How To Protect The Encryption Keys To Your Kingdom

Tatu Ylönen, CEO and founder of SSH Communications Security, was clearly frustrated as we talked over lunch. “Why can’t I get through to them,” he asked, almost rhetorically. Ylönen was expressing a level of dismay common in the security industry.

Getting senior management to invest in security can be a daunting task.

Unfortunately for many managers, security remains a cost center in their minds and that in turn gives them reason enough to skimp. When the quarterly balance sheets come out, it’s easy to improve the bottom line by cutting back on security.

That’s no surprise to the IT staff, where budgets are often cut to the point that the department can no longer function effectively.

Encryption Key Management

The reason that managers can get away with cutting back on critical functions such as IT services and security is because the consequences are delayed.

You won’t realize the costs of cutting the security budget until a major network breach sometime later results in the theft or public exposure of customer accounts, trade secrets and internal financial records.

What even makes even less sense is an organization that goes to the trouble to try to keep data out of the hands of cyber-criminals by routinely encrypting data and communications, but fails to provide the adequate resources to manage the encryption keys.

Without proper management, the keys that ensure your communications remain encrypted can frequently be found where criminals can find them. Worse, when they’re not properly managed, encryption keys may be left in place for years, long after the devices they were protecting are out of service.

Ylönen explained that an encryption key is simply a string of something over 100 numbers that are used like a password to gain access to a network device. The keys are usually embedded in the software that provides the encrypted link between secure systems.

Key overload

One of the major methods of encrypting communications is by using the SSH (secure shell) protocol, which Ylönen invented. His company, SSH Communications Security, provides the encryption keys.

The problem, unfortunately, is that when encryption keys are purchased for secure devices, many companies get far more keys than they need. When those keys aren’t management properly, it’s possible for a hacker to find the keys and then try them against a company’s secure communications infrastructure. This type of breach does happen with depressing regularity, according to Ylönen.

The solution to this problem is to adopt some kind of key management system that ensures encryption keys are protected, that they aren’t left installed in obsolete equipment when it’s taken out of service and tracks where keys are assigned so they can be recovered.

Originally published on eWeek

Page: 1 2

Wayne Rash

Wayne Rash is senior correspondent for eWEEK and a writer with 30 years of experience. His career includes IT work for the US Air Force.

Recent Posts

US Finalises Billions In Awards To Samsung, Texas Instruments

US finalises $4.7bn award to Samsung Electronics, $1.6bn to Texas Instruments to boost domestic chip…

2 hours ago

OpenAI Starts Testing New ‘Reasoning’ AI Model

OpenAI begins safety testing of new model o3 that uses 'reasoning' process to ensure reliability…

3 hours ago

US ‘Adding Sophgo’ To Blacklist Over Link To Huawei AI Chip

US Commerce Department reportedly adding China's Sophgo to trade blacklist after TSMC-manufactured part found in…

3 hours ago

Amazon Workers Go On Strike Across US

Amazon staff in seven cities across US go on strike after company fails to negotiate,…

4 hours ago

Senators Ask Biden To Extend TikTok Ban Deadline

Two US senators ask president Joe Biden to delay TikTok ban by 90 days after…

4 hours ago

Journalism Group Calls On Apple To Remove AI Feature

Reporters Without Borders calls on Apple to remove AI notification summaries feature after it generates…

5 hours ago