HARDWARE IS THE KEY TO INFORMATION SECURITY

by Andreas Curiger

Many of today’s business processes are digital and run over the Internet. Networks have become repositories of digital information, making them attractive targets for hackers. They must therefore be constantly monitored to prevent unauthorized access to this information. Information security concepts comprise protective measures on four different levels:

• Organizational: classifying information
• Human resources: raising awareness among staff
• Legal: regulating processes
• Technical: infrastructure

Only technical measures are addressed here.

THE CORE COMPONENT: CRYPTOGRAPHIC KEYS

Cryptographic keys are a core component of efficient information security. Identification and authentication keys are typically based on public key cryptography, a system in which the initiator holds a private key, while the responder holds a corresponding public key. These keys are created and managed using a software service called public key infrastructure (PKI).

SOFTWARE: INSUFFICIENT RANDOMNESS MEANS INADEQUATE PROTECTION

Software alone cannot generate genuinely random keys because it works according to deterministic principles. In addition, it cannot shield against physical attacks, and its complexity means that it always contains errors that hackers can exploit. For example, the software can be infiltrated with malicious code that reads the keys stored in it and sends them to the hackers.
Three measures are required to significantly enhance information security:

• Authentication
• Integrity verification: Network appliances verify that only trusted code is executed and only trusted data is processed.
• Secure hardware: Confidential keys should only be created and used on devices that have passed a security check. These should be equipped with a secure bootstrap mechanism for their internal code. The hardware architecture must ensure that known bugs or unwanted features cannot be exploited to extract keys.

KEY MANAGEMENT DEVICES

Various types of hardware may be suitable for securing data, depending on requirements:

• Low end: smartcard chip in card or USB stick form. The quality of the keys and the degree of physical protection may be sufficient, but the performance of the authentication and encryption mechanisms is usually poor. On top of this, you are entrusting vital security elements to an item that is made of breakable material and can easily be lost or stolen.
• High end: hardware security module. This offers outstanding physical protection and a range of service levels.
• Scalable performance and user numbers: HSM as a service. In this instance, you have to be able to trust the service provider or make sure that the service is truly based on actual HSMs.

To sum up, hardware is the key to reliable network security, and a secure, tested hardware security module is indispensable for high-end protection.

This article was published on August 25 in the edition 4/2017 of the german journal gi - Geldinstitute - Fachzeitschrift für IT-Entscheider und Manager, page 44. it is based on a keynote of Andreas Curiger on the SIGS-Technologyconference 2017 from May 16 to 18, 2017.