Key Encryption Key (KEK), and then store that in another safe location—but this rarely happens. Another mistake organizations frequently make is to use the same encryption key to protect all data. So once the hackers have the key, they can read everything. The advice of cybersecurity experts is to store data in multiple security partitions, each with its own key. Unfortunately, this advice is often ignored.
Hardware Security Modules: The Next Step for Encryption
With these various cyber risks opening doors for hackers to get past encryption, the internet security sector has eased the hassle of key management with the hardware security module (HSM). An HSM’s purpose is to protect and manage cryptographic keys and implement the encryption and decryption process.
An HSM is a physical device that reinforces data protection by offering a secure environment in which to conduct key management. It comes in the form of a plug-in card, smart card, or other external device, and is connected to a network server, accessed from the cloud, or used as standalone hardware. The high-level security enables companies to easily implement protection policies. For example, a company might use an HSM to hide trade secrets or intellectual property (IP) and ensure the data’s safety by only allowing authorized personnel to access the module.
HSMs boast a range of features to prevent illicit use. These include:
Hardware and software built to high security government standards such as Federal Information Processing Standardization (FIPS) 140-2.
Tamper resistance through a hardening process that makes the HSM very difficult to interfere with or intentionally damage.
Installation in a secure area that isolates the HSM from other processes. This security can be taken one step further by locating the HSM in a third-party data center.
Support for a range of application programming interfaces (APIs) for the development of custom applications, including the Public-Key Cryptography Standards (PKCS) and Cryptography API: Next Generation.
An HSM manages all aspects of a cryptographic key’s lifecycle—from creation to disposal. Initially, the HSM generates (or “provisions”) the key using a true random number generator. The HSM then copies the key and stores it as a backup, should the original version be lost or damaged. Some HSMs also encrypt the backup key. Once a key is in use, the HSM controls and monitors it according to industry standards and the owner’s internal systems. The HSM will also manage key rotation and deploy new keys as existing ones reach their sell-by date.
Finally, the HSM decommissions keys once they outlive their usefulness. Such keys are put in offline, long-term storage in case they’re needed to access data that they originally encrypted. Keys are only securely and permanently destroyed after the user is assured they’re no longer needed.
Conclusion
While the internet makes it easy for data to pass between sender and recipient in seconds, it also exposes that data to those with malicious intent. Developers have hit back with AES-128 encryption to scramble data in a prescribed manner so that it can be unlocked at the far end with the appropriate key. That approach makes the data unreadable to hackers, unless they get their hands on the key. Then it’s a case of simply unlocking the information and touting it to dodgy third parties.
Therefore, protecting the keys becomes the critical factor in data security. Although that can be taxing work, HSMs remove much of the tedium by ensuring encryption keys remain safely locked away, beyond the grasp of even the most determined hacker.
Sources
[1] https://www.datacenterknowledge.com/networking/network-encryption-a-double-edged-sword-for-cybersecurity
[2] https://www.techopedia.com/news/seattle-port-airport-ransomware-rhysida
