This message will self-destruct...
Not all security strategies need be as dramatic as those proposed by Mission Impossible, but anyone offering SaaS needs to ensure data is accessible by only authorised users.
One plank in any security strategy is encryption, the transformation of sensitive data into an unintelligible form. This scrambling of data is reversible only by those who have the appropriate key, or at least it should be.
One of the problems with encryption is that it is hard to make bulletproof. Algorithmic weakness and even the simple passage of time can transform an uncrackable cipher into a toy programming project.
For this reason, when the US Government needed a new encryption standard suitable for use by the NSA and the community at large, they worked hard to get it right. The NIST compared fifteen competing designs in a five year standardisation process, soliciting entries from the top security experts and cryptographers in the world. The winner became known as AES or the Advanced Encryption Standard.
As an example of what AES does, imagine a policy or benefit record containing these fields:
| Forename | FRED |
|---|---|
| Surname | FLINTSTONE |
| Amount | 100 |
| Postcode | EH10 4BW |
| Date of birth | 15/11/1929 |
We might decide that the name and postcode are too revealing, so we push these sensitive fields through AES using a given key and use Base64 encoding to make the results printable:
| Forename | KoJag278FDmjdW0F3Si2sw== |
|---|---|
| Surname | NAxlNwCAGm3hNriG4icn+g== |
| Amount | 100 |
| Postcode | 7NfuiRw32aQ3kP6S5ypouw== |
| Date of birth | 15/11/1929 |
The identity of the worlds favourite caveman is pretty safe in this latter format: if you don't have the appropriate key, expect to spend longer than the age of the universe on a brute force attack. One downside is that the encrypted data is much longer than the original due to encoding block lengths - encryption has a price both in terms of performance and resource usage.
Open encryption standards such as AES have made data privacy widely available and commonly encountered. For example:
- The padlock icon on a web browser shows that all communication traffic is encrypted
- Versions of Windows Vista come with BitLocker drive encryption
- Multi-platform encryption tools like TrueCrypt are in common use.
- Archive tools like WinZip now offer strong encryption options
Such techniques are unfortunately only helpful when they are used. As UK civil servants repeatedly find, unencrypted data might not self-destruct, but it can certainly blow up in your face...
Add new comment