- Email: [email protected]
Making Data Secure
feature
Making Data Secure Richard Parris Chief Executive, Intercede Limited
This article explains how smart cards can be used to not only meet the requirements of the new Data Protection Act but also to make life that much easier for the average user drowning in multiple usernames and passwords. Since the beginning of March, all organizations have had a specific responsibility to protect any personal data they hold, from abuse or theft, by utilizing appropriate technology. The reason — a new version of the Data Protection Act came into force on 1st March.
Data Protection Act — March 2000 The 8th Principle of the Act states that all personal data “be surrounded by proper security”. In the Schedules to the Act, Principle 8 is expanded upon and reads: “8. Appropriate security measures shall be taken against unauthorized access to, or alteration, disclosure or destruction of,
personal data and against accidental loss or destruction of personal data.” The Data Protection Act applies to any computers that contain personal data such as the employee lists kept by Human Resources, contact details and mailing lists kept by Sales and Marketing and customer information kept by the Accounts department. Organizations now have a responsibility to stop any of that data being misused or stolen and must use appropriate technology to protect it. Any solution designed to stop theft and abuse of sensitive data must carry out at least two functions, these being: • Authentication — which ensures only those with the right to access the data can do so and thereby helps prevent misuse and theft of sensitive data by staff. • Encryption — which ensures the data is
unusable to anybody if the equipment is stolen and provides proof of due diligence by the company in protecting personal information. Adopting a solution that ensures data is only accessible to those with the valid access rights can easily be extended to cover any commercially sensitive material that should also be protected. A smart card solution gives all sensitive data the protection it needs as well as allowing users to access other information from anywhere they like. Hard disk encryption ensures that all the data remains private whilst a smart card provides strong authentication of the user and controls access to computers, the networks and hence the data. Already in common use is for those users needing to carry around sensitive data to be given an encrypted laptop. This is not new — all the laptops the security services keep losing are encrypted. The new part is the use of a smart card to make life that much easier for the user and that much harder for anybody wanting to abuse the system. The smart card can act in many different roles. • It provides the username to make sure that a valid user can access the computer.
Customer or Supplier PKI enabled Remote Access Validated by use of one-time passwords generated by the smartcard
Remote Access Server Validates access by communicating with smartcards on dial-in machines
Connection made via Internet, PSTN or ISDN – secured using VPN
Communications with third parties secured and validated as messages encrypted and digitally signed by PKI keys held on smartcard
Laptop Access Smartcard holds user name and verifies user to laptop at boot up
Local Access Smartcard allows access to protected workstations
Encrypted Laptop Access to data controllled by smartcard.
Figure 1: Schematic diagram showing how a smart card can be used to make life easier for the user. 10
Secure Encrypted Workstation Sensitive data such as accounts, employee records, or client lists encrypted and access controlled by the use of smartcards.
feature • It acts as the validation mechanism for the hard disk encryption. • It provides one time passwords for logging on to central networks by remote access. • It can even contain PKI keys to sign, encrypt and verify electronic messages. The number of roles it can carry out at the same time is increasing. Newer 32k cards (most cards are currently 8k) will allow this functionality to increase even more. The greater the functionality of a smart card the easier and more convenient it is for the user. Having a single card that can act as a cash card, credit card, debit card, door access, encryption, digital signature etc., with only a single pass phrase to remember, is sure to find favour with the majority of users in the future.
