Cloud Hosting

The Justice Department is requesting more than $20 million in federal funding to bankroll efforts related to resolving the governments continuing Going Dark problem, Deputy Attorney General Rod Rosenstein said Tuesday, signaling one of the Trump administrations first attempts at tackling the issue of ubiquitous, hard-to-crack encryption amid growing concerns involving its impact on criminal investigations.

While federal investigators have fought for years to counter the so-called Going Dark phenomenon the governments growing inability to access and decipher digitally encrypted communications Mr. Rosenstein said during a Justice Department budget-request hearing Tuesday that resources needed to reverse the trend are required now more than ever.

The seriousness of this threat cannot be overstated, Mr. Rosenstein told the Senate Subcommittee on Commerce, Justice, Science and Related Agencies. This phenomenon is severely impairing our ability to conduct investigations and bring criminals to justice.

The Justice Department is requesting $21.6 million specifically towards countering its Going Dark program, Mr. Rosenstein testified in his prepared remarks.

The FBI will use this funding to develop and acquire tools for electronic device analysis, cryptanalytic capability and forensic tools, he added, in turn enabling the Justice Department to continues its leading role in enhancing the capabilities of the law enforcement and national security communities.

Mr. Rosenstein was not initially slated to testify Tuesday, but appeared after the hearings previously scheduled witness, Attorney General Jeff Sessions, canceled in lieu of speaking before the Senate Intelligence Committee with respect to the Trump administration and its purported ties to Russia, as well the presidents abrupt firing last month of former FBI Director James Comey.

Days before leaving office on May 9, Mr. Comey said federal investigators had legally seized more than 6,000 smartphones and electronic devices during a recent six-month span but found that 46 percent couldnt be opened with any technique.

That means half of the devices that we encounter in terrorism cases, in counterintelligence cases, in gang cases, in child pornography cases, cannot be opened with any technique, Mr. Comey told the Senate Judiciary Committee on May 3. That is a big problem. And so the shadow continues to fall.

The vast majority of smartphones currently sold in the U.S. run either Apples iOS or Googles Android operating systems, the likes of which allow customers the ability to protect their digital contents and communications from eavesdroppers with security-minded technology including strong encryption. While hailed by privacy and security proponents, however, the issue became a hot-button issue last year after federal authorities found themselves unable at first to access the contents of an Apple iPhone recovered from the scene of a December 2015 mass shooting in San Bernardino, California.

If Apple doesnt give info to authorities on the terrorists Ill only be using Samsung until they give info, President Trump tweeted from the campaign trail February. Boycott all Apple products until such time as Apple gives cellphone info to authorities regarding radical Islamic terrorist couple from Cal.

The Obama administration was not in a position where they were seeking legislation, Mr. Comey told lawmakers last month when asked about the possibility of establishing a legal statue to resolve the Going Dark dilemma. I dont know yet how President Trump intends to approach this. I know he spoke about it during the campaign, I know he cares about it, but its premature for me to say.

Read the original:
Justice Department requests $21.6M to tackle 'Going Dark' encryption problem - Washington Times

Source: Thinkstock

June 14, 2017 -Healthcare cybersecurity is essential for covered entities of all sizes, especially as ransomware attacks and other types of malware become more common. Healthcare data encryption is often discussed in these situations as well, with many in the industry underlining its importance.

HIPAA regulations do not specifically require data encryption, and instead qualify it as an addressable aspect. However, it is a very necessary piece to the larger data security puzzle.

In this primer, HealthITSecurity.com will review the basics of healthcare data encryption and explain why it is so critical in the current healthcare cybersecurity landscape.

Encrypting data means an organization converts the original form of the information into encoded text. Data is unreadable unless an individual has the necessary key or code to decrypt it.

With healthcare data, this involves securing ePHI and keeping it confidential so unauthorized individuals cannot access or use the information, even if they are able to find the information in a database or network.

READ MORE: Implementing HIPAA Technical Safeguards for Data Security

The Security Rule defines confidentiality to mean that e-PHI is not available or disclosed to unauthorized persons, HHS states on its website. The Security Rule's confidentiality requirements support the Privacy Rule's prohibitions against improper uses and disclosures of PHI.

Furthermore, the Security Rule also emphasizes the importance of ePHI integrity and availability. Covered entities maintain integrity by ensuringePHI is not altered or destroyed in an unauthorized manner, while availability relates to the data is only accessible and usable by authorized individuals.

There are also two kinds of two kinds of data that can be encrypted: data in motion and data at rest.

Data in motion is information that is being sent from one individual or device to another. For example, this can be done through secure direct message or email. Data at rest is when the information is being stored.

