What are some best practices for implementation of encryption solutions?

[peluso]

Hi Experts,

I think it would be great to hear from you about encryption implementation best practices -- are there any best known methods, tips, documentation....etc....?

Thanks!

[wmichael]

This is quite a formidable topic, but I will take a first stab at it.  Hopefully others will be able to chime in and offer some further advice.

Architectural considerations:

• Make sure the deployment is highly available. 
  • Deployments should offer multiple paths to access the encrypted data.
  • Encrypting endpoints should be able to retrieve and back keys up to multiple key managers
• Identify areas where encrypted data needs to move
  • Sites receiving encrypted data will need to have access to the encryption keys in order to restore the data

Administration considerations:

• Identify security officers responsible for managing the data encryption keys
  • Implement role separation for administration of the encryption devices and key managers
  • Use 2 factor authentication and require a quorum of security officers to be present for sensitive operations involving issues such as key recovery

Encryption Policy considerations:

• Develop a data life cycle and include encryption keys in the policy
  • When encrypted backup tapes expire, the keys should also be set to expire
  • When destroying an encrypted LUN, or retiring encrypted disks, make sure your key manager is able to easily and correctly identify the keys in order to facilitate deletion

[edbrown · Accepted solution]

Also, to add to Mike's points, best practice defines that you have policiesin place to take advantage of encryption.

1. Identify the data that must be encrypted prior to settling on a solution. Encrypting everything usually is not a suitable approach.

2. Set policies on who can access the data with what conditions and by which method. This may involve restricting access through specific servers with enhanced authentication and logging. Encryption is only as good as the policies, authentication and logging that is available.

3. Have logging servers that are secure ready to integrate your encryption solution as well as your authentication to ensure that tracking and control measures are effective.

4. Have a secured ethernet network for management of the infrastructure that is accessible only by those that need access to manage the encryption and assets.

5. Establish roles with separate passwords and two factor authentication for :

     a. Security administration - This usually can be someone responsible for data security in the environment.

     b. Physical administation - In a typical environment technical staff have the skills to implment the solution.

6. Never entrust all passwords to one person. This puts the whole security of the environment at risk if that person abruptly quits or is terminated. Share roles across two or three trusted employees.

There are still others but much of this should be decided upon prior to implementation.