Local Encryption ... Why Not?
-
@BRRABill said:
I also understand the concept that things like servers, or any device with important data should be locked up, and almost impossible to gain physical access to. But just in case, why not add the extra protection?
Because encryption always adds risk. It might take risk away, but it always adds risk too. It's always a tradeoff in risks. When the risk you are taking away is completely trivial, you don't really want to make that tradeoff.
I've worked in some of the most secure environments in the world and even there they would only encrypt in the most specific circumstances. Even their security team (we are talking potentially seven figure security advisors) and their entire IT team would general advise against encryption for 90% of workloads because it introduces big risk while reducing effectively none.
If the biggest, riskiest, most attacked, biggest budget, most secure environments in the world think that it is a silly waste of resources and that it does not add any meaningful protection: it is worth listening.
-
@scottalanmiller said:
Is this product free? How reliable is it? What happens if you have Active Directory issues? Do you now have to track individual admin passwords for each machine?
It is not free. It is $39 standalone.
Been reliable so far except when an AV program broke it. And even that didn't break it, it just broke the single sign on for that client, which I do not have enable on my machine anyway.
I guess it would depend on the AD issues. If worst came to worst, I could log in as the SED Admin account I created on the drive and unlock it.
You do have to track admin passwords. They have software that integrates in a larger environment, but for me it's just as easy to track the admin passwords. I use a huge complex password, and keep it the same on all the devices I need to manage.
-
@BRRABill said:
I am under the impression that for HIPAA, if a laptop with PHI is lost, and the drive is encrypted, that is basically not a violation for them, as the data is deemed inaccessible. No encryption? It is a major issue.
This is a grey area. There are no checkboxes with HIPAA. There are "anti-checkboxes", meaning things that you can never do, but there is nothing that you always have to do. Things that must be avoided but nothing that has to be done.
HIPAA is about "reasonable efforts at security." And much of that will come down to expert witnesses and a judge making a determination. If I had a laptop stolen and it was encrypted and someone broke that encryption I'd hate to face an expert witness and a judge who ask me "so why did you have data on a laptop in the first place?"
Encryption would be expected in that situation, but if not implemented well it would no more protect you from a HIPAA fine than if you did not have it. It's a good starting point once you assume you are doing things like putting data on endpoints. But we will keep coming back to asking "why are we being so risky in the first place and does encrypting those devices encourage reckless behaviour?"
-
@BRRABill said:
I guess it would depend on the AD issues. If worst came to worst, I could log in as the SED Admin account I created on the drive and unlock it.
You do have to track admin passwords. They have software that integrates in a larger environment, but for me it's just as easy to track the admin passwords. I use a huge complex password, and keep it the same on all the devices I need to manage.
So if that one password was to be compromised, all encryption would be useless? And if that one password is not available, all of that data is at risk? I don't like the sounds of those odds. I can see cases where that would make sense, but I'd feel pretty worried in any situation where I felt the need to deploy it.
If I have data stored somewhere, I want to know that it can be retrieved reliably. If I don't need it retrieved reliably, why store it there?
-
@scottalanmiller
I agree here... if there is no data on the endpoint.. there is nothing to worry about - atthat end. You move it to the convenience and the host.You also pretty much pull all your costs back to your network and your host as you need next to nothing but a terminal at the user.
-
@BRRABill said:
It is not free. It is $39 standalone.
Not bad but that adds up, too. If the question is "why not just do it", I'd say that it needs to have a clear value in excess of $39 as a starting point. For most machines that I deal with, it would not. The cost of the license and license management alone would be too costly before we consider any risk that it introduces, performance loss that it causes or IT overhead cost that it brings in.
-
@scottalanmiller said:
So if that one password was to be compromised, all encryption would be useless? And if that one password is not available, all of that data is at risk? I don't like the sounds of those odds. I can see cases where that would make sense, but I'd feel pretty worried in any situation where I felt the need to deploy it.
If it was compromised the encryption wouldn't be useless, the person with the compromised password could just access the data. So they would have to have somehow gained access to my very complex password AND stolen the machine with the SED.
