Incident Response

Encryption

Even in using out-of-band communications such as those described previously, it is prudent to encrypt sensitive data. Using available encryption tools will increase the level of confidence in the data that you’ve collected. Encryption tools can enhance data confidentiality, integrity, and authenticity.

With the basic concepts of encryption in mind, let’s talk about how we could make use of them during an incident. Maintaining confidentiality of all information collected during an incident is vital. Quite often, we’re going to transmit the data to an analyst via a network or modem, as we discussed previously. We need to make more than just a basic effort to protect the confidentiality of the data. Pretty much any encryption product can do that for you; choosing the right one really comes down to ease of use, compatibility with the platform that you want to run it on, and key management.

Ease of use is extremely subjective, so we’re not going to spend much time talking about it, except with regard to the particular tools described in this section. Compatibility is a more objective issue, and one that should be carefully thought through. It’s not enough to say that you use Windows NT, so you only need an NT-based encryption package; what about the systems that you’re likely to run up against during an actual incident? If your team supports one parent organization, then it should be relatively easy to predict. If not, you should look at packages that run on just about everything. ...