In this lesson,
we're going to discuss encryption recommendations
that you may need to make after a pen test.
Just as a quick refresher,
let's define what we mean by encryption.
Encryption is the process
of converting plain text into coded format,
known as ciphertext, to prevent unauthorized access.
This ensures that only authorized parties
who possess the decryption key
can read the original information.
The most basic purpose of encryption
is to protect the confidentiality of data.
Whether that data be at rest (which is stored on a device)
or in transit (being transmitted over a network),
encryption ensures that even if the data is intercepted
or accessed by unauthorized individuals,
it remains unreadable and secure.
A key characteristic of effective encryption
involves using strong encryption algorithms
and managing encryption keys securely.
Common encryption algorithms include AES,
which stands for the Advanced Encryption Standard,
which is used for symmetric encryption
and RSA, which stands for Rivest-Shamir-Adleman,
for asymmetric encryption.
In wireless networks,
encryption protocols like WPA2 (Wi-fi Protected Access-2)
and WPA3 are used to secure communications.
WPA2 uses AES for encryption and is widely used,
but WPA3 offers enhanced security features
such as improved encryption key management
and protections against brute force attacks.
For securing communication over networks,
protocols, like SSH which is the Secure Shell,
are used to encrypt data between devices,
ensuring secure remote access and file transfers.
Additionally, in enterprise environments,
encryption methods such as PEAP which stands
for the Protected Extensible Authentication Protocol,
EAP-TTLS which stands
for Extensible Authentication Protocol-Tunneled
Transport Layer Security,
and EAP-FAST which stands
for the Extensible Authentication Protocol-Flexible
Authentication via Secure Tunneling
are commonly used to secure wireless
and wired network access.
These methods provide secure authentication
and encryption of data transmitted over the network.
And it's also important to consider
encryption export regulations which restrict the use
and export of certain types of encryption technologies.
These regulations aim to control the spread
of strong encryption that could be used
for malicious purposes.
Organizations must ensure compliance
with these regulations when exporting encryption solutions,
particularly if they operate internationally.
For example, if a company wants to export a messaging app
to a customer in France,
they might need to do so under License Exception ENC
after completing the necessary registration and reporting.
License Exception ENC, where the ENC
just stands for encryption,
is the provision
in the U.S. Export Administration Regulations, or EAR,
that authorizes the export, re-export,
and transfer (in-country) of encryption commodities,
software, and technology.
With that being said, given our current relations
with a country like North Korea,
if the company wants to export that same messaging app
to North Korea, the company would likely need to apply
for an export license due to stricter regulations
on certain countries if they even allow it at all.
So how do you make the appropriate recommendations
for encryption after a pen test?
Start by assessing the current use
of the encryption across
all data storage and transmission points.
Ensure that strong industry-standard encryption
algorithms are being used.
For data at rest, this might involve
encrypting databases, file systems, and backups.
For data in transit, implement TLS,
or the Transport Layer Security,
to secure communications over networks.
Next, we want to review the key management practices.
Ensure that encryption keys are stored securely
and rotated regularly to prevent them
from being compromised.
Use a dedicated key management system
to handle the life cycle of encryption keys,
including generation, distribution, storage,
and destruction.
For wireless networks, we need to verify
that WPA2 or WPA3 is implemented and properly configured.
Ensure that enterprise authentication methods,
such as PEAP, EAP-TTLS, or EAP-FAST,
are used where appropriate to secure network access.
And for remote access, ensure that protocols,
like SSH, are used to encrypt data transmissions.
We need to make sure that we're conducting regular audits
to ensure compliance with encryption policies
and identify any unencrypted sensitive data.
We also need to educate staff on the importance
of encryption and best practices for handling
and securing encrypted data.
Additionally, we need to stay informed
about encryption export regulations
to ensure compliance and avoid any legal issues.
So remember, encryption is an essential practice
for protecting the confidentiality of your data.
By implementing strong encryption methods,
managing encryption keys securely,
and staying compliant with regulations,
you can address vulnerabilities identified
during the pen test and maintain a robust security posture.