IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
In the event of the PC or hard disk being stolen or lost, the offender has a great
deal of time available to gain unauthorised knowledge of the data. A
protective measure must guarantee the confidentiality of the stored data even
when subject to such extended-length attacks.
The protective measure used should therefore be a product with boot
protection and hard disk encryption. Various solutions are available on the
market. The choice lies between encryption software (solution A), a hardware
encryption component (solution B) or a combination of a hardware component
and a software component (solution C). Solution C will typically consist of
encryption software in combination with a chip-card reader to provide access
control. Which solution is chosen is dependent on various decision criteria:
- Security (crypto algorithm and key length, encryption operating mode,
access protection, key generation / distribution/ storage / entry, integration
in the operating system, etc.)
Depending on the operating system platform on which encryption is
performed, certain limits are inevitably reached with software solutions
(solutions A and C). If there cannot be assumed to be a secure operating
system with a strict separation of tasks and memory areas (to date, that has
not been reliably proved of any operating system), the key used during
encryption and decryption must be held unprotected in the memory of the
PC for at least a short time. The confidentiality of the key is therefore no
longer guaranteed. Hardware encryption components (solution B) may
offer more (but not necessarily). The key can be loaded into the hardware
component and stored there in a form that secures it against being read out.
The key will never leave the hardware component again, and is protected
against attempts to search it out. It can only be activated by authorised
users with the appropriate ownership and knowledge (e.g. chip card and
password). Other aspects are also important, such as the algorithms used
for encryption (usually a block encipherment algorithm), their modes of
operation (e.g. CBC) and the way in which they are integrated into the PC
system. Ideally, the encryption hardware should be integrated in such a
way that it compulsorily encrypts the entire hard disk and cannot be
deactivated or bypassed by attacks without this being noticed. If contrary to
this only individual files are encrypted, there is a risk that the contents of
these files may additionally be written to the hard disk in plain text in an
uncontrollable manner at least in part (for example to the swap files of
various operating systems or to backup files).
- Performance (speed of executable programs)
Software encryption utilises the system resources of the PC; it is therefore
a burden on the CPU and uses main memory. At the latest when the entire
hard disk is encrypted, the performance of the PC will fall. Hardware
components with their own processor may perform encryption without
burdening the PC’s CPU and consequently without any notable loss of
performance. In this respect the throughput rate of the encryption hardware
used is one of the crucial factors, depending on the design.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000