Going the open source route to encrypt enterprise data has its own potential pitfalls
When Unisys CISO John Frymier came in to work on Friday, Sept. 6, the phones were ringing, and continued to ring all day. Customers were panicking over the news headlines of the day before.
Credit: Flickr: Mlcastle
The NSA had cracked Internet encryption.
The NSA was listening in to everything.
European customers were especially concerned, he says.
Fortunately, many of the headlines had been unnecessarily alarmist.
“The earlier types of encryption, with 64 bits or less, the NSA has figured out how to brute force decrypt at least some of that traffic,” he says. “But the more modern, strong encryption, with 128 or 256 encryption units, they can’t decrypt that. And it bothers them no end.”
Customers can still trust it, he says.
[ALSO: Should the NSA be reformed?]
“Modern encryption implemented well is perfectly secure and nobody can crack it,” he says. “Strong encryption is still safe.”
But what exactly does “implemented well” mean? And what about back doors deliberately installed by the NSA in commercial encryption software?
According to encryption expert Bruce Schneier, a fellow at Harvard’s Berkman Center for Internet and Society, one solution is to use open source encryption algorithms.
But open source encryption, while publicly vetted by security experts, academics, and a global community of paranoid code wranglers, has its pitfalls as well. In particular, open source encryption requires a higher level of in-house expertise to implement, and there may be a shortage of encryption experts to go around. In addition, open source products may not offer the same level of functionality and support as commercial offerings.
According to Schneier, who had direct access to the leaked NSA documents, the NSA asks vendors to make subtle changes to their encryption software to make it more vulnerable. For example, a random number generator might not be as random as it should be. Or the software could leak keys in some undetectable way.
And if the problem is detected, the vendor can explain it away as a mistake, he says.
Though that may be changing.
“Thankfully, companies that colluded with the NSA are being penalized in the marketplace,” says Schneier.
One of his recommendations is to be suspicious of commercial encryption software and to opt for open-source alternatives.
In particular, open-source alternatives that have to be compatible with multiple implementations, since changes to the core code base have to undergo extra scrutiny to ensure that they don’t break compatibility with the various implementations.
Now that there’s so much attention focused on the possibility of backdoors sponsored by the NSA, or other players, the level of attention open source encryption software receives will only increase.
In fact, encryption is pretty much the only area in information security where the more the public knows about a process, the better.
“To think that a proprietary algorithm can be better simply because its source code is unknown is, to put it mildly, ludicrous,” says Pierluigi Stella, CTO of network security vendor Network Box USA. “There’s no way anyone can write an algorithm and sufficiently test it to ensure no one will ever find a small crack in the code to render its encryption completely useless. These algorithms need to be tested, tested and tested yet again, to ensure they really work and are strong. And the only way to do so is to make them public. I don’t know with certainty if there’s been a surge of interest in open source. All I know is that I would never use anything else.”
Experts in short supply
According to a report released earlier this year by workforce technology vendor Burning Glass Technologies, demand for cybersecurity professionals grew 3.5 times faster over the past five years than demand for other technology specialties, and about 12 times faster than for all other jobs.
And the 2013 Global Information Security Workforce Study by Frost & Sullivan reported that two-thirds of chief security officers are short-staffed – partly due to an inability to find enough talent.
“There aren’t enough cryptographers,” confirms Jon Oltsik, an analyst with the Enterprise Strategy Group, an IT research firm. “So the default is to buy a solution from the vendor. There’s nothing wrong with that, especially if you’re in an industry where either your intellectual property isn’t that valuable, or you don’t fear the NSA.”
For example, a company that encrypts data for compliance reasons isn’t going to be penalized by regulators because of the existence of an NSA back door. “But, otherwise, it’s worth exploring open source as an option, especially if you have a lot of technical expertise on your staff,” Oltsik says.
Popular options include disk encryption tools such as TrueCrypt, AxCrypt and GNU Privacy Guard.
GNU Privacy Guard is available for Windows, but it comes out of the GNU/Linux project and, in fact, there’s a wide variety of open source encryption related tools available for the Linux platform. For companies looking for SSL encryption, OpenSSL is a popular open source platform.
