While E2EE doesn’t prevent cyberattacks such as the one Salt Typhoon perpetrated, it can render them useless.
“The biggest advantage is that it mitigates vulnerability,” says Richard Forno, assistant director of the Center for Cybersecurity at the University of Maryland, Baltimore County. “So, if your network was compromised by a third party, your encrypted communications would still be secure. That’s why adopting an E2EE strategy was the first recommendation of the Cybersecurity and Infrastructure Security Agency.”
How Can Your Agency Get Started With Encryption?
Some challenges need to be addressed before choosing an encryption provider. The first is figuring out how encryption relates to a department’s document retention policies.
“Wall Street firms have had to deal with this problem for years, as traders have been caught deleting messages while using Signal to get around insider trading and compliance regulations,” Forno says. “And, of course, the government also requires agency documents and communications to be preserved.”
DISCOVER: Samsung’s secure mobile solutions make agency connectivity seamless.
There’s also the issue of complying with federal procurement regulations.
“Some agencies are constrained to buying only U.S. products and services, which limits the number of possible vendors,” Forno says. “Ideally, you’ll want to buy from well-known, reliable vendors. Security software is not something you want to get from a relatively new, obscure company with the lowest bid.”
“The more open a company is about having their encryption technology vetted and validated by the community, the better,” Dunlap says. “You want an industry standard that’s been thoroughly checked out by cryptographic professionals. If a company says they’ve developed an encryption product and shows you what the professionals think about it, that’s better than, ‘Come buy our cool, new encryption. No one on the outside has had access to it or tested it, but trust us, it’s secure.’”
Another value to companies offering open-source E2EE products is that user communities often find and correct issues.
“It’s not uncommon for good citizens or ethical researchers to reach out to the makers of an open-source product and let them know about a problem that needs a patch or update,” Dunlap says. “That’s better than a nation-state finding a flaw that lets them crack a high level of encryption and them keeping that information close to the vest and not telling anyone.”
LEARN MORE: DOD’s higher-level security framework makes sharing systems tricky, but not impossible.
Using Encryption in the Real World
Adopting an encryption program won’t shield anything if employees avoid using it. Perhaps they’re used to communicating with colleagues in other offices via text message, or they find the new encrypted communication program has a clunky interface.
“Of course, there are also instances where an agency employee defaults to using personal email or texting for business, and we’ve even seen that with politicians,” Dunlap says. “Educating and training people on secure communications is essential for federal agencies.”
Another issue that hasn’t been worked out yet is program compatibility.
“Apple’s iMessage is a perfectly good, encrypted message program; however, an iMessage user can’t communicate with someone using Google Messages or Signal,” Forno says. “You’ve got to kind of pick your ecosystem and make sure everyone’s on board with it.”
RELATED: Encrypted attacks on agencies are surging.
There’s also the problem of group chats. If a group chat is set up among agency employees and a handful of independent contractors regarding a project, but the contractors don’t have the encryption program used by the agency staff, the chat communications are unencrypted to allow those users to participate.
“Making sure the outside people use the same program is the answer, but it is an extra step to take,” Forno says.
Overall, the work to put encrypted communications in place is worth the benefits.
“It greatly reduces the risk of sensitive information getting in the wrong hands, and that’s a critical mission for every federal employee,” Dunlap says.
