Privacy. Protecting Your Members. Monday, June 30, :00 p.m. - 4:15 p.m. Dena Bauckman, Director of Product Management Zix Corporation

Transcription

1 What We LEARN in Vegas... Comes Home from Vegas! Privacy Protecting Your Members Monday, June 30, :00 p.m. - 4:15 p.m. Dena Bauckman, Director of Product Management Zix Corporation Massachusetts Credit Union League, Inc Annual Meeting & Convention BELLAGIO, LAS VEGAS

2 Privacy: Protecting Your Members Dena T. Bauckman, CISSP Director Product Management ZixCorp Agenda Usage in Business Risks and Identity Theft Guidelines and Regulations Using encryption Cryptography Implementation Approaches Deployment Summary

3 in Business 130 million US workers send 2.8 million messages a day Depending on the user, the average number of s by user varies from 10 to 50 daily At least 30% of all corporate traffic will be sent to customers and outside partners is fast becoming the communication method of choice for US adults 60% of US Internet users prefer reading than reading ordinary post 34% prefer to send an than make a telephone call Risks is inherently insecure Like sending a postcard in pencil! Messages can be: Read by employers, coworkers, or family Intercepted by third parties Users treat as a form of casual conversation instead of a business document

4 Identity Theft In 2007, identity theft victims totaled 15 million One new victim every 2 seconds Identity theft is passing drug trafficking as the number one crime in the US US Dept of Justice Statistics Identity theft is the #1 concern among consumers contacting the FTC The No Send Policy Companies are challenged to enforce no send policy Continue to train employees on proper use of Various manual processes for delivery of sensitive documents: Fax, mail, copy to CD and ship Additional manual processes sent using Password protect documents (where possible) Password protect zip files All difficult because is the preferred method of communication

5 Regulations and Guidelines California Senate Bill 1386 (SB 1386) and other state privacy acts Gramm-Leach Bliley Act (GLBA) Federal Financial Examination Council (FFIEC) guidelines BITS Security Toolkit Justification for Encryption Reputational risk of the no send policy Cost of a data security breach Immediate delivery of confidential documents to partners/customers Eliminate costs related to manually sending confidential documents Protecting customers increases customer trust New regulatory compliance pressures

6 USING ENCRYPTION Cryptography Implementation Approaches Deployment Symmetric Key vs. Public Key Cryptography Symmetric Key Cryptography A single key is use to encrypt and decrypt The key represents a shared secret Provides high performance encryption/decryption Key distribution and management is a major issue Algorithms include: IDEA, DES, 3DES, AES Pubic Key Cryptography A key pair consisting of a public key and private key Encrypt using the public key, decrypt with the private key The private key can be used to create a digital signature Slower performance than symmetric cryptography Algorithms include: RSA, ECC, Elgamal

7 SSL and TLS TLS is the successor of SSL SSL developed by Netscape TLS Internet standard (RFC 2246) SMTP over TLS (RFC 3207) Uses both symmetric and public key cryptography Symmetric cryptography to encrypt the traffic Public key cryptography to exchange the symmetric keys and authentication Provides authentication and privacy over the Internet S/MIME Originally developed by RSA Data Security in 1995 S/MIME v 3.1 Message Specification (RFC 3851) Provides privacy and authentication S/MIME functionality is built into many major programs Requires key pair and certificate, plus access to the public key certificates

8 PGP Released in 1991 by Phil Zimmermann Provides privacy and authentication Similar, but incompatible, to S/MIME Adopted as an Internet standard OpenPGP (RFC 2440) Uses both symmetric key and public key cryptography Symmetric for data Public key for exchange of keys Binds public key to user identity Web of trust or Public Key infrastructure (PKI) type infrastructure Implementation Issues Of the companies that experienced loss, 54% subsequently implemented encryption Only 27% of the companies that had no breach had encryption 1. There is no interoperability between encryption standards 2. Consumers typically do not have encryption capabilities Adding to the difficultly of ensuring customer privacy 3. Key management is difficult and often costly

9 The Issue of Key Management Approaches to Encryption Gateway-to-Gateway Preferred for business-to-business Allows archiving Options: TLS, S/MIME, OpenPGP, ZixVPM Gateway-to-Desktop Preferred for business-to-consumer Options: S/MIME, OpenPGP, Pull, Push Desktop-to-Desktop Preferred for highly confidential and consumer-to-consumer Options: S/MIME, OpenPGP, ZixMail

10 Encryption: Gateway Solutions Encryption at edge of network Enforces security policies Transparent to sender Optional encryption by user-selection Deployment can be: Simple or difficult Costly or affordable Content filtering Separate system or built-in Accuracy is critical No impact on archiving or surveillance systems Encryption Desktop Solutions Mail client-level Encryption takes place at a user s machine Decisions made by sender Plug-ins for client Stand-alone software clients Good for end-to-end security Challenge for maintenance and compliance Not centralized User must know and remember when to encrypt Often problematic for archiving and surveillance systems

11 Delivery Methods for Members Push and Pull Allows send to anyone Nothing to install or download Secure Portal ( Pull ) Message encrypted and stored on secure server Notification message sent to recipient Typically, can be branded with your logo, look, and feel Secure Attachment ( Push ) Message delivered directly to recipient Message resides in recipient s inbox Online or Offline reading Deployment Options Software Client-level software Gateway-level software Set up encryption gateway, key server and secure portal Appliances Pre-packaged solution, black box Typically quick implementation May require separate appliances for key management, web portal, and/or content filtering

12 Deployment Options (cont.) Services (Security in the Cloud) Fastest to implement Process all or only needing encryption Must be trusted, reliable service provider SAS 70 Type II, SysTrust certification Reference customers Service Level Agreements (SLAs) Hybrid Approach Gateway appliance on-site Customer has control of encryption policies, decisions Key management, secure portals and other components offered as a service No resources required for key server, account management, or web portal hosting Summary is a popular business communication tool Preferred communication method for US adults is like a postcard, written in pencil Identity theft is passing drug trafficking as the number one crime in the US No Send policies are not enough To protect your members you need encryption

13 Summary Encryption options: Gateway or desktop Standards: OpenPGP, S/MIME, TLS Member support with Push or Pull Software, appliance, service or hybrid The right solution for you will depend on your resources and requirements ZixCorp ZixCorp encryption service Largest encryption network: ZixDirectory 11 million users & adding 70,000 new users a week Including many of the nation s most trusted institutions: The US Federal Banking Regulators 19 States Banking Regulators U.S. Securities and Exchange Commission 600 financial institutions

14 ZixCorp s Encryption Service ZixDirectory Questions