GSN Digital Edition April 2016

Campbell on Crypto
Cybersecurity and Occam’s Razor –
Encryption is the Simplest Answer
By Shawn Campbell
When it comes to OMB’s Cybersecurity
Strategy and Implementation
Plan (CISP), it may be
best to apply the problem-solving
principle of Occam’s Razor: The
simplest answer is usually correct.
And the simplest answer is:
Encrypt everything, from datain-motion
to data-at-rest.
CISP underscores the need for
agencies to implement
an indepth
defensive
strategy to protect
high value
information and
assets – especially
sensitive
data, sensitive
keys, and identity credentials.
Sensitive data at rest is particularly
vulnerable once a breach
has occurred, because of its volume
and relevance.
The true threat to sensitive data
comes from attackers hijacking
privileged accounts with full access
to servers. In some cases,
“Insiders are a major source of breaches,”
whether intentional and malicious or
through inadvertent misuse by employees
or partners.
22
the attackers are actually insiders
with existing elevated privileges.
Privileged accounts are where
data is most readily available;
other end points do hold data,
but that data is too widely distributed
to be as great a threat.
The greatest risk to unauthorized
data access comes from insider
threats, which are surprisingly
prevalent. As early as 2012,
the industry analyst firm Forrester
noted that (particularly in the
private sector) “insiders are a major
source of breaches,” whether
intentional and malicious or
through inadvertent misuse by
employees or partners. Privileged
accounts have access to considerable
amounts of data. Today,
through the sharing of administrator
and superuser accounts, as
well as physical theft of servers,
insiders present both a real and
growing threat.
Enter Occam’s Razor
To address CISP’s requirement
for protection of high value information
and assets,
the best way
for agencies is the
simplest: Encrypt
all sensitive data on
your storage array.
What it boils
down to is, if sensitive
data is encrypted,
then it is safe. And if you
don’t know which of your data is
sensitive, then encrypt all of it.
As an added layer of protection,
separately store the encryption
keys used to encrypt and decrypt
data. When an encryption key is
stored separately from the data –
ideally on a hardened device – it