Encryption May Increase Vulnerability, Experts Caution

By Dave Nixon

The employment of data encryption could render organisations susceptible to new dangers and threats, a panel of security experts warned today.

Numerous organisations are encrypting their stored data to alleviate fears regarding data theft or loss for instance, US compulsory disclosure laws on data breaches do not pertain to encrypted data.

Nevertheless, experts from IBM Internet Security Systems, Juniper, nCipher and elsewhere said that additionally data encryption develops new risks, especially via attacks, premeditated or accidental, on the key management infrastructure.

The amendment comes predominantly with the swing from encrypting data in transit to encrypting stored data, frequently in reaction to regulatory burden, said Richard Moulds, nCipher’s product strategy EVP.

“A Lot of organisations are new to encryption,” he added. “Their only exposure to it has been with SSL, but that’s just a session. When you shift to data at rest and encrypt your laptop, if you lose the key you trash your data - it’s a self-inflicted denial-of-service attack. Organisations experienced with encryption are standing back and saying this is potentially a nightmare. It is potentially bringing your business to a grinding halt.”

Additionally encryption is equally significant for the bad guys as the good guys, warned Anton Grashion, European security strategist for Juniper. “As soon as you let the cat out of the bag, they’ll be using it too,” he said. “For example, it looks like a great opportunity to start attacking key infrastructures. It’s a new class of DoS attack,” agreed Moulds. “If you can go in and revoke a key and then demand a ransom, it’s a fantastic way of attacking a business.”

Another danger is that over enthusiastic application of encryption will harm an organisation’s capability to legally share and use critical business data, noted Joshua Corman, principal security strategist for IBM ISS.

“One fear I have is that we’re all going to hide all our information, but companies are information-driven, so we take tactical decision and stifle ability to collaborate. Sometimes, the result of implementing security technology is actually a net increase in risk,” added Richard Reiner, chief security and technology officer at Telus Security Solutions.