|
Server : Apache/2.4.62 System : FreeBSD fbsdweb2.web.rcn.net 14.1-RELEASE FreeBSD 14.1-RELEASE releng/14.1-n267679-10e31f0946d8 GENERIC amd64 User : www ( 80) PHP Version : 8.3.8 Disable Function : NONE Directory : /domains/ap.belleisle/INFOSEC/ |
Upload File : |
<HTML>
<HEAD>
<TITLE>FORENSIC SOFTWARE COUNTERMEASURES</TITLE>
<META NAME="description" CONTENT="Cerberus Systems, Inc. develops, manufactures and markets Windows� cryptosystems designed to meet or exceed level 1 of FIPS PUB 140-1 with DOD 5220.22-M disk data recovery countermeasures.">
<META NAME="keywords" CONTENT="ANSI X9.17, computer security, cryptosystem, data privacy, DOD 5220.22-M, encryption, file wiping, FIPS 140-1, forensic software, INFOSEC, sanitizing, security leaks, secure deletion, security software, triple-DES, zeroizing, Windows�.">
</HEAD>
<BODY TOPMARGIN="0" LEFTMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0" BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#009966" ALINK="#FF0000" VLINK="#009966">
<BASEFONT SIZE=2 FACE="Arial,Helv,Helvetica">
<TABLE ALIGN=LEFT BORDER=0 CELLSPACING=0 CELLBORDER=0 CELLPADDING=12 WIDTH=640>
<TR>
<!-- LEFT MARGIN STRIP -->
<TD BGCOLOR="#336666" ALIGN=CENTER VALIGN=TOP>
<FONT SIZE=1>
<a href="../default.htm"><IMG SRC="images/web_icon.gif" ALT="CERBERUS HOME ICON" WIDTH=72 HEIGHT=72 BORDER=0 VSPACE=2><br><b><i>CERBERUS</i></b></a>
<P><a href="index.htm""><IMG SRC="images/needs.gif" ALT="THE NEED" WIDTH=90 HEIGHT=30 BORDER=0></a><br>
<a href="privacy.htm">Vulnerabilities</a>
<a href="threats.htm">Threats</a>
<a href="forensic.htm"><FONT COLOR="#00CC99">Countermeasures</FONT></a>
<P><a href="products/index.htm""><IMG SRC="images/products.gif" ALT="PRODUCTS" WIDTH=90 HEIGHT=30 BORDER=0></a><br>
<a href="products/docusec.htm">Document Security</a>
<P><a href="stds/index.htm"><IMG SRC="images/standard.gif" ALT="STANDARDS" WIDTH=90 HEIGHT=30 BORDER=0></a><br>
<a href="stds/fip140-1.htm">FIPS PUB 140-1</a><br>
<a href="stds/sanitize.htm">DOD 5220.22-M</a><br>
<a href="stds/ncsctg25.htm">NCSC TG-25</a> <br>
<a href="stds/fip81.htm">FIPS PUB 81</a> <br>
<a href="stds/fip180-1.htm">FIPS PUB 180-1</a><br>
<a href="stds/d520028.htm">DOD 5200.28-STD</a><br>
<P><a href="tutorial/index.htm"><IMG SRC="images/tutorial.gif" ALT="TUTORIALS" WIDTH=90 HEIGHT=30 BORDER=0></a><br>
<a href="tutorial/winfosec.htm">INFOSEC</a><br>
<a href="tutorial/keys.htm">Cryptosystems</a><br>
<a href="tutorial/phrases.htm">Passphrases</a><br>
<a href="tutorial/leaks.htm">Windows� Leaks</a><br>
<a href="tutorial/system.htm">System Settings</a>
<P><a href="download/index.htm"><IMG SRC="images/download.gif" ALT="DOWNLOADS" WIDTH=90 HEIGHT=30 BORDER=0></a><br>
<P><HR WIDTH=84>
<P><a href="mailto:[email protected]">QUESTIONS?
