Reimagining enterprise cryptography: How to regain control in a fragmented environment

Cryptography has been on a significant journey over the past two decades. Its role in securing the digital world of 20 years ago was very different to its role in the modern enterprise. Today, it is understood that attackers are everywhere, and we cannot rely on a strong perimeter to keep them out. This requires organizations to deploy zero-trust solutions, where security is preserved even when attackers manage to get into the network.

The challenge is compounded by new ways of working such as BYOD, remote working, and the spreading of IT infrastructure across data centers and clouds, all of which now needs to be managed remotely. In this modern environment, cryptography is needed everywhere. Unfortunately, the need to deploy cryptographic solutions enterprise-wide, at the pace needed by business, comes with many challenges.

At the heart of the matter is the fact that the current cryptographic space is highly fragmented. There are multiple security solutions that utilize cryptography in an inherent way. There are many ways of authenticating people’s identity to provide or prevent them access to systems, including passwords, OTP, and smartcards. There are also many protocols to authenticate machines and protect communication between them.

In addition, encryption is needed for databases, VMs, storage, and more, across different clouds and data centers. Furthermore, cryptographic signatures are needed for documents, transactions and code. In many organizations, there are multiple point and siloed solutions that result in management pain, lack of visibility, agility, and flexibility, with high cost to deploy in the different environments that must be supported.

Scoping out a new approach

Today’s threat-filled digital landscape requires the enterprise to adopt a new approach to deploying and managing cryptography. It requires a transition on multiple levels:

• From hardware only to hybrid hardware and software: Legacy key protection relied solely on hardware solutions. In today’s environments where everything is virtualized and much is remote, and enterprises are moving to cloud deployments, pure hardware solutions constitute a significant obstacle. As a result, software solutions for key protection with strong guarantees are needed to replace and complement existing hardware.
• From siloed to unified key management: Legacy key protection and management was comprised of different solutions for different environments and business problems. A unified approach with one platform that can support all cryptographic solutions in any environment is needed today.
• From disparate to integrated key management and key protection: Legacy key protection provides only basic management and dedicated key management solutions are often not integrated with key protection. A unified platform providing integrated key protection and management is required.
• From key theft to key misuse prevention: Legacy key protection solutions address the problem of key theft only. Today, key misuse must be addressed as an integral part of key protection.
• From rigid to agile infrastructure: Legacy key protection and management solutions are rigid and slow moving. Cryptography standards are continually changing – updates must be rolled out quickly, new threats considered and resolved. Today’s cryptographic infrastructure needs to support agility.
• From slow to fast deployment: Legacy cryptographic solutions that relied on solely on hardware were slow to deploy. Today enterprise security teams must offer on-demand cryptographic services internally in order to quickly support business needs.

In modern environments, cryptography is needed everywhere. However, this cannot work if the cryptographic infrastructure in use is the same as in the 1990s. The fragmented legacy cryptographic infrastructure does not support modern business needs and is in desperate need of modernization.

Finding a way forward

The above challenges with legacy key protection and management solutions must be addressed. First, modern solutions are needed that are based on openness and transparency and support collaborative environments. Second, modern software that works in modern computing environments must be built. Third, a new technological approach is required to deliver a software key store with proven security guarantees to complement legacy hardware and support new security requirements.

How can this be achieved? The philosophy behind legacy solutions is to build a fortress around the device that holds key material and prevent any attacker from breaching that machine. In today’s zero-trust environments, this is problematic, especially when considering software-only solutions.

A completely different paradigm is to protect cryptographic keys and secrets by never having them reside in any single place at any single time, and to force an attacker to simultaneously breach multiple machines to learn anything. That way there would be no single point of security failure, and strong separations between the different machines would make it extremely hard to breach.

This goal may appear impossible – how can one carry out cryptographic operations such as decryption or signing, without holding the key? Fortunately, a methodology called Secure Multiparty Computation (MPC), also known as threshold cryptography, can do exactly this. Using MPC, the secret key is generated in two or more parts called shares, so that all shares are needed to get any information about the key. These different shares reside on different servers and devices, so that an attacker has to breach them all to steal the key.

MPC protocols enable the different machines holding key shares to interact, so they receive the result of the operation without revealing to each other anything about the key. This means the key remains fully protected, even while in use. MPC protocols have mathematical proofs of security, guaranteeing that an attacker who cannot breach all machines is unable to learn anything about the key, even if they know the protocols used. Although anti-intuitive, when using MPC, the key is never whole in any single place, not when being generated and not while being used.

Implementing a unified solution

What’s needed to address these areas is a new platform-based approach to securing enterprise cryptographic infrastructures, one that virtualizes cryptographic key stores and provides a layer of abstraction that delivers cryptographic services to applications, wherever they are: an engine that is a distributed environment that builds a mesh of cryptographic key stores of all types, delivering on-demand cryptographic services at the edge.

Critically too, any such solution must deliver a unified approach to key storage, enabling organizations to enjoy its own features and capabilities while being free to choose the key store best suited to their needs.

By transforming their existing fragmented infrastructure into a unified solution of this kind, organizations attain enhanced efficiency, better security, better user experience and at a lower cost. For any given specific cryptographic problem, it’s possible to add a point solution and increase the already fragmented space in the enterprise. Alternatively, a unified solution can be deployed, providing the necessary infrastructure for all cryptographic needs.

By virtualizing cryptography, businesses ensure that their cryptographic infrastructure works the way their other software works. When it is virtual, they can scale it, and they can work in the cloud or on-premises in exactly the same way. It has the benefits of cloud economy, and it’s agile. All those benefits can come immediately, automatically and at low cost. Finally, and critically, such solutions facilitate key orchestration across the enterprise and manage all cryptographic devices and solutions from one place. It’s a new paradigm, bringing cryptography to the next phase of technological advancement for the enterprise.