And there you have it. Encryption is not necessarily going to protect you or your company.
http://www.wired.com/threatlevel/2012/01/judge-orders-laptop-decryption/
http://www.wired.com/threatlevel/2012/01/judge-orders-laptop-decryption/
I came across an article by Roger Grimes over at Infoworld on how security policies and controls are the real power when it comes to IT security. Roger mentions the SANS 20 Critical Security Controls for Effective Cyber Defence , which are a great read for anyone looking at updating or auditing your policies for completeness. The SANS top 20 controls are a must for any organization: Inventory of Authorized and Unauthorized Devices Inventory of Authorized and Unauthorized Software Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers Secure Configurations for Network Devices such as Firewalls, Routers, and Switches Boundary Defense Maintenance, Monitoring, and Analysis of Security Audit Logs Application Software Security Controlled Use of Administrative Privileges Controlled Access Based on the Need to Know Continuous Vulnerability Assessment and Remediation Account Monitoring and Control Malware Defenses Limitation and Control ...
I think this, or a similar case will need to go before the US Supreme Court for a ruling eventually. In the mean time, "I forgot the decryption password" would be a valid next step for her.
ReplyDeleteCue the encryption industry providing a solution where if you enter password A you decrypt but if you enter password B you destroy.
ReplyDeleteI know that TrueCrypt has plausible deniability built in as one of their encryption schemas. I wonder how long before traditional vendors introduce the same...
ReplyDelete