<br><IMG SRC="images/email2.gif" ALT="E-MAIL" WIDTH=61 HEIGHT=31 BORDER=0></a><br>
<P><br><IMG SRC="./images/amex_ok.gif" ALT="AMEX WELCOME" WIDTH=51 HEIGHT=68 BORDER=0>
</FONT>
</TD>
<!-- END LEFT MARGIN STRIP -->
<!-- MAIN SECTION -->
<TD ALIGN=LEFT VALIGN=TOP>
<!-- Title Bar -->
<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=0 WIDTH=500>
<TR><TD>
<!-- Right-justified Logotype -->
<TABLE ALIGN=RIGHT BORDER=0 CELLSPACING=0 CELLPADDING=0>
<TR><TD><FONT COLOR="#006633" SIZE=3><B><I>CERBERUS <FONT SIZE=1>SYSTEMS, INC.</FONT></I></B></FONT></TD></TR><TR><TD ALIGN=CENTER><FONT COLOR="#999933" SIZE=1><B><I>
<!--forensic software countermeasures-->
<!--INFORMATION SECURITY TOOLS-->
<!--INFOSEC for Personal Computers-->
<!--INFOSEC Products for Windows®-->
<!--INFOSEC Tools for PCs & Laptops-->
<!--personal information security tools-->
Windows®-compatible encryption
</I></B></FONT></TD></TR>
</TABLE>
<!-- End Logotype -->
</TD></TR>
<TR ALIGN=CENTER><TD WIDTH=490>
<!-- Centered Page-Title -->
<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=10>
<TR><TD ALIGN=CENTER><FONT COLOR="#CC3300" SIZE=5><B>
<!-- Title Text-->
FORENSIC SOFTWARE<BR>
<FONT COLOR="#999933" SIZE=4><i>COUNTERMEASURES</i>
<!-- End Title Text -->
</B></FONT></TD></TR>
</TABLE>
<!-- End Page-Title -->
</TD></TR></TABLE>
<!-- End Title Bar -->
<!-- Content -->
<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=506>
<TR><TD><FONT SIZE=2>
<FONT SIZE=2>
<P>Any software claiming to cryptographically protect your data should use a <i>cipher</i> (encryption algorithm) that meets public standards, and has an extensive history of independent cryptanalytic validation. Its key-size should place its <i>workfactor</i> ("cracking" resistance) well beyond the limits of today's export controls (and of computing power increases expected over the lifetime of its encrypted <i>ciphertext</i>).
<P>In addition, however, its implementation should meet the standards for that cipher's strongest operating modes, so as to provide a cryptanalytically secure <i>cryptographic engine.</i> Most importantly, the complete software <i>cryptosystem</i> in which the engine is embedded (<i>not</i> just the engine) should meet (and pass the <FONT SIZE=1><b>DERIVED TESTS</b></FONT> for) NIST's <B><FONT COLOR="#006633">FIPS PUB 140-1,</FONT> <FONT SIZE=1>SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES</FONT>.</B>
<P>Clearly, a Windows� cryptosystem should meet this standard <i>while operating under Windows�.</i> But, even the strongest lock is useless if it can be bypassed, so such a cryptosystem should <i>also</i> include specific functions to plug Windows� security leaks. These <FONT COLOR="#006633"><b><i>forensic software countermeasures</i></b></FONT> should be seemlessly integrated; be clearly identified; and require minimal user-intervention for their effectiveness.
<P><HR SIZE=1 WIDTH=50%>
<P>Many encryption software products, though they encrypt with strong ciphers, do not include such functions. They were designed for e-mail COMmunications SECurity between secure systems, rather than secure data <i>storage</i> on unsecure systems. Their ciphertext doesn't have to be "cracked;" un-encrypted <i>plaintext</i> is available.
<P>Some (such as PGP for Windows�) don't contain functions to prevent Windows� from ignoring their attempts to securely overwrite discarded plaintext files. Others (such as the DOS version of PGP) do contain such functions, but Windows 95� ignores their 16-bit cache-flushing calls, anyway. Most do nothing to eradicate the copies of your passwords or encryption keys in the Windows� swapfile, or the "temporary" copies of your plaintext files that Windows� makes every time you print them, in disk clusters that are merely unlinked ("deleted") and left available on the disk for forensic recovery.
