Is Your Data Encryption Really Secure
There are various types and methods of data encryption. Some of the most popular forms of data encryption include single file encryption, folder encryption, volume encryption, whole disk encryption, and of course email encryption. The Windows XP operating system has the ability to perform file and folder encryption. There are 3rd party tools, like PGP Desktop, which can perform whole disk, logical disk, file, and e-mail encryption. If you routinely deal with confidential or sensitive information, or if you are concerned about private information falling into someone else's hands, encryption may be the way you want to go. However, there are a few things you should be aware of so you don't have a false sense of security. First, What Is Data Encryption
--------------------------------------------------
Throughout ancient and modern history people have come up with ways to mask, hide, and verify that information is secure or valid. For instance; the ancient Babylonians in 4000 B.C. used something call intaglio, a process in which images and writing were carved or etched into stone that identified certain Babylonian merchants when they were trading. Each trader, or merchant, had a specific intaglio to make his mark, this way his customers would know that what they were purchasing belonged to, or was produced by, a specific merchant. This is a bit different then encryption, more like today's digital signature, another process typically part of data encryption. Encryption today is much more advanced and complex. It is used for everything from securing military secrets to keeping intellectual property confidential. There are various forms of encryption techniques, some stronger or more secure than others. In it's basic form, encryption can be thought of as the masking, or the scrambling of original human readable information. The person who is masking the information must provide the person he is sending the information to with some sort of key that allows them to unscramble the information so they can make sense of it. For instance; I use encrypted e-mail messages so I can correspond with my customers on a regular basis. I do this because during certain types of projects my customers and I discuss private information such as security holes discovered during security assessments. This type of information is obviously not something we would want to fall into someone else's hands. Most Data Does Not Start Out Encrypted So Be Careful
----------------------------
The primary reason I am writing this article is to point out a couple specific issues with data encryption. During a recent discussion with a friend of mine he told me that he was using Windows XP folder encryption to secure some of his confidential information. He asked me if I thought this was a secure method of storing important documents. My response was yes and no. The data encryption used by Windows XP is relatively secure, but the issue is that the majority of the data that is now encrypted in the folder did not start out that way. Let's take for example, a word document that contains your personal financial information. You may have written this document so you have a central location where account numbers, social security numbers, and other private and individual identification information is easily retrievable. After you are finished writing the document, you then transferred it to your secure encrypted folder. Since it is now in a secure folder, only you are able to access it because only you know the pass-phrase that was used to generate the encryption key. For the most part, this assumption is correct. While you were writing that document, you probably hit the save button several times. Or if you are like me, many times. I've lost lengthy documents several times in the past and have trained myself to hit the save button pretty frequently. Every time you hit the save button, a new temporary version of the file is created. This is typically saved in the c:documents and settings"profile name"local settingstemp directory. This is done for recovery and undue purposes. For instance, if you make a mistake while writing the document and need to undue your actions, one of these temp files may be used to undue the action. Also, if your system or application crashed while writing the document, you can recover it from the temp files stored in this directory. You may have had to go through this before and it works very well. Now that you have finished your document and copied or moved it to the secure folder, your document is secure, right? Wrong. Chances are the temporary files in your temp directory are still there. Even if you were to delete them, there is a significant chance they can be recovered using open source or very inexpensive undelete or data recovery software. If someone where to get hold of your computer, hard drive, or gain remote access to your system somehow, there is a significant chance the unencrypted original version of your document can be located. So what can you do to make sure that your encrypted version of your file and data is the only version. There is not a clear or 100% secure answer to this question but I will share with you how I deal with the issue. Changing The Location Of Unencrypted Temp Files
----------------------------------------------------------
