Comments on: Security perimeter? What security perimeter?

In the fight against security breaches, PGP Chief Executive Phil Dunkelberger cautions that encryption by itself is not the answer.

[skswave]

Phil you forget to mention TPMs

Phil,

Nice article but you neglect to discuss the industry standards authentication technology for deperimeterization. Trusted platform Modules are now in all corp computers. This is a hardware security chip that will create and hold the keys that are used for VPN access, WIFI access and windows logon. The reason that IT should be turning on the TPMs is that they will provide hardware protection of the access keys so that they can never be stolen by a virus or maleware. Almost all of the existing VPN and WIFI solutions support TPMs. You referanced TJX they actually had a WIFI connection security problem That would have been solved by using Their TPMs and WPA2 encryption. It is time to provide all of the IT shop practical advice on how to address securing their mobile users. Encrypt the data on your hard disk use software for the installed base and buy hardware encryption for new machines as part of the harddrive. Turn on the TPM and use it to store the keys for your VPN and WIFI connection (ask your network equipment supplier for supplemental instructions for the TPM or your PC manufacturer)

Steven Sprague
CEO
Wave Systems Corp.

[joncallas]

We definitely believe in TPMs!

Stephen,

Thanks for the comment. We're firm believers in TPMs we have
even done the extra work to support many of the older TPMs
that are present in previous-generation corporate computers.

You're absolutely right that a TPM-based authentication system
could have helped TJX. But also remember that at the time that
they were hacked, this wouldn't have been possible for them.
Also, they would have had to implement it correctly, and the
hack occurred because of incorrect implementation.

The TJX story is a lesson to us all because it was a targeted,
criminal attack on the financial system using the weaknesses in
a retailer's network. It shows that we all have to be vigilant as a
community and police ourselves better because a flaw in one
place can cause problems for many, many people.

That means security everywhere. TPMs are an important part of
security everywhere, but like any single subsystem, they are only
part of the total solution.

Regards,
Jon Callas
CTO/CSO PGP Corporation

[wbenton]

ISMS Standards

The purpose of ISMS in IT is to ensure the protection of data. Within those ISMS guidelines, they cover data encryption amongst other things.

One of them being data encryption for USB memory sticks as well.

These and many other policies are covered within the ISM standards.

All one has to do is to read, survey and implement them as they're written!

Sure it may take time, but hey... as the article says... Rome wasn't built in a day. And as such, security must start somewhere.

Thus even though the final process may take a little while, it won't start until one decides to follow proven procedures.

And ISMS standards are such procedures!

Walt