<P><FONT COLOR="#006633"><b><i>Meeting independent standards</i></b></FONT> and <FONT COLOR="#006633"><b><i>plugging Windows� security leaks</i></b></FONT> makes the difference between Windows�-<WBR>compatible software designed to encrypt copies of data for communication, versus software cryptosystems specifically designed for its secure storage on PCs or laptops through truly <FONT COLOR="#999933"><b><i>Windows�-<WBR>compatible encryption.</i></b></FONT>
<P><HR SIZE=1 WIDTH=50%>
<P>The type of software-based "data recovery" attacks mounted by forensic software may be defeated by <i>Sanitizing</i> (or even <i>Clearing</i>) per <FONT COLOR="#006633"><b>DOD 5220.22-M</b></FONT>. However, files can be of any number of bytes, while Windows� can only address disk space in <i>clusters</i> of 512-byte <i>sectors,</i> whose unoccupied remainders can contain sensitive plaintext.
<P>Consequently, forensic software countermeasures should include functions to
<BLOCKQUOTE>
(1) Clear previously deleted data from all unallocated clusters on a drive (<i>disk slack</i>) - automatically on exit for whichever drive Windows uses for the TEMP space into which it leaks non-zeroized printer spooling files, unless the TEMP space has been configured on a RAM drive;
<P>(2) Clear the tails of all existing files on a selected drive (<i>file slack</i>), to eradicate deleted data held in subsequently reallocated clusters (any file written to disk by the encryption software should have its tail Cleared automatically, in order to zeroize RAM buffer scavanging leaks);
<P>(3) Clear the internal slack space (not just the tails) of all compound files created by MS Word�, MS Excel� and similar application programs (<i>OLE container slack</i>), to eradicate deleted data captured in the interiors of such files - automatically as part of the operation to Clear file slack;
<P>(4) Clear the <i>entire</i> swapfile (not just the unallocated clusters from those virtual memory <i>pages</i> which Windows� has released at the moment), in order to eradicate non-zeroized object leaks - automatically on exit;
<P>(5) Sanitize all unallocated clusters on a drive, for disposal of hard disks (or floppy diskettes prior to destruction) from which all files have been deleted; and
<P>(6) Sanitize <i>all</i> disk sectors occupied by any sensitive plaintext file to be discarded, including the file's tail (to be performed automatically on plaintext after encryption, using the larger of the plaintext file's current size or its size at last decryption, to counter file-editing deletion leaks);
</BLOCKQUOTE>
<P>Functions (1), (2) and (3), and (4) should be used to Clear the drive of a PC or laptop meant to be recycled to other users without having to re-install all the software on it.
<P>Function (5) should be used for <i>purging</i> hard disks classified as
less-than-Top Secret (<i>not</i> DoD Classified floppy diskettes, which should be destroyed per DOD 5220.22-M).
<P>Function (6) must be implemented with full understanding of the idiosyncracies of the operating system layers between the file-manipulating commands at the Application Programmimg Interface and the actual performance of disk overwriting, to prevent Windows� from ignoring intended overwrites and instead merely "deleting" the file.
<P>Cerberus Systems, Inc. offers standards-compliant cryptosystems that incorporate all of the above-listed forensic software countermeasures and are designed for the secure storage of sensitive data on Windows� PCs and laptops. <a href="products/index.htm"><IMG SRC="images/web_next.gif" BORDER=0></a>
</FONT></TD></TR>
</TABLE>
<!-- End Content --->
<!-- Standard Footer --->
<CENTER>
<P><BR>
<FONT SIZE=2 COLOR="#006633"><B><i>
Cerberus Systems, Inc. develops, manufactures and markets<BR>
software cryptosystems designed to level 1 of FIPS PUB 140-1<BR>
with DOD 5220.22-M disk data recovery countermeasures.
</i></B></FONT>
<P><HR SIZE=1>
<FONT SIZE=1 COLOR="#CC3300">
The Cerberus logo and the <i>...Security Manager</i> product names are trademarks of Cerberus Systems, Inc.<BR>
© Copyright 1997-99, all rights reserved.
</FONT>
<HR SIZE=1>
</CENTER>
<!--- End Standard Footer --->
</TD>
<!-- END MAIN SECTION -->
<!-- PADDING CELL -->
<TD>
<!-- right margin = 2 x cellpadding -->
</TD>
<!-- END PADDING CELL -->
</TR>
</TABLE>
</BODY>
</HTML>