The password is always available, unless I am dead. And even in that instance, the user still have their password so they could get in, and the data on these systems are all backed up. (Also with encryption both locally and in the cloud.)
I think the switchover point is around machines, where they recommend central management. But for a one-off here and there it wouldn't make sense.
-
@scottalanmiller said:
HIPAA is about "reasonable efforts at security." And much of that will come down to expert witnesses and a judge making a determination. If I had a laptop stolen and it was encrypted and someone broke that encryption I'd hate to face an expert witness and a judge who ask me "so why did you have data on a laptop in the first place?"
But again, what are the odds of this?
As has been discussed in other threads, there is a still a lot of data on endpoints, right or wrong. Or at least, that is my feeling. Would love to hear other thoughts of people in the wild or this.
-
In your "all on the cloud" example...
Let's say a covered entity transfers a file of mailing addresses (PHI, obviously) to me. It stored on a HIPAA-compliant cloud service, so no issues there. I want to bring down the file to locally make labels and print on my machine.
How does this work? I assume you'd download it, do your work, and then delete all instances?
I guess in this scenario, I could use a product like "Deep Freeze" so there is NEVER any data on there. But that is a very limited case.
-
@scottalanmiller said:
Why would you by syncing? Again, the point is not to do these things.
Usage on a laptop when there is not WiFi?
Or if they are very large files, so as to not have to wait to work with them?
Or if they are files for which there is no cloud-version available. Such as a lot of the third party software we've been discussing. And while products such as QuickBooks or Lacerte might have better alternatives, a lot of the proprietary stuff you'd see in a doctor's office, or financial planner's office might not.
-
@BRRABill said:
@scottalanmiller said:
So if that one password was to be compromised, all encryption would be useless? And if that one password is not available, all of that data is at risk? I don't like the sounds of those odds. I can see cases where that would make sense, but I'd feel pretty worried in any situation where I felt the need to deploy it.
If it was compromised the encryption wouldn't be useless, the person with the compromised password could just access the data. So they would have to have somehow gained access to my very complex password AND stolen the machine with the SED.
The password is always available, unless I am dead. And even in that instance, the user still have their password so they could get in, and the data on these systems are all backed up. (Also with encryption both locally and in the cloud.)
I think the switchover point is around machines, where they recommend central management. But for a one-off here and there it wouldn't make sense.
Unless the encryption system has some type of OS that boots before windows, how does that part work?
-
@BRRABill said:
In your "all on the cloud" example...
Let's say a covered entity transfers a file of mailing addresses (PHI, obviously) to me. It stored on a HIPAA-compliant cloud service, so no issues there. I want to bring down the file to locally make labels and print on my machine.
How does this work? I assume you'd download it, do your work, and then delete all instances?
I guess in this scenario, I could use a product like "Deep Freeze" so there is NEVER any data on there. But that is a very limited case.
Well, if you are working with something like O365 and ODfB and SharePoint, you don't download it in the traditional sense. it's downloaded to your application where you do what you need.. when you close it.. the temp files are deleted by default and the file is saved back to the cloud where you go it, all automagically.
-
@Dashrender said:
Unless the encryption system has some type of OS that boots before windows, how does that part work?
It is built into the drive.
Once the machine boots past the DELL logo, a WAVE screen comes up asking for a password.
-
@BRRABill said:
@scottalanmiller said:
So if that one password was to be compromised, all encryption would be useless? And if that one password is not available, all of that data is at risk? I don't like the sounds of those odds. I can see cases where that would make sense, but I'd feel pretty worried in any situation where I felt the need to deploy it.
If it was compromised the encryption wouldn't be useless, the person with the compromised password could just access the data. So they would have to have somehow gained access to my very complex password AND stolen the machine with the SED.
The password is always available, unless I am dead. And even in that instance, the user still have their password so they could get in, and the data on these systems are all backed up. (Also with encryption both locally and in the cloud.)