The primary way applications like Microsoft Word determine where to store temporary versions of your files is by looking at two user environment variables. One called "tmp" and one called "temp". They can be accessed by right clicking on "my computer", choose properties, then choose the "advanced" tab and click "environment variables". Here you can edit or change the default location for temporary files. One thing I have to point out is even though a large number of software packages use these locations for temporary storage, it will be hard to determine if they all do or if they save temp files in other locations. You will have to do a little investigating to determine where various applications store their temp files. On my system, I have changed these variables to point to an encrypted disk where I store my encrypted data and files. This way, I can be reasonably sure that temporary or working versions of the files are also encrypted. Encrypted Files May Not Stay Encrypted When Copied or Moved
-----------------------------------------------
Another thing you should be aware of is what happens to encrypted files or folders when they are copied or moved to another location. If a file or folder that has previously been encrypted is copied or moved to another Windows NTFS partition or volume, the encryption is preserved (under most circumstances). However, if you move or copy the encrypted data to volume or partition that is not NTFS, the file is automatically decrypted. Also, just because a file is encrypted on your hard disk it does not mean that this file will be encrypted when you e-mail it to someone. E-mail encryption is a totally different procedure. Also, keep in mind that encrypted files are decrypted when they are transmitted over a network connection. Make Sure Deleted Unencrypted Files Are Really Gone
---------------------------------------------------
Because data that is deleted from disk may be recoverable for quite some time, I use another procedure to limit or reduce the risk of this possibility. As I mentioned earlier, data that has been deleted can in many cases be easily recovered using off the shelf software. In order to be reasonably sure deleted data is not easily recoverable, you need to write over that portion of the disk where the file and it's fragments were located. Actually, you most likely need to do this multiple times just to be sure the data is unrecoverable. The PGP Desktop software I use to create encrypted file systems, send encrypted e-mail, and create encrypted zip files also has a tool called "Wipe Free Space". This tool will write random patterns of data to all space on a drive that is flagged as free. You can tell the software how many times to perform this procedure but the default it usually three passes. My primary system performs this task every night. This way I can be reasonably sure the unencrypted versions of my encrypted files are not just sitting around waiting to be recovered. Conclusion
----------
If you are concerned about keeping important data confidential, file, folder, or disk encryption is a good solution. If configured properly you can be reasonably sure that your private information will remain private. Just remember that most data does not start out encrypted and that remnants of the original information may still exist in an unencrypted state. There are many options with regard to data encryption; Windows XP native file and folder encryption, open source encryption solutions, or commercial encryption solutions such as PGP (Pretty Good Privacy). Do some research up front to determine which may be the best method for you. You may reprint or publish this article free of charge as long as the bylines are included. Original URL (The Web version of the article) ------------ http://www.defendingthenet.com/NewsLetters/IsDataEncryptionReallySecure.htm About The Author
----------------
Darren Miller is an Information Security Consultant with over seventeen years experience. He has written many technology & security articles, some of which have been published in nationally circulated magazines & periodicals. If you would like to contact Darren you can e-mail him at Darren.Miller@defendingthenet.com. If you would like to know more about computer security please visit us at http://www.defendingthenet.com. |
Other Trading System Articles
Eternal Sunshine There is a current movie entitled “Eternal Sunshine of the Spotless Mind”. It is about a man who has had a painful love affair and will do anything to rid his mind of those pain thoughts of a former love. He sees an advertisement that offers just such a service. It seems his former lover has the exact thoughts and she goes through the same treat ...Daddy, Why Aren't We Rich? A Stock Trader's Story One Saturday morning, while he was sitting at his computer studying the market, David's 7 year old daughter came up, tugged at his shirt sleeve, and said, "Daddy, why aren't we rich?"He looked his child in the eye, and thought to himself, what a great question - why aren't we rich?As she stood there expectantly waiting for an answe ...Straight Talk -- Braces and Adults You're over 30, over 40, or over 50 even and have always wanted to have what you thought was a "pretty" smile. You've seen Pretty Woman several times and just can't get the image of Julia Roberts out of your mind when her Prince Charming climbs the fire escape to claim his Princess. Hollywood has a way with drama but Julia Roberts' smil ...The Stock Trading Plan 1. That discipline contributed more to their success than their trading philosophy itself. Remember that the key to any plan is how well it holds over time.2. There is no "sure thing", and there is no trading system that is 100% accurate. Your goal, as a trader, is to usethe tools available and try to develop an edge. Base your trades on ...Day Trading Forex Currency, Hype, Lies and TANSTAAFL Day trading Forex currency is all about making big money. Some