The impending GDPR regulations will set a new standard for data protection and privacy. Recognised by security experts from across the globe, the GDPR advocates the use of “strong and effective encryption” to ensure long-term privacy and integrity of data.
Despite this, as Hashed Out’s Patrick Nohe points out, certain law enforcement organisations continue to push for encryption backdoors, or the general weakening of best-practice encryption standards.
Sensibly, the GDPR committee ignored the request. However, the dilemma facing the law enforcement community has served to highlight the fundamental differences between encryption technologies. Specifically, it makes the distinction between strong, high-assurance solutions and weaker, low-assurance alternatives.
It’s important for Network Architects and IT security professionals to understand that not all encryption solutions are the same; in a rush towards GDPR compliance there is the risk that some organisations may fall into “traps for the trusting”.
Choosing a low-cost, low-assurance encryption solution on the basis that it may help you tick the compliance box is not only a false economy but may also expose your business to even greater risk. Worse still, it’s a waste of time and effort, as it doesn’t meet the GDPR standards for “strong, effective end-to-end encryption”.
One example of low-assurance encryption is the use of the MACsec standard. Originally developed for local area networks MACsec does not scale to provide effective WAN security.
When embedded into network devices, such as switches and routers, the resulting multi-function devices expose the network to additional risk:
- Multi-function network devices do not offer effective encryption as they are not dedicated security devices and do not provide separation of duties between security and network functions.
- A weaker encryption standard is applied; one that does not meet the GDPR requirements.
- Hundreds of thousands of switches and routers have recently been found to contain vulnerabilities that allow hackers to take control of the device. With it they can control the network, data routing and even turn off the encryption
Then there is the issue of independent testing for certification. Solutions that hold international security certifications, such as Common Criteria, FIPS etc. provide valuable peace of mind. However, it is not just certification itself that matters, but the details of the specific level of security certification.
There are many low-assurance solutions on the market that claim some degree of certification but look beneath the veneer of respectability and you may find that they are not suitable for securing sensitive, valuable, personal or confidential data.
Any secure solution should, by definition, be dependable. Especially when under attack. It must not expose the user to risks resulting from vulnerabilities in the hardware, software or weaknesses in the standards applied. As defined by the GDPR, it should provide end-to-end encryption.
Dedicated high-assurance hardware encryption is not always the answer. For large-scale WAN infrastructure, securing every link with a hardware device may not be practical. But organisations should not be tempted with low-cost, low-assurance solutions. Low-assurance may as well be no-assurance as it does not meet the GDPR standards for effective encryption.
If you’d like to find out more about high-assurance encryption hardware, you can visit the product pages of our site.