I think the switchover point is around machines, where they recommend central management. But for a one-off here and there it wouldn't make sense.
I don't know, the bigger the scale the bigger the risk and the more important that it is to keep the data off of the machines completely. The bigger you get, the more this kind of stuff costs in raw numbers.
Also, keep in mind your number one thread is end users themselves and social engineering both of which bypass encryption automatically.
-
@BRRABill said:
@scottalanmiller said:
HIPAA is about "reasonable efforts at security." And much of that will come down to expert witnesses and a judge making a determination. If I had a laptop stolen and it was encrypted and someone broke that encryption I'd hate to face an expert witness and a judge who ask me "so why did you have data on a laptop in the first place?"
But again, what are the odds of this?
As has been discussed in other threads, there is a still a lot of data on endpoints, right or wrong. Or at least, that is my feeling. Would love to hear other thoughts of people in the wild or this.
Sure, there is. But why does that matter? If we are discussing how to improve things and what we as IT do, what other people are doing is only useful for seeing if "everyone does it" then we know that that is probably wrong. But that's only so useful, sometimes the crowd does something useful or things are useful because of the network effect so the guide of "the crowd does things poorly" doesn't always mean that we should rule that thing out (TCP/IP might not be the best, but using something else is too impractical due to the needs of interoperability.)
Yes, lots of places have data on end points. But if we are the IT for those places, we can point out that that is a risk and that if we feel the need to protect those endpoints we need to rethink how they are being used and evaluate if data on end points makes sense.
-
@scottalanmiller said:
Also, keep in mind your number one thread is end users themselves and social engineering both of which bypass encryption automatically.
Agreed.
But it also nice to know if the device gets lost/stolen, the data is probably safe.
We had an employee who lost their iPad. But we set them to erase after 10 tries. So while there is some chance that another person who found the iPad could have guessed their passcode (hoping it wasn't 1234), but the odds are the iPad got erased. The chance drops even more if they use a real password. Which of course they will hate, so there's that tradeoff.
-
@BRRABill said:
Let's say a covered entity transfers a file of mailing addresses (PHI, obviously) to me. It stored on a HIPAA-compliant cloud service, so no issues there. I want to bring down the file to locally make labels and print on my machine.
Issue here.... you are mixing "how" with your "goals."
Your goal, I assume, is to print labels NOT to store the file locally, right? So don't mention downloading the file because that's the problem. You've decided on the solution already and made it part of the goal and introduced the problem. Think at the goal, rather than the proximate level, and the problem presents a solution.
Goal: Print Labels
Solution: Pull data from the service to print labels. Why do you need all data pulled down locally to do that? If I am using an application like Spiceworks I don't need to do that. If I am using excel I don't need to do that. Sure, some apps don't work well for this, but that is what we are potentially looking to address, right?
-
@BRRABill said:
@scottalanmiller said:
Why would you by syncing? Again, the point is not to do these things.
Usage on a laptop when there is not WiFi?
Or if they are very large files, so as to not have to wait to work with them?
There are viable cases, but these should be generally the exception, not the rule. How often is this actually happening to people that they are needing to work offline in the modern world? I don't go completely offline and I work in the third world regularly. How would working Americans run into this with any regularity?
-
@scottalanmiller said:
Goal: Print Labels
Solution: Pull data from the service to print labels. Why do you need all data pulled down locally to do that? If I am using an application like Spiceworks I don't need to do that. If I am using excel I don't need to do that. Sure, some apps don't work well for this, but that is what we are potentially looking to address, right?
We happen to use Sharefile for Healthcare for our PHI transfer.
I'd have to get the file from there to Excel somehow.
-
@Dashrender said:
Well, if you are working with something like O365 and ODfB and SharePoint, you don't download it in the traditional sense. it's downloaded to your application where you do what you need.. when you close it.. the temp files are deleted by default and the file is saved back to the cloud where you go it, all automagically.
Are we sure about that?
And if we were ever brought before a judge, are we sure "O365 said it deleted my files when i was done" is a better response than "My entire drive is encrypted"?
