#21st century encrypto how to

Misplace a digital key and the encrypted data to which that particular key is associated would be as good as lost unless a duplicate copy of the key exists and its whereabouts are known. In other words, they lock or unlock data written to media (tape, optical or disk, for instance). Keeping Trackĭigital keys, consisting of long strings of numbers and characters, enable or deny access to encrypted data. The use of hardware-based key appliances can minimize security risks when tapes or other encrypted media become lost or stolen, points out Jon Oltsik, a senior analyst with Enterprise Strategy Group of Milford, Mass.Īs encrypted data volumes grow and digital keys become more ubiquitous - spanning multiple sites, applications and technologies - the ability to effectively manage these environments will become paramount, Burr acknowledges. Burr’s group crafts Federal Information Processing Standards guidelines and policies to help agencies with encryption practices. Key management isn’t “going to go away, and it is something that we will need to pay more attention to,” says William Burr, manager of the Security Technology Group at the National Institute of Standards and Technology’s IT Lab.

#21st century encrypto how to

With agencies adding a protective wrapper of encryption to the data they create - specifically, sensitive and personally identifiable information - the technology dilemma looming on the horizon is how to handle the thousands (in some agencies, millions) of digital keys created in the process.Īlthough key management isn’t a mandate, it can make day-to-day life a lot easier for an agency’s IT managers.

The deadline is Friday, at 11:59 PM Eastern.KEY LINGO: When dealing with storage of encrypted data, there's more than one kind of key. While I'm focused on the contradictory stance they have proposed, to reference but not actually follow FIPS 140-2, it's critically important for all points of view to be represented. Self-attestation would fall squarely into that bucket.Īgain, please weigh in on the '21st Century Cures Act', whether specific to encryption or otherwise. The FIPS 140-2 standard says that any encryption not tested and validated to meet the standard is considered to be no better than plaintext. Self-attestation of 'capability' means nothing. Even in this very proposed rule, it states that 'We posit that FIPS Publication 140-2 is the seminal, comprehensive, and most appropriate standard.' And yet, the rule pivots to 'self-attestation' instead of enforcing the very benchmarking test that FIPS 140-2 itself was written to make explicit.

The HITECH Act and other healthcare legislation has consistently referred all cryptographic requirements to NIST, referencing FIPS 140-2 validation. There is no reason that it should not be an explicit requirement, just as it is for every other federal agency. Validation of FIPS 140-2 encryption standards via NIST has evolved and is no longer a prohibitive process. Self-attestation to be 'capable' of encrypting to FIPS 140-2 cryptographic standards is not enough and not aligned with the intention of NIST's cryptographic benchmarking program. Privacy and Security Transparency Attestations Criteria Updates to the 2015 Edition Certification CriteriaĦ. Now the public comment portal is open, and I encourage you to add your voice to the conversation!

I responded on Twitter with concerns about their peculiar stance on encryption. A month ago, ONC shared a draft of the '21st Century Cures Act' in advance of the public comment period.