11436 SSO

Industrial-Grade Data Security for Agile Development

Aug 28, 2015

Data breaches are making headlines on a seemingly weekly basis. With hackers exposing and exploiting millions of consumer records, data security has taken center stage among security leaders and enterprise architects. It’s a crucial time for organizations to reassess their data security architectures and risk profiles.  

The goal of every security and compliance manager should be to implement a secure-by-design pattern where all sensitive data—both in transit and at rest—are secured.

A primary reason data breaches occur: organizations lack strong data protection measures such as encryption, hashing, and tokenization, and they lack strong access control models that limit sensitive data access to authorized users. Often, they also don’t secure the cryptographic keys that are employed for data protection.

It happens over and over again: hackers get their hands on sensitive data by accessing cryptographic keys that aren't safeguarded with hardware-based encryption systems such as hardware security modules, or HSMs.

HSMs: more secure than software encryption

HSMs are physical network devices, sometimes in the form of a plug-in card that attaches directly to a server. They’re a cornerstone of digital security roots of trust, and ensure that keys are protected inside a hardened, tamper-resistant device. HSMs are considered more secure than software-based encryption systems, where keys are stored in the software.

Unlike software-based cryptographic systems, an HSM-based system is not vulnerable to attacks that target operating systems and applications that store and manage cryptographic keys within the software elements.

Balancing security with self-service

Organizations handling data security often grapple with trying to implement strong security control without creating too much complexity.

So how can developers continue to be agile and innovate their next mobile or IoT app while protecting sensitive data? Developers prefer self-service and easy-to-use APIs to help build engaging apps and experiences. But the majority of the developers aren’t trained in secure design and coding practices and don't possess the skills to develop the industrial-grade cryptographic systems required to support an organization’s data protection needs.

Successful IT organizations understand that good security can be achieved when developers consume security-as-a-service in the form of APIs. This makes it essential for organizations to choose an API management platform that is not only capable of supporting strong security controls such as HSM, but also can abstract and hide complexity from the developers who consume APIs that handle sensitive data.

Where are your keys?

Developers interacting with Apigee Edge, for example, can store and manage the cryptographic keys in a secure way using a commercial HSM module. What are the typical keys used by the platform when protecting sensitive data that crosses the trust boundary?

  • Keys that authenticate and encrypt two-way SSL/TLS sessions
  • Keys that encrypt XML/JSON payloads when dispatched to a destination service
  • Keys used for signing REST payloads

In all the these cases, cryptographic keys should be stored in HSMs offered by the likes of Safenet, Thales, or Amazon’s AWS CloudHSM, and should be governed by strong access control.  

Improve adoption, embed security, quell breaches

Any enterprise data protection strategy and architecture must consider strong cryptographic systems to help protect sensitive data. Data protection using HSM is a recommended approach for organizations dealing with customers' personally identifiable information (PII) or sensitive or regulatory data—such as financial institutions, healthcare organizations, and government agencies.

And when the protection mechanisms and configuration are made available to developers via APIs, it improves developer adoption of security and automatically embeds security into applications. While these measures alone don’t guarantee absolute data security, they can make security breaches far less likely.

For more on API security, check out the webcast replay, "How to Achieve Agile API Security."

Photo: "T"eresa/Flickr

Scaling Microservices