For enterprises looking to build secure web applications for clients, there’s the recently launched open source Crypton project, which allows cloud vendors to encrypt customer data in such a way that the vendors themselves have no access to it.
Expertise is required because it’s not enough to simply pick a strong encryption algorithm, Olstik says.
“We know that it’s nearly impossible to brute-force and hack an encryption system,” he says. So hackers – and government authorities – typically go after the surrounding systems such as key management and random number generators.
All of those systems need to be vetted and properly implemented, as well. One alternative is to use open source software and select trusted security vendors to deploy and maintain it. “It is a direction that people are going into,” says Oltsik.
Functionality and support
Historically, open source software, developed by developers for developers, has lagged behind proprietary alternatives when it comes to completeness, usability and support. In addition, a private company can sometimes innovate faster than the open source community.
Open source encryption is just one of the building blocks of a complex security system, says Bob Janacek, CTO at DataMotion, which specializes in encrypted emails, files, and forms.
“The user must handle everything else, including finding a way to exchange keys, storing and transporting the encrypted data, tracking and reporting, making the encryption usable for someone who is not technical, and interoperating with other systems,” he says. “Proprietary encryption systems provide a number of technology layers on top of these basic encryption building blocks.”
The result is a platform that’s more convenient for users. “Any form of security is useless if it is not used,” he says.
Meanwhile, vendors are dealing with the fallout by increasing the transparency of their technology and systems, and by setting up their business so that even if they were ordered to turn over customer data, they wouldn’t have the ability to do so.
“By design, we decided not to offer business services to anyone,” says Pravin Kothari, founder and CEO of cloud security vendor CipherCloud. “We don’t have any traffic. We don’t keep any keys.”
Instead, CipherCloud offers a security appliance that can run behind the customer’s firewall that encrypts data before it’s sent out to a cloud service provider, and decrypts it again when it comes back. The customer controls the appliance and the keys it generates.
“Our customers can monitor the traffic going out, harden the box, monitor everything,” says Kothari.
Even though his company makes proprietary software, Kothari agrees that open source products have a public relations advantage, especially with the stream of news reports about agencies and companies providing compromised solutions. “Open source encryption is always preferable because of the influence you can get from government agencies,” he says. Internally, the company uses AES encryption in its product, which is an open standard.
He also points out that companies approached by the NSA aren’t allowed to talk about it, but adds that his company hasn’t been visited. “Maybe because we’re not Google or Microsoft-sized.”
Adrian Sanabria, an analyst at 451 Research, says that it’s becoming increasingly common for customers to demand control of their keys, even in a cloud-based service environment.
“There are a ton of startups that are doing this now that exist solely to be a secure wrapper in the cloud around your data,” he says. They include Toronto-based PerspecSys, New York-based Vaultive, Tel Aviv-based Porticor, Austin-based Gazzang, and San Jose-based Vormetric.
Plus, it insulates the vendor from having to decide between turning over customer data and shutting down the whole company – which is already happening.
“This is the first time I’ve seen companies closing down services in anticipation of being asked to or forced to turn over customer information,” Sanabria says.
In addition, some commercial software vendors will open up their software if a customer is willing to sign a non-disclosure agreement, or allow reviews by third-party auditors. “I can see more that happening as it becomes more an issue for buyers,” he says.
Today’s climate is reminiscent of 10 years ago, when librarians found out that the Patriot Act allowed government agents to see customer lending histories, recalls Eric Murray, security architect at Hadoop deployment software vendor Zettaset. Technology vendors could take a page out of those librarians’ playbook, he suggests.
“Some librarians were putting up posters saying, ‘We have not yet been visited by the NSA,’ with small text underneath, ‘This poster can disappear at any time’,” he says.
And he adds that his company’s only interaction with the NSA, so far, has been to get export approval for the software. “The NSA basically just asked us what we were doing and went away.”
Korolov is a freelance writer. She can be reached at maria@tromblyinternational.com.
