The importance of protecting the device and not just the network

Issue 3 2021 Infrastructure

With data security such a big talking point of late, many of the discussions around protecting data have focused on securing the network. At a time of increased remote working and reliance on cloud technology, perhaps this is understandable. However, a key consideration should also be how best to secure the devices that hold this data.

Ruben Dennenwaldt.

To ensure data is protected, device systems, hardware and software applications all have to be analysed thoroughly in order to see where improvements can be made to existing infrastructures. Furthermore, new state-of-the-art security techniques need to feel virtually seamless for end users to ensure the best results.

Infrastructures for storing data can be improved and in this article, we will examine four areas where proven security concepts have recently seen significant improvement.

1. The advantages of hardware encryption

Encryption is important to both the confidentiality of data and the drive where that data resides. Strong hardware-based encryption can help to increase security without impacting speed.

These days, people have become accustomed to using their mobile phones for authentication, as many of us now keep our phone with us at all times. We pair our phones with external devices such as headphones and log in with biometrics such as fingerprint or facial recognition. Using these same sorts of actions seemed like the ideal way to add security features in a way that feels very natural and intuitive.

Hardware-based encryption is different than encryption which takes place within software. In software-based encryption, the host computer has access to the encryption key for the disk, which means that malware on the host can steal that key. With many forms of hardware-based encryption, the key used to encrypt data on the drive stays isolated within the drive itself.

Hardware-based encryption therefore helps provide a secure method of establishing trust while also eliminating a traditional point of friction and weakness within the verification process.

2. Application security through sandboxing

One of the security measures that must be met by apps listed on official app stores is application sandboxing. Sandboxing supports built-in operating system checks to limit an app’s use of system resources to only those features that the app developer intends. This helps prevent inserted malicious or faulty code from being used to access additional system resources.

For instance, a sandboxed application cannot corrupt other applications’ files, or spoof operating system level security dialogues. By contrast, an app which contains a kernel-level driver has full control over your operating system as well as all applications and files on your computer. Any security bug in this driver might allow malware to take over the entire computer.

Sandboxed applications include an entitlement list that enumerates the set of system resources that the app requires. This list is checked by the operator of the app store to ensure that it matches the features of the application. If the application attempts to access a resource that it does not have permission to use, such as a microphone, then the operating system’s sandbox will prevent the application from continuing.

This keeps an app from being used to access resources and data on your device. When it comes to ease-of-use, the key is applying the best practices of mobile device security to external drives. If the drive is uniquely linked via an app on a user’s compatible smartphone through an encrypted wireless connection, it helps bring enhanced security and a great user experience.

3. Communications protocols over Bluetooth technology and USB ports

Traditionally, there are two methods to unlock your drive and authorise other users: wirelessly via Bluetooth technology and using a wired method, such as via a USB port. No matter which method you choose, the same technologies are used to help secure your connection to the device.

The Bluetooth pairing process requires a pairing code to be entered on both devices. Nowadays Bluetooth security can provide a ‘point and pair’ connection process. This layer makes it easier to pair and also helps improve security by verifying the authenticity of the drive when you connect to it.

Drives can contain a label with a unique key that is used to locate and secure the connection. When connecting via Bluetooth technology, you simply scan the QR code on the label, then your phone finds and connects to the drive using the key embedded in the code. When connecting via a USB port, a separate, shorter code is used, which is printed next to the QR code. This code serves as validation you are connecting to the right drive and also helps prevent malicious applications from connecting to it.

4. Data protection through hardware-backed encryption

These days, hardware-backed encryption is based on a new approach to public-key management, one which allows data to be self-secured by the hardware-based key storage in your smartphone or computer.

Passwords can be a weak link in security, while also interfering with the useability of a device. Simply put, people may choose weak passwords, or they forget them. Once the password of a self-encrypting drive is lost, the data on the drive could be lost as well.

To address these issues, there is a new approach to securing data on a self-encrypting drive. A smartphone or laptop can be used as a ‘key’ that can unlock your drive. Specifically, this is done through a hardware-backed key storage on your device. This hardware protection enforces the use of a mobile device’s passcode or the biometric used to unlock the private key.

Moving forward

There are clear advantages to using hardware for data security over solely relying on secure networks. Hardware products can push the boundaries of state-of-the-art security techniques while maintaining ease-of-use that feels virtually seamless. These products are designed by choosing existing, proven security concepts, improving them whenever possible and creating innovative solutions where they are needed. Ultimately, by weaving concepts together, a next-generation architecture is created that helps provide security over many technology layers.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Navigating the evolving tech landscape in 2024 and beyond
Residential Estate (Industry) Infrastructure
Progress in the fields of AI, VR and social media is to be expected, but what is not, is our fundamental relationship with how we deploy solutions in our business and how it integrates with greater organisational strategies and goals.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Smart mining operations management
Mining (Industry) Infrastructure IoT & Automation
In his presentation at the recent MESA Africa conference, Neels van der Walt, Business Development Manager at Iritron, revealed the all-encompassing concept of SMOM (Smart Mining Operations Management) and why it is inextricably linked to the future of worldwide mining operations.

Do you need a virtual CIO?
Editor's Choice News & Events Infrastructure
If you have a CIO, rest assured that your competitors have noticed and will come knocking on their door sooner or later. A Virtual CIO service is a compelling solution for businesses navigating tough economic conditions.

The TCO of cloud surveillance
DeepAlert Verifier Technews Publishing Surveillance Infrastructure
SMART Security Solutions asked two successful, home-grown cloud surveillance operators for their take on the benefits of cloud surveillance to the local market. Does cloud do everything, or are there areas where onsite solutions are preferable?

Cyber resilience – protect, defend, recover
The challenge with AI is that threats are getting harder to detect. As a result, plans in 2024 are not just about detection and prevention, but about recovery.

Powering business resilience and field operations
Infrastructure Products & Solutions
[Sponsored] The Anker 757 Portable Power Station emerges as a strategic asset for businesses looking to overcome power instability and the demand for operational efficiency in remote and field-based environments.

Top bets for backup and business continuity
Become your organisation’s data pioneer and spearhead data governance and protection of critical data. Challenge why best practices are not adopted or in place, while highlighting the inherent risks this poses.

Next-gen solar-powered switches
Duxbury Networking has introduced its range of solar unmanaged switches, which are ideal for any environment requiring reliable Power-over-Ethernet (PoE) capabilities, such as IP phones, cameras, and access points.

Navigating South Africa's cybersecurity regulations
Sophos Information Security Infrastructure
[Sponsored] Data privacy and compliance are not just buzzwords; they are essential components of a robust cybersecurity strategy that cannot be ignored. Understanding and adhering to local data protection laws and regulations becomes paramount.