Sidebar
This is an old revision of the document!
Table of Contents
2.3.4.2.3 Data-In-Use
Overview
Data-in-Use covers data being processed (i.e., updated, processed, erased, accessed or read) by a system. Data-In-Use is not passively stored, but is actively moving through parts of a Computing Platform. Data-In-Use is one of three states of digital data – the other states are Data-at-Rest and Data-in-Motion.
Data states are used by information security professionals to identify Endpoints where data should be encrypted. In addition to encryption, some important ways that Data-In-Use is protected include user authentication at all stages, strong identity management and well-maintained permissions for profiles within an organization.
Examples of Data-In-Use include data stored or processed in Random Access Memory (RAM), Datastores or CPUs. Requesting access to transaction history on a banking website or authorizing user login input are applications of Data-In-Use.
Datatype Issues for Data-In-Use
Security of Data-In-Use
Due to Data-In-Use being directly accessible by one or more users, data in this state is vulnerable to attacks and exploits. Additionally, security risks become greater as the permissions and devices increase. Oftentimes, Data-In-Use can contain digital certificates, Encryption keys, and Intellectual Property (IP) which make it crucial for businesses to monitor. Common practices for protecting Data-In-Use are defined under Securability and include:
| Physical Security | Physical Security is essential while data is being processed. Often, the Cipher Data is decrypted to Plaintext during processing. The decrypted data can leave residues behind in on-line and off-line storage, as well as in memory after the processing is complete. Therefore, when it is not possible to guarantee physical security, steps be taken to prevent: |
|---|---|
| Data Security | Data Security is the process of protecting data from unauthorized access and data corruption by using a Encryption Algorithm to encrypt data throughout its lifecycle especially while the data is in use. Encryption can be any combination of Hashing, tokenization, and Key Management practices that protect data across all Applications and Platforms. With the rise of Decentralized and Distribute systems, it is no longer possible to trust all the parts of a Software Stack and Solution Stack especially devices such as: Network Device, Mobile Device, Peripheral Device, or Storage Device, Web Service. Also, each Web Service also represent a stack of more components, such as: Apache CloudStack, LAMP (Linux, Apache, MySQL, PHP/Perl/Python) , Oracle Cloud Stack , Web Service Protocol Stack. Each of these components, the connections and the Network devices represent a risk, especially when Instrumentation for monitoring of the component is added to the mix. For example, using a Debugger tool is useful during development for observing the state of the component, but those features leave vulnerabilities for exposing sensitive information. See MITRE Common Weakness Enumeration (CWE) list. The following are approaches to helping solve some of these problems:
|
| Network Security | Network Security covers all Network Device and is an over-arching term describing the policies and procedures implemented by a network administrator to avoid and keep track of unauthorized access, exploitation, modification, or denial of the network and network resources. This means that a well-implemented network security blocks viruses, Malicious Software (Malware), hackers, etc. from accessing or altering secure information. Many of these goals can be achieved by having: |
| Platform Security | Platform Security is the security architecture covering Hardware (H/W), and Software (SW) for the entire Computing Platform Stack, including: Hardware Platform, Operating System Platform, Runtime Platform, and Network Platform. Many of these goals can be achieved by considering:
|
| Application Security | Application Security is the Business Process of developing, adding, and testing security features within applications to prevent security Vulnerabilities against cyberthreats such as unauthorized access and modification. Application Security describes security measures in the Application that aim to prevent data or code within the Application from being stolen or hijacked. It encompasses the security considerations that happen during application development and design, but it also involves systems and approaches to protect Applications after deployment. Application Security covers Hardware (H/W), Software (SW), and Business Processes to minimize security Vulnerabilities. Application Security also covers any security measures added-to or integrated-into the Appication. For example, the use of a Software Firewall.
|
| Securty Culture | CyberSecurity Culture (CSC) CyberSecurity Culture (CSC) of organizations refers to the knowledge, beliefs, perceptions, attitudes, assumptions, norms and values of people regarding Cybersecurity and how these manifest in people’s behavior with information technologies. CyberSecurity Culture (CSC) is about making information security considerations an integral part of an employee’s job, habits and conduct, embedding them in their day-to-day actions. Some common tools to help create a good Securty Culture are: |
| Data Logging | Data Logging (also known as Logging) is the process of creating a Log which is the automatically production of time-stamped documentation for events relevant to a particular system. There are many tools available to help with Logging, some are Technical Standards and some are de facto Standards:
|
| Access Control | Access Control defines a set of controls restricting access to resources based on the group membership, identity, clearance, physical & logical location and need-to-know. In addition, access includes method of permission to consume, enter, control, restrict, use and protect the resource to guarantee: Availability, Confidentiality, and Integrity. Some of the more traditional resources requiring Access Control are: Memory and Storage, Peripheral Device, Central Processing Unit (CPU), Heap Memory, Stack Memory, Non-Volatile Storage (NVS), and Network Interface Card (NIC). Many of these goals can be achieved by considering: |
| Inentification, Authetication and Authorization | Identification, Authentication, and Authorization Protecting rest is far easier than protecting Data-in-Use. The best way to secure data in use is to restrict access by user role, limiting system access to only those who need it. Even better would be to get more granular and restrict access to the data itself. Protect against evolving data security threats Full memory encryption Encryption, which prevents data visibility in the event of its unauthorized access or theft, is commonly used to protect Data in Motion and Data at Rest and increasingly recognized as an optimal method for protecting Data in Use. There have been multiple projects to encrypt memory. Microsoft Xbox systems are designed to provide memory encryption and the company PrivateCore presently has a commercial software product vCage to provide attestation along with full memory encryption for x86 servers. Several papers have been published highlighting the availability of security-enhanced x86 and ARM commodity processors. In that work, an ARM Cortex-A8 processor is used as the substrate on which a full memory encryption solution is built. Process segments (for example, stack, code or heap) can be encrypted individually or in composition. This work marks the first full memory encryption implementation on a mobile general-purpose commodity processor. The system provides both confidentiality and integrity protections of code and data which are encrypted everywhere outside the CPU boundary. For x86 systems, AMD has a Secure Memory Encryption (SME) feature introduced in 2017 with Epyc. Intel has promised to deliver its Total Memory Encryption (TME) feature in an upcoming CPU. CPU-based key storage Operating system kernel patches such as TRESOR and Loop-Amnesia modify the operating system so that CPU registers can be used to store encryption keys and avoid holding encryption keys in RAM. While this approach is not general purpose and does not protect all data in use, it does protect against cold boot attacks. Encryption keys are held inside the CPU rather than in RAM so that data at rest encryption keys are protected against attacks that might compromise encryption keys in memory. Enclaves Enclaves enable an “enclave” to be secured with encryption in RAM so that enclave data is encrypted while in RAM but available as clear text inside the CPU and CPU cache. Intel Corporation has introduced the concept of “enclaves” as part of its Software Guard Extensions. Intel revealed an architecture combining software and CPU hardware in technical papers published in 2013. Cryptographic protocols Several cryptographic tools, including Multi-Party Computation (MPC) (sometines referred to as Secure Multi-Party Computation (SMPC)) and homomorphic encryption, allow for the private computation of data on untrusted systems. Data in use could be operated upon while encrypted and never exposed to the system doing the processing. |
