How can you design a system architecture to protect data across domains and levels of classification?

1 Encryption basics

Encryption is the process of transforming data into an unreadable format using a secret key, so that only authorized parties can decrypt it and access the original information. Encryption can be applied to data at rest, in transit, or in use, depending on the level of security and performance required. There are two main types of encryption: symmetric and asymmetric. Symmetric encryption uses the same key for both encryption and decryption, while asymmetric encryption uses a pair of keys: one public and one private. The public key can be shared with anyone, but the private key must be kept secret.

2 Encryption standards

To ensure the interoperability, compatibility, and quality of encryption solutions, there are various standards and protocols that define the algorithms, formats, and procedures for encryption and decryption. For example, Advanced Encryption Standard (AES) is a popular symmetric encryption standard that supports 128, 192, or 256-bit keys and is considered one of the most secure and efficient algorithms. Other widely used encryption standards include RSA, which is an asymmetric encryption standard used for digital signatures, authentication, and key exchange; Secure Sockets Layer (SSL) and Transport Layer Security (TLS), protocols that provide encryption and authentication for data in transit over networks; as well as Pretty Good Privacy (PGP) and GNU Privacy Guard (GPG), software applications that use asymmetric encryption to encrypt and decrypt data at rest.

3 Encryption best practices

Designing a system architecture that can protect data across domains and levels of classification requires following some encryption best practices. You should use strong encryption algorithms and keys that meet the security requirements and standards of your data and system, and avoid using outdated or weak encryption methods. Different keys should be used for different data sets, domains, and classifications, stored securely in separate locations, and rotated periodically to prevent compromise or exposure. Encryption should be used throughout the data lifecycle, from creation to deletion, encrypting data at rest, in transit, and in use. Additionally, encryption should be part of a comprehensive data protection strategy that is complemented by other security measures such as access control, auditing, backup, recovery, and deletion.

4 Encryption challenges

Encryption can provide a high level of data protection, but it is important to be aware of some of the challenges and limitations it poses. Encryption can affect the performance, usability, and functionality of your system and data, potentially increasing processing time, storage space, and bandwidth consumption while reducing speed, availability, and accessibility. Additionally, encryption can interfere with some data operations, such as indexing, searching, or analyzing. Furthermore, it can introduce new risks and vulnerabilities to your system and data such as key theft or key management errors. It also has the potential to create new compliance and legal issues. Lastly, encryption can require additional resources and expertise to implement and maintain which can increase the complexity, cost, and maintenance of your system and data.

5 Encryption resources

Designing a system architecture that can protect data across domains and levels of classification can be aided by encryption resources, such as those provided by the National Institute of Standards and Technology (NIST). This federal agency offers guidelines, recommendations, and standards for encryption and cryptography, like the Federal Information Processing Standards (FIPS) and the NIST Special Publications (SP). The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) are two international organizations that develop and publish standards for encryption and cryptography, such as the ISO/IEC 27000 series and the ISO/IEC 19790 series. Additionally, the Open Web Application Security Project (OWASP) is a non-profit organization that provides resources and best practices for encryption and security of web applications, like the OWASP Cheat Sheets and the OWASP Top 10. Finally, the Crypto Forum Research Group (CFRG) is a research group within the Internet Research Task Force (IRTF) that provides analysis and guidance on encryption and cryptography for the internet community, like the RFCs and the CFRG mailing list.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?