Encryption , Technology

NIST: Specially Designed Cryptography Needed for Small Computing Devices Eric Chabrow (GovInfoSecurity) • September 6, 2016    

The National Institute of Standards and Technology is moving ahead with an initiative to create standards for cryptographic algorithms for small computing devices, such as those found in automobiles, control systems, smart grids and the Internet of Things.

See Also: A Smarter Approach to Third-Party Vendor Risk: A Case Study

NIST last month issued a draft report, Interagency Report 8114: Report on Lightweight Cryptography, which provides an overview of its lightweight cryptography project and describes plans to standardize these algorithms.

Cryptographic algorithms designed to secure large computer devices - servers, desktops, tablets and smart phones - don't necessarily scale downward to function effectively on smaller devices - think embedded systems, radio frequency identification devices, sensor networks and thousands upon thousands of devices that make up the Internet of Things.

Vulnerability Anxieties

Experts have expressed some anxiety about the vulnerabilities created by the lack of encryption for smaller devices. "Everyone who understands cryptography standards and their applications shares the same feeling," says Lily Chen, NIST's acting group leader for cryptographic technology. "We have seen too many lightweight cryptography primitives [low-level algorithms used to build cryptographic protocols for computer security systems] broken. In order to achieve lightweight metrics, special design methodologies are applied. Some of the methodologies are less understood about the security impacts. Even for well-designed lightweight cryptography primitives, misuse could lead to security mishaps."

As smaller computing devices become ubiquitous, NIST is exploring ways to develop tailored algorithms to encrypt them. NIST, in 2013, initiated the lightweight cryptography project to study the performance of the existing NIST-approved cryptographic standards on these so-called constrained devices, understand the need for dedicated lightweight cryptographic standards and, if necessary, design a transparent process for standardization.

Constrained Environments

"We're talking about some very constrained devices, 8-bit processors [with] little memory, low speed, low power," says cryptographer and IT security author Bruce Schneier. He sees the lightweight cryptography project as important because "a lot of the algorithms we have just aren't suitable for these constrained environments. ... We want good algorithms for constrained devices."

NIST plans to create a portfolio of lightweight primitives through an open process, in which submitters describe physical, performance and security characteristics of these algorithms. NIST used a similar process to develop its portfolio of block cipher modes of operations. A block cipher mode is an algorithm that provides an information service, such as confidentiality or authentication.

Power Limits

Because many small computing devices have power and/or bandwidth constraints, lightweight cryptographic solutions must be designed, in many instances, for specific types of devices. For example, some RFID devices draw power from nearby sources to function. That lack of internal power places limits on how the devices can be encrypted.

"The guidance has to be very specific for each application environment," NIST's Chen says. "It is a different approach compared to our general purpose cryptography standards. For lightweight cryptography, to be specific is the key to make sure the guidance can be effective to avoid introducing security flaws."

Greg Temm, the first chief information risk officer at the Financial Services Information Sharing and Analysis Center, says he'll focus on helping members analyze cyberthreats and expand global threat intelligence sharing.

In an interview with Information Security Media Group, Temm says his position was created to help ensure that the FS-ISAC continues to help its 7,000 member firms support the resilience and continuity of the global financial-services infrastructure.

"We continue to take security seriously, as a fundamental component to the value proposition of the FS-ISAC," he says. "Many of our board members are chief information security officers or chief risk officers of their organizations, so they have a keen sense of what is needed from the FS-ISAC to protect their organizations, and this position will further solidify those high-level goals."

Temm will serve as an adviser to FS-ISAC members, leading the organization's global intelligence and risk management programs. He says he'll work to analyze "cyberthreat information that we have at our disposal and glean insight from it to inform our stakeholders about what it might mean to them. They can then use that intelligence to feed into their own risk management practices to help them further mitigate risk."

The new FS-ISAC chief information risk officer says his experience at MasterCard, where he led various components of the card association's security program, helped prepare him to take on the role of disseminating meaningful threat information to FS-ISAC members.

"With recent reports estimating that cybercrime damages alone will top $6 trillion in the next five years, there's a tremendous amount of opportunity to reduce those potential risks by developing programs and partnerships that help our member organizations avoid these losses," he says.

In this interview (see audio link below photo), Temm also discusses:

Why ransomware attacks are a growing concern for the global financial community; How the merging of physical threats and cyberthreats is changing how organizations fight cybercrime; and Steps the FS-ISAC is taking to expand global intelligence sharing.

Temm brings 18 years of experience in cybersecurity and risk management to the FS-ISAC. Most recently, he led MasterCard's Intelligence & Public Private Partnership program for cyber and physical threats. In previous roles at MasterCard, Temm led cybersecurity, network operations and debit operations. He was instrumental in the creation of MasterCard's first security operations center. Temm has served as an officer and director for FS-ISAC.

After a significant 2003 cyberattack against the company, defense contractor Lockheed Martin spent 10 years developing a cyber defense strategy taking into account the lessons it learned.

Key elements of that strategy that others can put to use include diligently gathering threat intelligence internally to support development of an effective mitigation strategy. Another important step is the use of the company's seven-step "cyber kill chain framework" to guide the process, says Chris Coryea, cyber intelligence services manager for Leidos' cyber intelligence practice in Europe, the Middle East and Africa. Leidos acquired Lockheed Martin's information systems and global solutions cyber business in August.

"Post the attack, we wanted an effective strategy or a framework that helped us derive intelligence from the data and footprints left by the attackers," Coryea explains in an interview with Information Security Media Group conducted at the recent 2016 RSA Conference Asia Pacific & Japan in Singapore.

"To derive the intelligence and understand the gaps in people, process and technology so as to evaluate portfolio of products and technologies against real attacks, we [created our] cyber kill chain framework to build defense strategies."

Leadership Continuity

To build an effective security strategy, however, requires continuity in leadership, Coryea says. "Frequent changes in leadership, such as having a new CISO every two years, breaks the long haul of building a security culture and consistency in building effective defenses as each new professional would like to try something different, discarding the earlier efforts," he says.

In this interview (see audio player below photo), he also offers insights on:

Using a systematic and pragmatic approach to building a network defense; Creating an actionable threat intelligence program; Taking advantage of information sharing to help mitigate threats.

In this role at Leidos, Coryea oversees its UK Security Intelligence Centre and is responsible for leading a team of cyber intelligence, open-source intelligence and information assurance analysts.

Principal correspondent Varun Haran contributed to this report.

The ISMG Security Report leads with a report on Federal CIO Tony Scott partly blaming the way Congress funds agencies for the 2015 breach of computers at the Office of Management and Budget that exposed 21.5 million records.

In the report (click on player beneath image to listen), you'll also hear:

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our Aug. 30 and Sept. 2 reports, which respectively analyze an FBI warning to state election officials that their IT systems could be hacked and a conversation with internet co-founder Vint Cerf. The next ISMG Security Report will be Friday, Sept. 8.

Theme music for the ISMG Security Report is by Ithaca Audio under the Creative Commons license.