Intellectual Property Law

Memory trick shows that encryption isn't the answer to data security

The question of how to put personal data and other sensitive (in the plain English sense) information on portable devices and storage mediums such as laptops, CDs and memory sticks whilst keeping that data secure and achieving compliance with data protection laws is one that organisations have to tackle. Encryption technology is increasingly being deployed by organisations for their laptops and portable storage, and appears to be regarded by many as the total solution to these issues.

To quote Wikipedia:

• Encryption is "the process of converting ordinary information (plaintext) into unintelligible gibberish (ie, ciphertext).
• Decryption is the reverse, moving from unintelligible ciphertext to plaintext.
• A cipher (or cypher) is a pair of algorithms which creates the encryption and the reversing decryption.
• The detailed operation of a cipher is controlled both by the algorithm and, in each instance, by a key

The BBC News website yesterday reported on a US survey that demonstrates how hackers can gain access to encrypted data on computers by switching off a computer, immediately switching on, and then doing some clever geeky stuff to gain access to the computer's memory, the RAM. Within the RAM, the encryption key can be found, allowing the stored data to be decrypted.

This hacking technique raises important questions for organisations that place personal/sensitive data on portable computers (e.g. laptops).

IMPACT® opinion

More and more people within organisations are using laptops - just look at how many have gone missing in the public sector that we know about. Then give thought to how many more in the private sector have gone missing that we will never hear about - there must be so much lost or stolen personal / sensitive data floating around out there.

The above news takes away the comfort blanket offered by encryption technology and forces organisations to focus on:

• who they allow to process data
• how that data is processed
• how it is protected

Finally, organisations must consider how much data is processed; remember the Data Protection Act principle that personal data must not be excessive in connection with the purposes for which it is processed. With technology not capable of offering total protection for stored data on portable devices, organisations must minimise the risks and damage associated with data loss/theft by minimising the amount of data out there.

Ann Critchell-Ward and Alex Newson

Full post as published by IMPACT on March 06, 2008 (boomark / email).