Encryption and decryption fall under the Access Control aspect of HIPAA technical safeguards. The Security Rule does not require specific technical solutions, and instead maintains that there are many technical security tools, products, and solutions that a covered entity may select to maintain PHI security.

READ MORE: How Data Encryption Benefits Data Security

Determining which security measure to implement is a decision that covered entities must make based on what is reasonable and appropriate for their specific organization, given their own unique characteristics, as specified in 164.306(b) the Security Standards: General Rules, Flexibility of Approach, states the HIPAA Security Series from HHS.

Access Control will give users the necessary rights or privileges to access certain areas containing information, including information systems, applications, programs, or files. These rights and/or privileges should be granted based on an individuals necessary job function, and the minimum necessary must be followed.

Essentially, individuals should only be given the minimum necessary access to properly perform their job. This is especially critical when PHI access is taken into account.

For encryption and decryption specifically, HHS explains that healthcare organizations must determine if this measure will be necessary and benefit workflow.

it permits covered entities to determine whether the addressable implementation specification is reasonable and appropriate for that covered entity, HHSstated. If it is not, the Security Rule allows the covered entity to adopt an alternative measure that achieves the purpose of the standard, if the alternative measure is reasonable and appropriate.

READ MORE: HIPAA Data Breaches: What Covered Entities Must Know

HHS added that covered entities should consider which ePHI should be encrypted and decrypted to prevent unauthorized access by persons or software programs. Additionally, organizations can consider reasonable and appropriate mechanisms to prevent access to ePHI by persons or software programs that have not been granted access rights.

Healthcare organizations can use their risk analysis to better determine whether or not something is addressable or required. This is another key aspect of HIPAA regulations, and all entities should be performing regular risk analyses.

Davis, Wright, Tremaine LLP associate Anna Watterson explained in a previous interview with HealthITSecurity.com that the risk analysis is the foundation of the security role for an organization.

The addressable ones need to be implemented if reasonable and appropriate, Watterson said. So the risk analysis can be the basis for determining whether a particular addressable implementation specification is reasonable and appropriate to implement in a particular circumstance.

The National Institutes for Standards and Technology (NIST) explained in a storage encryption guide that organizations should implement encryption solutions that use existing system features, such as operating system features.

It can be more difficult when solutions require extensive changes to the infrastructure. Furthermore, end user devices should generally be used only when other solutions are not sufficient.

Organizations should carefully consider how key management practices can support the recovery of encrypted data if a key is inadvertently destroyed or otherwise becomes unavailable, NIST wrote. Organizations planning on encrypting removable media also need to consider how changing keys will affect access to encrypted storage on removable media and develop feasible solutions, such as retaining the previous keys in case they are needed.

NIST also establishedthe Cryptographic Module Validation Program (CMVP) to analyze, test, and validate that crypto modules are functioning properly and deploying approved algorithms. All algorithms and modules are tested for conformance with the Federal Information Processing Standard (FIPS) 140-2.

Many federal agencies require FIPS 140-2 validation, noted HealthITSecurity.com contributor Ray Potter.

Essentially this means that crypto is useless until proven otherwise, a blunt but accurate sentiment, Potter wrote. Other sectors have adopted the standard as their own, as well, with increasingly strict adherence in state and local government, finance, and utilities. Either encryption is validated or it is not. Its very black-and-white.

With healthcare data encryption, NIST also released NIST SP 800-66:An Introductory Resource Guide for Implementing the HIPAA Security Rule.

NIST security standards and guidelines (Federal Information Processing Standards [FIPS], Special Publications in the 800 series), which can be used to support the requirements of both HIPAA and FISMA, may be used by organizations to help provide a structured, yet flexible framework for selecting, specifying, employing, and evaluating the security controls in information systems, the guides executive summary explained.

Overall, healthcare organizations need to take the time to understand all available options to properly maintain ePHI security. Technology will only continue to evolve, and covered entities and their business associates are becoming more digital and connected both to other organizations and in utilizing internet connected devices.

A ransomware attack could lead to data becoming compromised, but what if it was already encrypted in the first place and was inaccessible? A laptop containing ePHI might be stolen, but what if that data is unreadable without an access key?

HHS even notes in its ransomware guidance that if the ePHI was properly encrypted before an incident occurs, then it is not considered unsecured PHI and the entity is not required to conduct a risk assessment to determine if there is a low probability of compromise, and breach notification is not required.

Healthcare organizations should conduct thorough and regular risk analyses to properly determine how and where data encryption would be beneficial. Staying educated on all available options and any federal or state requirements will also help entities ensure ePHI security. While not technically required, data encryption is quickly evolving into a very necessary part of data security.

More:
Healthcare Data Encryption not 'Required,' but Very Necessary - HealthITSecurity.com