View Single Post
  #7   (View Single Post)  
Old 2nd November 2010
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Thank you, Ocicat.

Let us start with definitions.

Data protection: data cannot be deleted/changed, or can be recovered if deleted/changed. Examples: read/only media, archives, backups.

Data at rest: Data sitting around on media.

Data in motion: Data in use -- in RAM on a processor, being sent over a network, etc.

Data encryption: obfuscation of data to make it meaningless to anyone but the originator and a recipient with the proper decryption tools and keys to remove the obfuscation.

Keys: Used in combination with encryption / decryption tools to obfuscate or make the data clear. Keys vary in capability, usefulness, complexity of use, ad infinitum, ranging from simple passwords to complex key systems and certification technologies.

Authentication: techniques used to identify users of data-at-rest, or senders and recipients of data-in-motion.

Authorization: techniques used to permit access to data, or to encryption/decription keys.

Key Management: The decisions made about who or what stores or has access to keys, can change keys, and all of the varied authentication systems for those keys, from personal possession or knowledge to certificate authorities and "trust" management. (In my opinion, this is often the most complicated and difficult to understand part of any encryption/decription system. And I further believe it is often the weakest link in any encryption/decryption decision system.)

------

Based on those simple definitions, it should be clear that any encrypted data at rest is not protected unless a protection regimen is instituted. One has nothing to do with the other.

------

There are times when data-in-motion is unencrypted: when the data is being processed by an application, or displayed, or retransmitted. Often, this is not well considered by a data architect.
One example that comes to mind is the recent very vocal and noisy NFSv4 thread on misc@ that began here: http://marc.info/?l=openbsd-misc&m=128818996830209&w=2 -- one of the thread posters who kept it going was happy with his NFSv4 implementation because he thought his strong authentication technology secured his organization's medical data. He not only confused authentication with encryption, eventually he mentioned that he'd combined NFSv4 with CIFS retransmissions -- disclosing to the knowledgeable that his implementation was also retransmitting unencrypted data, or data-in-the-clear, to Windows workstations on his open networks.

Last edited by jggimi; 2nd November 2010 at 12:36 PM.
Reply With Quote