Encryption Beyond the Basics

1
EncryptionBeyond the Basics

• Have a Successful Project and Meet the CSCIC
  Deadline

2
Agenda

• The Need for Encryption
• CSCIC Standards
• Understanding Encryption
• Cold Boot Attack
• Effective Technology Selection
• A Successful Methodology

3
The Need for Encryption

• Data is made vulnerable by mobility
• Sensitive data is lost or stolen nearly everyday

4
Regulations and Standards

• CSCIC
• HIPAA
• Sarbanes-Oxley
• PCI

5
CSCIC Encryption Standards

• All Laptops Full Disk Encryption
• Pre-Boot Authentication
• All PDAs Volume, Folder, File or Field Level
  Encryption
• All USB Flash Drives Volume, Folder, File, or
  Field Level Encryption

6
CSCIC Encryption Standards

• Removable Electronic Storage Media
• FIPS 140 Validation
• Validate Successful Encryption
• December 31, 2008 Deadline

7
Understanding Full Disk Encryption
8
Understanding Full Disk Encryption

• Authentication Modes
• Single Sign On
• Separate Pre-Boot Authentication and Windows
  Authentication
• Windows Integrated Logon
• 2 Factor Authentication

9
Full Disk Encryption - Concerns

• Can I shut down my computer during the initial
  encryption without causing issues?
• How long will it take to encrypt the hard drive?

10
Full Disk Encryption - Concerns

• Will my computer be slower after it is encrypted?
• What will the end user experience during and
  after deployment?
• Can multiple users use one computer?

11
PDA Encryption

• Blackberry
• Windows Mobile
• Palm OS
• Symbian

12
Removable Media

• USB Flash Drives
• SD Cards
• Compaq Flash Cards
• CD/DVD
• Disks (Floppy, Zip, Jazz, etc.)
• MiniDisk
• MP3 Players
• Tapes

13
Your Encryption Roadmap

• Email
• Network Shares

14
Technology Components
15
Central Management
16
Key Management
17
Secure Recovery

• What if a user leaves?
• What if a user refuses to unlock a computer?
• How can I recover an encrypted computer?

18
Cold Boot Attack
19
Effective Technology Selection

• Get Started Soon
• Technology Selection is Critical
• Technology Selection is Difficult
• Very Detailed and Time Consuming

20
Effective Technology Selection
21
Technology Selection Obstacles
22
Encryption Challenges
23
Policy Assessment
Critical to deployment success
24
Successful Solution Methodology
25
Bryan Spinner
3 Columbia Circle Albany, New York
12203 http//www.DandD.com bspinner_at_DandD.com Tel
518.218.0900 Fax [phone]