PQR Ltd. is a logistic service provider company, having presence at different locations in India as well as abroad. The company has been facing a lot of challenges due to its complex technical infrastructure and out-date
CS Professional · Information Technology and Systems Audit · PYQS · December 2019
PQR Ltd. is a logistic service provider company, having presence at different locations in India as well as abroad. The company has been facing a lot of challenges due to its complex technical infrastructure and out-dated legacy applications, including poor information system management. The employees of the company have also been facing a lot of issues in using the existing software systems. The poor quality of information resources and absence of proper information for strategic planning are leading to wastage of resources of the company and thus affecting the reputation of the company in the market. After a lot of deliberations with the stakeholders and with a consulting firm, the management of the company decided to adopt new IT enabled infrastructure including adoption of cloud computing services. Based on the above, attempt the following: Explain the encryption requirements during the transit and the storage of restricted data, as a part of data handling security measures to be taken by PQR Ltd.
Answer & Explanation:
Encryption requirement are as under: Transit encryption: Restricted data must be encrypted during transmission with a method that meets the following requirements: Cryptographic algorithm(s) are listed in FIPS 140-2 Annex A, the list of approved security functions. Cryptographic key lengths meet best practices for length, given current computer processing capabilities. Both the source and destination of the transmission must be verified. Storage encryption: Restricted data must be encrypted using strong, public cryptographic algorithms and reasonable key lengths given current computer processing capabilities. Keys must be stored securely, and access to them provided on a least-privilege basis (see ISO 11568 for recommendations on securing keys). If one-way hashing is used in lieu of reversible encryption, salted hashes must be used. Possible encryption scenarios are: Encrypt files containing restricted data using different keys or passwords than those used for system login. Encrypt data stored in databases at the column-level. In addition to file and/or database encryption, implement full-disk encryption on portable devices containing restricted data.
Topics: Data Security