Thank Goodness for the NSA! — a Fable
If it weren’t for the U.S. National Security Agency’s trying to spy on everyone in the world, Bleeker Street Law would have been a cooked goose.
Back in 2013, we had a group of clients from a particular country applying for refugee status here in Canada. Because the NSA spying was in the news, we did a forensic audit of our computers, just to be safe. We promptly discovered that we had been hacked. Not by our clients’ former national security service, or by the NSA, but by a for-profit organization. A set of aspiring criminals had broken our security and were making everything they stole available by subscription on Silk Road. Several foreign firms and at least one government had subscribed to us. . . .
The country in question had a revolution, Silk Road doesn’t exist any more, and we now have a much simpler but more secure computer system, mostly on tablets and phones.
What we do differently
We used to worry about privileged communications with our clients, because we did all too much communicating with ordinary unencrypted email. Now we have encryption programs for our pads and phones, and encrypted email to boot. Older machines storing files get them already encrypted, so crooks can’t just subscribe to “every updated file”.
One new machine keeps the keys. We guard it like the cabinet of office keys, and it in turn is locked in the law librarian’s office and not connected to networks.
What’s on the pads?
Pads are very popular, and both Apple and Android have “end to end” encryption programs on them. This allows us to “label” files with encryption keys, so only the right people can decrypt them.
Personal information is labeled with the person’s name, which in effect means it is encrypted with the person’s personal key. Business information is labeled with both Bleeker Street’s name and the name of the person whose pad or phone it is on. It is therefore encrypted with a per-person business key.
Only little bits of data are in memory and unencrypted at any time, and because it’s labeled, it’s re-encrypted when it’s written back to disk..
Clients can download a free app and have secure email labeled “From client, for Bleeker Street”. We have the for-pay version and can talk to them and to each other, using keys that live in the locked machine.
What’s in the keystore?
Our keys, starting with a private key for each of us, then a collection of public keys from our staff and clients, and finally a collection of keys, each of which is for the combination of Bleeker Street and an individual staff member or client. We also have some signatures for software we use (we have a secure subscription), certificates for web pages and the like.
A legitimate investigator can get a court order to get individual keys, but they won’t get all the keys and therefore individual lawyers and clients aren’t at risk from them.
Where’s the risk now?
Stealing data while it’s in use is the big risk, followed by people shoulder-surfing for passwords when they’re typed. The labeling of accounts keeps most data safe from anyone other than its owner, but if someone subverts the machine itself, they can get data from memory and tiptoe away with it.
It’s not perfect security, but we’re not an attractive nuisance any more. Criminals used to target us because we had lots of valuable information in one place. No longer: now they have to attack individuals.
They still do, mind you: someone tried to claim they were a partner’s daughter in a foreign jail last week; but they can’t just break into a file server and take the company’s crown jewels. If they do that now, all they’ll get is encrypted files, which are about as valuable as zircons.
______________________________
All of the capabilities mentioned are real as of 2013, and have some degree of availability. No-one has a product that provides them all as yet. Full disclosure: I once proposed this to a device manufacturer, who thought no-one would ever need it.
Ensuring integrity of embedded devices like phones, to reject bad programs – https://lwn.net/Articles/568943/
Controlling access to one’s data (a key store for individuals) – http://www.newscientist.com/article/mg22029374.600-private-data-gatekeeper-stands-between-you-and-the-nsa.html
End to end encryption – silent circle: https://silentcircle.com/
Labels – orange book, circa 1985, see http://broadcast.oreilly.com/2013/12/where-were-ye-orange-book-in-w.html
Just remember a tip of the hat to Edward Snowden, hero. Otherwise you wouldn’t have had any idea you needed to do that security check.
so who hacked you ?
Keep in mind your single point of failure is where your keys are stored, they could get the files, break into your office and copy the machine withe the keys, or just steal it.
To anon: like the British in the 2nd World War, they need to steal the machine without our noticing it, so we don’t change the keys (and recode everything, worry about known-text attacks, re-re-code, etc).
They’d also want to have collected all the files in the place, too, so they’d have something to decrypt.
It’s predominantly a defence in depth, rather than a citadel: lots of stuff requires both our and a customer’s or employee’s keys. And in principle we should have multi-part keys with parts in escrow. A real crypto guy would be able to say more.
–dave
In a related discussion at slashdot, Em Adespoton noticed that “the other item that he missed was DLP — software is smart enough now to automatically encrypt data with the correct key based on content and metadata. THIS should be the default.”
That’s cool: it would make it easy to convert all one’s unencrypted files to encrypted with the right keys.
To Chris: this was based on two different incidents. Neither involved law firms, but one was near Bleeker Street in NYC.
The only addition to your methods that I use here is to have my certificate (PKI) authority in a standalone virtual machine, only brought up in a stand-alone manner. I’ve been doing this for the last decade and it makes it fairly easy to keep encrypted backups in a distributed manner. Stealing the host or VM backup isn’t sufficient to gain access. If for some reason you should suspect the host hardware, it isn’t that difficult to obtain a “good-enough” machine from any big-box store or other supplier.