So, why do security professionals harp on the need for encryption so much? Because we assume encryption safeguards will be done properly, and in conjunction with other layers of security that will complement them.

In this breach (summarized HERE, and originally reported HERE), a server containing credit card numbers was compromised by hackers from the Internet. The company was a provider of news and ad syndication for the web. The breach allowed the credit card information of 4500 customers to be stolen.


What went wrong?

Most security managers who read this will immediately guess that “they weren’t complying with the Payment Card Industry Data Security Standard” (in PDF format HERE). This is the standard to which credit card companies hold their merchants and other partners handling information related to their payment card systems.

One requirement of the PCI standard is that any sensitive information is stored and transmitted in encrypted form. But the card numbers “WERE” encrypted by the company …and they were still compromised! So, what good are these encryption requirements?

Here are some important things to know about encryption of stored data:

  1. When data is stored in encrypted form (such as in an encrypted data base or encrypted files - often called File Encryption), it is analogous to putting it into a safe. Usually a safe is pretty secure.
  2. The critical vulnerability for this type of security is usually in how you protect the access mechanism (for a safe, either a key or combination). If you don’t keep the safe’s key in a safe place where it is only accessible to people who need it, there is a good chance it will be seen and misused. If you write down a combination and don’t put it in a safe place, the same thing can happen.
  3. For most types of commonly used encryption, it is usually easier to try to find the key (or password that the key is derived from), than to break the encryption algorithm that protects the data file.

In this case, the key for the encrypted files was found by the hackers on an Application Server. Application servers usually do need to use the encryption key to processes the data as it is collected, or when the transaction information is sent to other parties in the payment system.

The Bottom Line

Encryption is intended to be a temporary thing. There is always an intent to be able to decrypt the information at some point. So, after encryption, the key must be kept accessible to those who need it, but secure from anyone else.

Remember the following things about encryption:

  1. Encryption is not considered a total safeguard in most situations.
  2. You usually need other safeguards to protect the keys as they are being created, used, stored and destroyed.
  3. You can encrypt keys, but then you need to protect the key that was used to encrypt the original key. Hackers know this, and will look for a “root key” that will allow them to work through the chain until they find the one that decrypts the data.
  4. Protecting encryption keys in an operational environment often involves the elements of strong physical security, authentication and access control.

While the details of this breach aren’t clear, it is very likely that the PCI standard was not implemented correctly. However, in looking at Sections 3.4, 3.5 and 3.6 of the PCI standard, very little is said about how they expect keys to be protected when in use by Application Servers. Is this a weakness in the standard?

So, encryption can be a waste of time if the keys aren’t managed securely. It’s like locking your car in the driveway and leaving the key on the front step.