“The reason for using hard disk encryption is that it is much simpler and quicker for a user than implementing a routine of encrypting individual files.” A typical scenario at the moment is for sensitive data (employee records, company strategy, etc.) to be kept either on a workstation with access limited by NT security or often on the MD’s laptop. In both cases any member of staff knowing the administrator’s password can access the data. Using individual passwords to protect files quickly becomes difficult to manage for one person and if the files have to be shared the security becomes very weak with the passwords often becoming common knowledge. On top of this the workstation will normally be in the office at all times so giving plenty of opportunity for members of staff to access it after hours, whilst the laptop runs the risk of being stolen and the thief can then hack into the information at leisure. Using smart cards and encryption changes the scenarios totally. If the data is stored on an encrypted partition of
the computer, which can only be accessed by inserting the right smart card, then even the administrator cannot see the data. The administrator can have a smart card that allows the maintenance of the computer but keeps the encrypted data partition hidden from those without the right key. In addition, anybody stealing the computers would need to steal the smart card as well if they are to get at the data. Taking steps such as these to protect data from staff may seem extreme but for many companies the most valuable asset they have is the data they hold. In many industries, such as recruitment, advertising and marketing, staff leave to set up their own companies competing with their former employers. It is not unknown for these members of staff to leave with their own copies of the customer database, staff lists, etc. Keeping this data encrypted and access limited by a smart card minimizes the ability for the data to be ripped off and abused. The reason for using hard disk encryption is that it is much simpler and quicker for a user than implementing a routine of encrypting individual files. In addition, the keys for encrypting the files can be held on the smart card along with the pass phrase rather than the user having to remember different passwords for every file. Combining hard disk encryption, bootup protection and smart cards can ensure that all the data on a computer remains secure and only the owner of the smart card can access the machine. Once the hard disk has been encrypted the process is transparent to the user. The encryption happens at a very low level so all the applications appear to be seeing non-encrypted data. Files are listed just the same as on a non-encrypted machine and opening and working with files or documents is identical. If a user attaches a file to send to somebody by E-mail, it is attached in its unencrypted form. If encrypted E-mail is required another utility such as PKI, can be used to encrypt it and ensure privacy. Integrating the hard disk encryption into smart card authentication makes the
whole system easier to use and increases the overall security. As long as the smart
“Combining hard disk encryption, boot-up protection and smart cards can ensure that all the data on a computer remains secure and only the owner of the smart card can access the machine.” card is in the machine the user can operate it as normal. When the card is removed the machine is locked and the smart card and PIN number are required to unlock it. This authentication can also then be used to identify the user to the network either over the LAN or via Dialup Access. Organizations that have already installed smart cards for authentication found that support calls for resetting passwords dropped considerably after the rollout, as the cards were simpler to use. This fact has surprised many organizations, which wrongly assume that adopting better security measures must increase cost and also impact heavily on the ordinary user. The new generation of security products often have quite the opposite effect. Controlling system access by means of a smart card makes life easier for the user, enhances security and cuts down on support calls. If the same smart card is then used to access different applications via Single Sign On (SSO) life becomes even easier for the user as they have less usernames and passwords to remember and the support costs drop even further. It is hardly surprising that with the demands of Internet Commerce and the Data Protection Act, as well as the availability of new integrated solutions that make systems more usable, the market for security products is expected to increase by an average of 28% per year until 2003 (source: Datamonitor). 11
Making Data Secure Richard Parris Chief Executive, Intercede Limited
This article explains how smart cards can be used to not only meet the requirements of the new Data Protection Act but also to make life that much easier for the average user drowning in multiple usernames and passwords. Since the beginning of March, all organizations have had a specific responsibility to protect any personal data they hold, from abuse or theft, by utilizing appropriate technology. The reason — a new version of the Data Protection Act came into force on 1st March.
Data Protection Act — March 2000 The 8th Principle of the Act states that all personal data “be surrounded by proper security”. In the Schedules to the Act, Principle 8 is expanded upon and reads: “8. Appropriate security measures shall be taken against unauthorized access to, or alteration, disclosure or destruction of,
personal data and against accidental loss or destruction of personal data.” The Data Protection Act applies to any computers that contain personal data such as the employee lists kept by Human Resources, contact details and mailing lists kept by Sales and Marketing and customer information kept by the Accounts department. Organizations now have a responsibility to stop any of that data being misused or stolen and must use appropriate technology to protect it. Any solution designed to stop theft and abuse of sensitive data must carry out at least two functions, these being: • Authentication — which ensures only those with the right to access the data can do so and thereby helps prevent misuse and theft of sensitive data by staff. • Encryption — which ensures the data is
unusable to anybody if the equipment is stolen and provides proof of due diligence by the company in protecting personal information. Adopting a solution that ensures data is only accessible to those with the valid access rights can easily be extended to cover any commercially sensitive material that should also be protected. A smart card solution gives all sensitive data the protection it needs as well as allowing users to access other information from anywhere they like. Hard disk encryption ensures that all the data remains private whilst a smart card provides strong authentication of the user and controls access to computers, the networks and hence the data. Already in common use is for those users needing to carry around sensitive data to be given an encrypted laptop. This is not new — all the laptops the security services keep losing are encrypted. The new part is the use of a smart card to make life that much easier for the user and that much harder for anybody wanting to abuse the system. The smart card can act in many different roles. • It provides the username to make sure that a valid user can access the computer.
