Encryption is widely used by companies to secure sensitive data. It comes in different varieties and purposes. There's symmetric vs asymmetric encryption, there's encryption at rest, in transit and in use, there's TDE vs record-level encryption vs column/field level encryption, and then there's key-encryption (wrapping). All of these varieties serve different purposes and use-cases that we review - from the point of view of an infosec person, a sysadmin, a developer and an architect.

1. Encryption in the enterprise
Bozhidar Bozhanov, CEO @ LogSentinel

2. About me
• Founder & CEO @ LogSentinel
• Senior software engineer and architect
• https://logsentinel.com/blog
• https://techblog.bozho.net
• LinkedIn: https://www.linkedin.com/in/bozhidar-bozhanov/

3. “We already have encryption”
means nothing

4. Encryption basics
Symmetric
encryption
Asymmetric
encryption
Key Management
• A single/shared key
• Useful if there’s only one party
• Used in conjunction with asymmetric encryption
• Public and private key
• Useful for multi-party communication
• RSA and elliptic curves
• The only secret part of a good encryption scheme is the key
• Key management is the hardest part in encryption
• Ephemeral keys

5. Use-cases
Protecting
sensitive data
Protecting
communication
Authentication Digital signatures
Use-cases

6. What’s the point?

7. Prevent malicious actors from accessing company data

8. (also, compliance -
GDPR, ISO 27001, PCI-DSS, CCPA, PSD2, HIPAA,
HITECH, SOX, GLBA)

9. Types
Data at rest
Data in transit
Data in use
• Decryption on load vs decryption on access
• On load: protects from physical theft
• On access: hard to implement but with multiple benefits
• Protects communication from sniffing
• Mandatory for user-facing communication
• Optional for inter-system communication*
• Protects data from RAM-scraping malware
• Can mean other things in marketing materials

10. What gets encrypted?
Storage
Database
Emails, files,
messengers
• OS-provided encryption (full-disk encryption, LUKS)
• Decrypted with a password-derived key
• Tricky on servers – how to handle reboots?
• File-system encryption/FDE/TDE
• Column-level encryption
• Record-level encryption
• S/MIME email encryption (hard to setup, hampers email security)
• File encryption – encrypted file sharing
• End-to-end encrypted messengers

11. Cloud encryption
IaaS
SaaS
• Options for encryption at rest (AWS, GCP, Azure, etc.)
• Key managements services and Cloud HSMs
• Inter-node encryption and certificate management
• Encryption in transit – always on
• Granular encryption – rarely supported
• BYOK (bring your own key) – rarely supported
• CASB-like solutions – perform encryption on the fly
• Always inquire of the encryption policies of the vendor

12. Other useful aspects
Signing
Crypto-shredding
Authentication
• Signing application artifacts (trust only signed artifacts)
• Signing documents (non-repudiation, integrity)
• Quickly delete data by throwing away the key
• Useful for GDPR erasure
• OTP based on shared key
• Challenge-response (e.g. SSH certificate authentication)
• Split key multi-party authentication
• API authentication

13. Database encryption granularity
Full disk
Column-level
Record-level
• Protects from physical theft
• Useful if there’s only one party
• Used in conjunction with asymmetric encryption
• Encrypts columns with the same key
• Useful for sensitive columns (SSNs, healthcare data, etc.).
• Limited querying functionality
• Can protects against multiple attacks: insiders, leaked
credentials, SQLi, malware, RCE.
• Hard to manage, often requires application-aware decryption
• The decrypter component becomes the only place to access data

14. Key management
Hard
Key protection
• Managing own CA and PKI is burdensome, but necessary
• Key rotation, re-encryption, shredding
• Using the right key parameter (key size, ECC params)
• An encryption scheme is as secure as the key
• Password protection
• Key wrapping
• Audit trail for key usage
• Key use policies
• Rate-limiting key use
• Protect keys in RAM (e.g. disable ptrace)

15. Encryption can be seen as
security through obscurity

16. User-triggered vs automatic
Password-based
encryption
“Server”
encryption
• Requires human intervention
• Data is lost if the password is lost
• Not applicable to applications, databases and servers
• The data needs to be automatically accessible (+ on reboot)
• Passwords key access have to be stored in plaintext ultimately
• Tools like HashiCorp Vault offer a level of indirection and control
• Protect keys (and HSMs) with secrets, protect secrets with
access control policies
• If an application needs to be able to read the data, so can a
determined attacker
• Centralize access to keys and data and enforce rules

17. Example architecture
Web app
Key management service
Encrypted data

18. Per-role best practices
Developer
Sysadmin
Infosec officer
• Be able to encrypt sensitive data within the application
• Use secrets manager via API
• Discard and shred keys used in memory
• PKI and CA setup and support
• Setup LUKS or similar wherever possible
• Manage network policies for access to HSMs
• Introduce encryption policies
• Make sure HSM (or IaaS KMS) policies are properly implemented
• Cryptography training and knowledge sharing

19. Should we encrypt everything?

20. Well…
as much as possible, but not more

21. Encryption best practices
Setup PKI
Encrypt data at rest
for all endpoints
Granular encryption
for sensitive data
Review encryption
policies regularly
Best practices
Force HTTPS
Inquire SaaS
encryption policies
Setup centralized
secrets manager
Centralize and
monitor key access
Enforce key use
policies
Grow internal
cryptographic
knowledge

22. Encryption is not a silver bullet
But it can solve a lot of security and privacy problems

23. Thank you!