When considering a secure communications solution for your organisation, there are a lot of different options. Not least of these are free-to-use consumer-grade apps. Without vigilance, these apps can seep into business use without any oversight from the organisation. This is often because employees use the apps for personal life, and they seem like an expedient way to communicate.
These apps claim end to end encryption, but do they really meet the needs of an enterprise? And what extra do paid-for Enterprise solutions offer? Dr Andy Lilly, CTO of Armour Comms, explains.
There is much more to security than just encryption – this is an important point made by the UK National Cyber Security Centre (NCSC). It has published a document, ‘Secure communications principles’, highlighting key points for secure communications. As usual, NCSC has done an excellent job of laying out the potential hazards – and how to avoid them – in an easy-to-read form. Here is an outline of those principles and why they are important.
NCSC 7 Principles for Secure Communications
NCSC defines seven principles, and they are:
- Protect Data in transit
- Protect network nodes with access to sensitive data
- Protect user access to the service
- Ensure secure audit of communications is provided
- Allow administrators to securely manage users and systems
- Use metadata only for its necessary purpose
- Assess supply chain for trust and resilience
Protect Data in Transit
At some point, your communications are very likely to travel over the public internet. It is, by its nature, an untrusted network. You don’t control it, so you can’t trust it. If not well protected, data travelling over an untrusted network can be tampered with, or people may be able to eavesdrop on your conversations and exchanges.
Messages sent to the wrong person is another issue. It could be because you mistyped their address or someone has spoofed or stolen an identity. You could think you are interacting with a trusted colleague, when in fact, a hacker has misappropriated their account. You could be tricked into giving sensitive, valuable information or downloading malware.
Protect network nodes with access to sensitive data
A node is a connection point inside a network that can receive, send, create, or store data. Each node requires you to provide some form of identification to receive access. As your message travels across the network and passes through these nodes, if it has any unencrypted data, it may be accessed by the nodes. While the app may encrypt the communication within the message, your metadata may not be.
Another key point to consider is that encrypted messages rely on an encryption key to encrypt and decrypt. The key needs to be shared with the recipient for them to read the message. It requires some form of key management system. If someone were to get hold of the key, they could read the message. If someone accesses the key management system, that would undermine the trust of the communications system. You wouldn’t necessarily know that this had happened until it was too late and that sensitive information had been compromised.
Protect user access to the service
As alluded to earlier, when you communicate with a trusted colleague, you assume that it is them. However, if their account is hacked, you may not be communicating with whom you think you are*. For this reason, strong user authentication is an important part of a communications system.
Suppose your colleagues are using their own phones for business use, i.e. an unmanaged device. In that case, there is also the danger that details such as user credentials and historic communications content are processed and stored without being encrypted. Therefore, if someone else gains access to that device/phone, information could be compromised. It is another reason for strong access control authentication (for example, fingerprint scan or password).
*In case the risk here isn’t clear, this is the ‘messaging app’ analogy to Business Email Compromise (BEC), which the FBI’s 2020 Internet Crime Report indicated cost $1.8B last year, more than the total costs of confidence fraud, ransomware, identity theft and several other categories all added together!
Ensure secure audit of communications is provided
For those working in regulated industries (financial services and health, for example), it is important that all communications can be audited. That requires all communication data to be recorded and stored. However, this is not as easy as it sounds. The communications content must be kept secure. It also needs tight controls around who can access the content, when and why. This level of access would be highly desirable to criminals. Consumer-grade apps certainly do not provide this level of service. Some may even monitor your content for advertising or other purposes.
Allow administrators to securely manage users and systems
All IT service desks know that if users can administer their own accounts, you end up with anarchy. For a secure communications system to remain secure, it must be properly managed. It means controlling who can join and who can communicate with which groups. In contrast, consumer apps allow anyone to join. It could include hackers, criminals, and disgruntled ex-employees. Once in, they can then contact anyone else on the system.
Controlling who is admitted to the system provides a level of trust that you know whom you are communicating with. Should someone leave the organisation, their account is disabled.
Use metadata only for its necessary purpose
Metadata is the ‘who’, ‘where’, ‘when’, and ‘how’ of the communication. It reveals information about the user, for example, who is talking to who. In certain cases, this can be useful even if a malicious actor doesn’t know what they are saying.
Aggregating metadata makes it even more valuable. It is often harvested and sold to advertisers. This is how free-to-use services monetise their users. Apart from the adverts being annoying (and creepy), it is a security risk for organisations.
Assess supply chain for trust and resilience
Do you know every element of your secure communications service and who supplies it? Can you trust every element? If your existing solution uses the public internet, you can’t know every element, and therefore you need to mitigate the risks.
Is the system standards-based (and so can be supported by multiple vendors) or a proprietary system? If proprietary, what happens should that supplier go out of business or be taken over by another organisation?
Finally, for a secure communications solution to be genuinely usable (in other words, there is no reason for users to circumvent the system with workarounds or “shadow IT”), can users communicate with people outside of the organisation? Any solution adopted needs to be able to talk to other secure communications systems.
The ease of use of a communications app belies the underlying complexity. When looking for a solution that is secure enough for enterprise and business use, there is a lot to consider.
Armour Communications Limited is a UK based company supplying market leading technology for secure communication via 3/4/5G, Wi-Fi and satellite for voice, video, messaging and data on Android, iOS, Windows, Linux and macOS platforms. Armour Mobile features in-built secure conferencing (audio and video) between multiple callers. SigNet by Armour provides similar end-user features with enhanced AES-256 bit peer to peer encryption.
Armour Mobile and SigNet by Armour are available as Cloud or On-Premises solutions. If required Armour’s technology can interoperate with SIP based PBXs and commonly used UC installations, extending the reach of mobile secure comms to the desk phone in the enterprise.
Armour Mobile and SigNet by Armour enable users inside and external to an organisation to communicate transparently within a secure and private environment, while taking advantage of the reduced costs and increased flexibility provided by Voice over IP corporate communications.
Armour’s products include NATO and CPA approved offerings up to OFFICIAL-SENSITIVE and NATO Restricted with solutions via selected Armour partners available to mitigate threats up to SECRET.
In March 2021 Armour achieved ISO27001:2013 registration for the Armour Communications Information Security Management System covering the development and delivery of Armour Mobile, SigNet and white-labelled products.
Armour’s products are trusted by Government departments, banks, law enforcement, defence and health organisations, and enterprises around the world.
Armour and SigNet by Armour are registered trademarks of Armour Communications Limited.
Armour Mobile, Armour Connect, Armour Desktop and Medicomms by Armour are trademarks of Armour Communications Limited.