Customer or Supplier PKI enabled Remote Access Validated by use of one-time passwords generated by the smartcard
Remote Access Server Validates access by communicating with smartcards on dial-in machines
Connection made via Internet, PSTN or ISDN – secured using VPN
Communications with third parties secured and validated as messages encrypted and digitally signed by PKI keys held on smartcard
Laptop Access Smartcard holds user name and verifies user to laptop at boot up
Local Access Smartcard allows access to protected workstations
Encrypted Laptop Access to data controllled by smartcard.
Figure 1: Schematic diagram showing how a smart card can be used to make life easier for the user. 10
Secure Encrypted Workstation Sensitive data such as accounts, employee records, or client lists encrypted and access controlled by the use of smartcards.
feature • It acts as the validation mechanism for the hard disk encryption. • It provides one time passwords for logging on to central networks by remote access. • It can even contain PKI keys to sign, encrypt and verify electronic messages. The number of roles it can carry out at the same time is increasing. Newer 32k cards (most cards are currently 8k) will allow this functionality to increase even more. The greater the functionality of a smart card the easier and more convenient it is for the user. Having a single card that can act as a cash card, credit card, debit card, door access, encryption, digital signature etc., with only a single pass phrase to remember, is sure to find favour with the majority of users in the future.
“The reason for using hard disk encryption is that it is much simpler and quicker for a user than implementing a routine of encrypting individual files.” A typical scenario at the moment is for sensitive data (employee records, company strategy, etc.) to be kept either on a workstation with access limited by NT security or often on the MD’s laptop. In both cases any member of staff knowing the administrator’s password can access the data. Using individual passwords to protect files quickly becomes difficult to manage for one person and if the files have to be shared the security becomes very weak with the passwords often becoming common knowledge. On top of this the workstation will normally be in the office at all times so giving plenty of opportunity for members of staff to access it after hours, whilst the laptop runs the risk of being stolen and the thief can then hack into the information at leisure. Using smart cards and encryption changes the scenarios totally. If the data is stored on an encrypted partition of
the computer, which can only be accessed by inserting the right smart card, then even the administrator cannot see the data. The administrator can have a smart card that allows the maintenance of the computer but keeps the encrypted data partition hidden from those without the right key. In addition, anybody stealing the computers would need to steal the smart card as well if they are to get at the data. Taking steps such as these to protect data from staff may seem extreme but for many companies the most valuable asset they have is the data they hold. In many industries, such as recruitment, advertising and marketing, staff leave to set up their own companies competing with their former employers. It is not unknown for these members of staff to leave with their own copies of the customer database, staff lists, etc. Keeping this data encrypted and access limited by a smart card minimizes the ability for the data to be ripped off and abused. The reason for using hard disk encryption is that it is much simpler and quicker for a user than implementing a routine of encrypting individual files. In addition, the keys for encrypting the files can be held on the smart card along with the pass phrase rather than the user having to remember different passwords for every file. Combining hard disk encryption, bootup protection and smart cards can ensure that all the data on a computer remains secure and only the owner of the smart card can access the machine. Once the hard disk has been encrypted the process is transparent to the user. The encryption happens at a very low level so all the applications appear to be seeing non-encrypted data. Files are listed just the same as on a non-encrypted machine and opening and working with files or documents is identical. If a user attaches a file to send to somebody by E-mail, it is attached in its unencrypted form. If encrypted E-mail is required another utility such as PKI, can be used to encrypt it and ensure privacy. Integrating the hard disk encryption into smart card authentication makes the
whole system easier to use and increases the overall security. As long as the smart
“Combining hard disk encryption, boot-up protection and smart cards can ensure that all the data on a computer remains secure and only the owner of the smart card can access the machine.” card is in the machine the user can operate it as normal. When the card is removed the machine is locked and the smart card and PIN number are required to unlock it. This authentication can also then be used to identify the user to the network either over the LAN or via Dialup Access. Organizations that have already installed smart cards for authentication found that support calls for resetting passwords dropped considerably after the rollout, as the cards were simpler to use. This fact has surprised many organizations, which wrongly assume that adopting better security measures must increase cost and also impact heavily on the ordinary user. The new generation of security products often have quite the opposite effect. Controlling system access by means of a smart card makes life easier for the user, enhances security and cuts down on support calls. If the same smart card is then used to access different applications via Single Sign On (SSO) life becomes even easier for the user as they have less usernames and passwords to remember and the support costs drop even further. It is hardly surprising that with the demands of Internet Commerce and the Data Protection Act, as well as the availability of new integrated solutions that make systems more usable, the market for security products is expected to increase by an average of 28% per year until 2003 (source: Datamonitor). 11