investors have found it quite easy to make a large amount of money by day trading the Forex currency markets as they change hour by hour. But, you see that "some" in the previous sentence? What that means is that a lot of people don't make a dime and even lose a lot of money.U ...Stock Market for Dummy It is not easy to start trading on the stock market when you have no financial background at all. It shouldn’t be difficult to prosper, though, if you follow certain guidelines. Being organized and disciplined are two very important factors in this business. Don’t let all the information you gather confuse you. Make sure important decisions are ...Card Trading: Risks and Precautions You can trade your cards in two different ways: face to face, or by postal mail. The first type of trading is performed at tournaments, at schools, or at the local comic shop, and you arrange the trades by checking the other person's cards directly, holding them in your hands. Otherwise, cards are traded by mail when the parties can not meet bec ...Forex Trading: Calculating Profit and Loss in Foreign Currency Trading The foreign exchange market, or Forex market, is an around-the-clock cash market where the currencies of nations are bought and sold. Forex trading is always done in currency pairs. For example, you buy Euros, paying with U.S. Dollars, or you sell Canadian Dollars for Japanese Yen. The value of your Forex investment increases or decreases becaus ...Finding Hidden Profits In Your Business - 7 Strategies To Use Today If I walked into your business and spent an afternoon, I'm fairly confident I could find several little hidden profit centers, just waiting to be used. Let's talk about 7 strategies for finding hidden gold in your business.Strategy #1 Let someone else do the mopping and filingWhen you "save money" by doing $8/hour work ...Avoid The Paypal e-Cheque Scam - It Could Cost You! As the internet grows and more people begin to buy and sell, online payment facilties will accrue more members daily. The largest and currently one of the most popular is Paypal.Whilst Paypal make every effort to ensure its members safety, an entire fireproof system, can prove to be very difficult to produce. Everyday, there are members w ...What Is ISL Uranium Mining? In situ leach mining (ISL), also known as in-situ mining or solution mining, was first used as a means to extract low grades of uranium from ore in underground mines. First used in Wyoming in the 1950s, originally as a low production experiment at the Lucky June mine, it became a high-production, low cost method of fulfilling Atomic Energy Commi ...Simple, Effective Web Site Traffic Promotion Web site traffic promotion is central to the success of any online business. Without effective web site traffic promotion, an internet business will literally perish in a matter of no time just as a retail storefront would go out of business without customers walking through their doors. An internet business is as dependent on web ...Should You Use a Pareto Chart Unless you are familiar with manufacturing management principles, you probably have not heard of a pareto chart. It is a very effective tool managers use, to manage and effect outcomes in manufacturing environments. You're saying, How in the heck will this help my trading? Well it can, if you use it right.Another name for using pareto cha ...Futures Trading Software - Choosing a Package For Big Profit Potential! The growth of the Internet has seen traders look more at the use of futures trading software as a way to increase their profit potential.Today, many vendors are selling futures trading software packages that make 50% annualised gains a reality.While there are many good systems, there are also many that don’t perform. This article i ...A Quick Look at Currency Exchange Basics “The blunt truth about the politics of climate change is that no country will want to sacrifice its economy in order to meet this challenge, but all economies know that the only sensible long term way of developing is to do it on a sustainable basis.” -Tony BlairInvesting in an exchange currency market is a hot new trend that has become ...Hitler - Bush Hitler received a legacy from his Rothschild relations in Vienna where he and his father before him had studied. The De Medicis agent named St. Germain had established a solid schooling system for the occult in Vienna. You hear a great deal about Hitler and his weird sexual relations.There is so much about Hitler and his occult handlers w ...Your Guide to Learning a Forex Trading System There are a great number of people in America that are interested in investing in order to make a tidy profit. There are many ways to invest and many ways to make profits by investing. One method that has been gaining in popularity is that of the Forex trading system. If you are unsure of what this is, let me explain. Forex stands for foreig ...Good to Know Stock Trading Information Stock trading is a complex process that may be quite confusing and deceitful to a new trader. Therefore, if you plan to start investing your money in shares, you should first choose a stock trading strategy that is most suitable for yourself.The major difference between stock trading strategies is based on timeframe. It means that an acti ...12 Smart Trading Runescape Tip When you play RuneScape trading is everything! Here are twelve smart RuneScape tips to give you a significant edge over other RuneScape players.1.Never buy anything from a RuneScape shop (unless it’s stackable) because it will be more expensive than trading with a RuneScape friend.2.Don’t get scammed! There’s no worse feeling in th ...
|
