Cybercrime , Cybersecurity , Data Breach

Analysis of Common Mistakes Made When Encrypting Data(gsuparna) • January 8, 2019    

The Marriott mega-breach is calling attention to the issues of whether organizations are storing too much data and whether they're adequately protecting it with the proper encryption steps.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

In its revised findings about a mega-breach that it now says affected 327 million customers, Marriott notes that 25.6 million passport numbers were exposed in the breach, of which 5.25 million were unencrypted. "There is no evidence that the unauthorized third party accessed the master encryption key needed to decrypt the encrypted passport numbers," Marriott says. But that doesn't mean that the attackers couldn't later brute-force decrypt the numbers (see: Marriott Mega-Breach: Victim Count Drops to 383 Million).

Also exposed in the breach were approximately 8.6 million encrypted payment cards that were being stored by Marriott. By the time the breach was discovered in late 2018, however, Marriott says most of the payment cards had already expired. As with the passport data, "there is no evidence that the unauthorized third party accessed either of the components needed to decrypt the encrypted payment card numbers," Marriott says.

U.S. Sen. Mark Warner, D-Virginia, says the breach highlights a failure by many organizations to minimize the amount of data they routinely store on consumers.

"It's unacceptable that Marriott was retaining sensitive data like passport numbers for so long, and it's unconscionable that it kept this data unencrypted," said Warner, who co-chairs the Senate Cybersecurity Caucus, the Wall Street Journal reported.

Meanwhile, security experts around the world are calling attention to the need to take all necessary steps to properly encrypt sensitive data that organizations store.

Common Mistakes

Although cryptography is being added to more backend applications, it's often being implemented incorrectly, contends Steve Marshall, chief information security officer and head of cyber consulting at Bytes Software Services, a U.K.-based IT company. "This often leaves organizations with a false sense of security, which, unfortunately becomes evident when they are attacked," he says.

And with governments across the world pushing for encryption backdoors to be used by law enforcement, the hacking risks could get worse.

Jagdeep Singh, head of risk and governance at Instarem, a Singapore-based payments company, says many companies worldwide make common mistakes when implementing encryption. For example, they:

Misconfigure implementation; Deploy vulnerable versions of crypto solutions; Use the same key in both directions for communication; Fail to understand the points of weakest controls; Implement weak cypher suites; Design their own crypto algorithms.

Overlooking Critical Steps

Tarun Pant, CEO at SecurelyShare, a Bangalore-based company, says too many organizations focus on encrypting data while it's transmitted but fail to encrypt it when it's at rest.

"Many organizations don't do end-to-end encryption of data," he says. "Hence, the weakest link is often the source of the breach. Data at rest, if not encrypted with source key, leads to breaches from within the organization."

Too many companies take a "check list" approach to data security, focusing narrowly on regulatory compliance. These firms often don't devote enough time and effort to properly implementing encryption, security experts say.

"Many development teams adding encryption to their code call it a day once they achieve the minimum security needed for a regulatory checkmark. This attitude is dangerous," Singh says (see: Demystifying DevSecOps and Its Role in App Security).

Managing Machine Identities

Kevin Bocek, vice president of security strategy and threat intelligence for Salt Lake City, Utah-based Venafi, a cybersecurity company that develops software to secure and protect cryptographic keys, says managing machine identities that are used to establish encryption is challenging for many organizations.

"Investigations have shown that simply not keeping track of machine identities, like TLS certificates, can create encrypted tunnels for hackers to hide in," Bocek says. "In addition, if a simple machine identity, like a key and certificate, not being updated, mobile networks across entire countries can be impacted."

Depending on where encryption occurs - column level vs. application level - what encryption techniques are used and what kind of vulnerability is being exploited, attackers can use many different techniques to cause data breaches, says Sandesh Anand, managing consultant at Synopsys, a Mountain View, Calif.-based technology company.

"Practitioners should not build their own crypto algorithms or libraries," he stresses. "They should instead focus on implementing well-known, peer-reviewed, secure algorithms properly."

Anand says the best algorithms to use are AES or Advanced Encryption Standard for symmetric encryption algorithm, RSA for asymmetric encryption algorithm and SHA-256 for hashing.

Mistakes in key management also can lead to trouble, Anand says. "Often firms end up either using short keys or they end up using the same key for months," he says. "Then there is the problem of insecure key management."

Pune-based Rohan Vibhandik, a security researcher with a multinational company, notes: "Storing or transmitting keys insecurely remains a common mistake, especially in case of a symmetric key where a single key is used at both ends - encryption and decryption."

While it's important to secure the storage of machine identities, including keys, it's become even more critical to be able to have the capability to change machine identities fast, Bocek stresses.

"Browsers can distrust Certificate Authorities. This means businesses have to quickly find and change out machine identities, like TLS keys and certificates, used for encryption," he says.

Foolproof Solution?

While encryption plays an important role in data security, it's not a cure-all, security experts stress.

"Encryption is just one of the many controls that protect data while in transit or at rest," Singh says. "However, there are numerous ways to circumvent encryption in a client-server model. "Also, encryption technologies and the way they get adopted are still evolving."

Anand notes: "Remember: The strength of a chain is the weakest link. So, if crypto keys are lying around in insecure locations or if database admins use weak passwords, data can still be breached. Finally, insecure application controls can also lead to a breach."

Proper Key Management

An important aspect of encryption is proper key management.

"Key management is a challenge that grows with the size and complexity of your environment," Pant says. "The larger the user base, the more diverse the environment, the more distributed the keys are. Hence the challenges of key management will be greater."

Singh recommends organizations avoid saving keys in the same server as the encrypted data.

"One needs to ensure that private keys, when stored, are non-exportable. Also, one must not use the same keys for both directions," he says. He also recommends adoption of proper standards, including TLS, or Transport Layer Security, while data is in transit. "Avoid using secure sockets layer as it is outdated," he emphasizes.

To help ensure that encrypted data remains untampered, adding a layer of hashing and salting is essential, Vibhandik says.

"When data is encrypted, one must hash it using functions like MD5 and SHA," he says. "To provide further layered security to the hashed data, SALT function must be used; that can prevent tampering of data.

"One must remember that hashing does not add any privacy to data; it only saves against any data alteration or tampering attempts. Encryption provides privacy to your data but does not make it tamper proof. So a combination of both is important for endpoint and end-to-end communication and data security."