Not long ago, news reports of a hacking incident emerged that should serve as a cautionary tale for enterprises and those responsible for maintaining their organizations’ data security (including encryption management) programs. The story, reported by Dark Reading and other cybersecurity journals, tells of a student who brought a halt to the Taiwan High Speed Rail (THSR) network after sending an emergency signal over the communications system.
It is not known why the perpetrator (described as a “train enthusiast”) did it, but what experts believe is that THSR’s Terrestrial Trunked Radio (TETRA) system was vulnerable because its encryption keys had not been rotated in more than twenty years. If ever there was an archetypal case study for the risks of improper encryption management, this would be it.
Just the Encryption Management Facts, Ma’am
I don’t want to speculate on the why behind this failure; there are several possible scenarios that could have resulted in the error. Assuming that the reports are accurate, we should instead focus on acknowledging the oversight and recognizing why proper management of the entire encryption process is important. Then, we should examine ways to identify encryption gaps in our own organizations and how to prevent similar oversights from happening.
Taiwan High Speed Rail’s Encryption Keys Had Not Been Rotated in More Than Twenty Years
The first step is simply recognizing that enterprise data encryption is more than just something you do to protect a file. It is a program that manages processes, identifies authorized parties, and controls access to the controls behind those processes. And for organizations with complex information supply chains, it should not be left to individuals to manage these processes manually. When encryption management is done ad hoc by people, mistakes are made and incidents occur. Those incidents might be three-hour disruption of high-speed rail service, or they might be a data breach in which highly sensitive company, customer, or personal information is compromised.
Encrypting Data Files and Channels
And encryption isn’t just something you do with data files. As the THSR incident reveals, data associated with the channels over which data is transmitted must also be encrypted. When that information is protected, senders and recipients have assurance that each is a legitimate party to the transaction. When a critical file—or emergency signal—is transmitted, the person or endpoint knows it is authentic, has not been tampered with, and originated from a legitimate entity.
This is why our Diplomat MFT managed file transfer solution pairs strong 2048-bit file encryption from Pretty Good Privacy (PGP) with Secure File Transfer Protocol (SFTP), the industry standard communication protocol encryption. Both are unbreakable and together provide excellent protection. And it is why many organizations choose Diplomat MFT with fully automated encryption management for file transfers rather than continue to use manual processes.
Don’t Be Late to Dinner
Encryption management automation that includes regular key rotation and distribution at intervals of your choosing, retires expired and obsolete keys, and tackles authentication and access control for administrators based on the principle of least privilege mitigates the risk of error that puts data and your operations at risk. And when you choose Diplomat MFT for file transfer automation you also get simple, automated encryption management across the entire file transfer ecosystem – including the industry’s only in-browser PGP automation.
What happened at Taiwan High Speed Rail is still largely a matter of speculation, but that doesn’t mean we shouldn’t immediately take action to review our own encryption practices and update them as necessary. An incident that halts operations at your organization might result in more than coming home three hours late to a cold dinner.