7 essential elements to effective key-management policy

The hardest part of implementing strong encryption is securely and effectively managing keys and policies. Without strong and flexible systems in place to do that, the best encryption standards are useless.

Whether agencies are trying to keep national secrets safe from external threats or simply satisfying regulatory requirements, managing cryptographic keys and the policies that govern them is a continual challenge -- and gets even more complex when the cloud is added to the equation.

However, there are seven essential elements of an effective agency key-management policy that will alleviate many of the problems, both now and in the future:

1. Awareness of current standards. Effective key management must be built on a solid foundation, which means leveraging the best practices the community has codified into standards. Knowing and following the National Institute of Standards and Technology's Recommendation for Key Management (SP 800-57 Part 1) standards is not just a guideline. It’s a requirement.

It is important to look beyond NIST standards, though, to ensure future compliance and compatibility. Agencies should be familiar with the standards that apply to Department of Defense/National Security Agency-approved cryptography, DOD public key infrastructure, the U.S. Federal PKI Common Policy Framework and the general compliance issues that affect choice of hardware, including FIPS 140-2 Level 3, true random numbers, generating adequate pure entropy to maintain reservoir and so on.

2. Prevent individual total access. Strong governance policies are critical to successful encryption strategies. For example, duties, control and knowledge should never rest in a single place -- they must be separated, doubled-up and split. Implementing separation of duties ensures that different people control different procedures so that no one person has full control over the platform. Dual control requires that at least two people control a single process, such as enabling access to master encryption keys. Finally, split knowledge provides only partial knowledge of an encryption key or passcode to any one person, requiring action from multiple parties to access critical data.

3. Plan for the future. Agencies must build in the flexibility to change or augment their encryption standards to meet new regulatory requirements or organizational changes. Having an initial capability that not only supports multiple encryption standards, but that also provides flexible templates and object policies, will enable and simplify organizationwide management of algorithm migration when needed.

4. Centralize control. A key and policy manager should define user profiles, detailing appropriate access to encryption resources and managing them centrally through an administrator. Many agencies have guidelines in place to centralize authentication/access already. However, DOD and NSA requirements are evolving, particularly for classified information, as technology is updated to more modern/dynamic environments. This process is further complicated by changes to military and homeland security organizations, both domestic and foreign, as parties assigned access may change over time.

And for transitions to the cloud environment, consider keeping control of encryption keys by implementing on-premise key-management capabilities, rather than giving them away to third parties.

5. Comprehensive logging. Keeping comprehensive event logs and audit trails is another core component of any key-management program, but it is even more critical in the government environment. PCs, tablets, smartphones and drones create unique challenges as data is accessed in unsecure environments and potentially on unsecured devices. Advanced logging and security information and event management tools can record all activity -- date, processes, user, activity, file accessed, device accessed, IP address and more.

6. Integrate and unify. Security software doesn’t know or care about what data it’s encrypting. Whenever possible, use one centralized solution to support fields, files and databases. A centralized solution will implement consistent policies across all encrypting end points in an organization, while assigning and managing attributes on keys that are specific to the end-user device or application.

7. Consolidate systems. Lastly, keep third-party integration in mind. Encryption solutions are often separate from the applications with which they will be used, but it can be beneficial to use one solution with multiple types of applications. Look for a solution that facilitates the integration, that meets standards for Key Management Interoperability Protocol and that undergoes regular interoperability testing.

By consolidating such systems via hardware and software solutions, agencies can address all attack avenues and secure the totality of threat surfaces. Strong encryption standards can be implemented in any environment and can be added or removed from disparate systems as needed with minimal or no interference to operations, implementation delays or insecure access points.

Roadmap to the future

Key management doesn’t have to be complex or complicated  even within unique government environments when strong policies are  matched to strong access control and centralized management of hardware and software security tools and assets. As technology evolves -- along with the threats that go with it – agencies must always keep an eye on the road ahead. Having a smart-policy roadmap in place will make that a smoother journey.