Encryption is one of the most important features of the DoD CMMC framework, as well as any healthy cybersecurity posture. Every organization should deploy encryption across all systems which store, process, or transmit potentially sensitive information. Not only is encryption of all controlled unclassified information (CUI) pertaining to the Department of defense mandatory – it will also protect your business from costly data breaches and other incidents.
Reaching a higher CMMC compliance level will let you bid on more lucrative contracts with the DoD, including those which involve working with CUI. In fact, any organization that handles CUI needs to reach Level 3 at the least, which is the recommended level to aim for if you’re just starting out on your CMMC compliance journey. Furthermore, CMMC Level 3 mandates encryption across several areas, including the following:
- Encryption of wireless network traffic (AC.3.012)
- Encryption of remote access sessions (AC.3.014)
- Encryption of CUI on mobile systems (AC.3.022)
- Encryption of passwords (IA.2.081)
- Encryption of CUI on digital media during transport (MP.3.125)
- Encryption of systems for network device management (SC.2.179)
What is encryption, and how does it work?
Encryption encodes information so that it can only be viewed by specific individuals. It uses an algorithm to encrypt the data, which can then only be decrypted with the correct decryption key. Today’s encryption engines are highly sophisticated and practically impossible to crack without somehow finding out the key, which hackers usually do with social engineering tactics. Although this means encryption isn’t fool proof, it does mean that it’s completely secure from a technical perspective.
The Federal Information Processing Standards (FIPS), developed by NIST, form the basis of the encryption requirements in the DoD CMMC framework. Encryption standards which have been approved for use in the protection of CUI include the Data Encryption Standard and the Advanced Encryption Standard (AES). AES-256 encryption, for example, uses a 256-bit key for encrypting and decrypting information. That means there are 2255 possible keys. Even all the computers in the world trying out every possible key would take longer than the age of the universe to break such encryption.
The importance of end-to-end encryption of CUI
If you transmit CUI on behalf of the DoD, the data must be protected by end-to-end encryption. This ensures the data is scrambled on the sender’s device and never decrypted until it reaches the intended recipient. This protects all outgoing communications and makes it impossible, for example, for hackers to steal information in transit. Even if attackers are able to intercept the data, they will be unable to use it.
End-to-end encryption is addressed in several CMMC domains: Access Control, Configuration and Management, Media Protection, Systems and Information Integrity, and Systems and Communications Protection.
Encrypting user activity logs
To achieve and maintain compliance with the DoD CMMC framework, it’s essential that data processors track all user activities involving the handling of CUI and other sensitive data. This provides security administrators and compliance officers complete oversight over their security infrastructure, and allows them to trace potentially malicious activities. With this audit trail, they can remediate against security holes and continuously improve their security infrastructure.
Naturally, these logs contain sensitive information themselves, which could be exploited by an attacker to find potential vulnerabilities in your security architecture. Moreover, attackers may try to delete logs to cover their tracks. These reasons are why activity logs must be encrypted to, in line the requirements of the CMMC domain Audit and Accountability.
Protecting access with key-based authentication
Passwords have long played a central role in cybersecurity. However, relying entirely on them poses a significant risk, even if you do have a robust password policy. Passwords are routinely targeted by social engineering scammers and then used for gaining unauthorized access to a system or escalating privileges. That’s why it’s important to verify user identities with an extra authentication factor, such as a private key which is stored only on the user’s device. Another benefit of key-based access is that device-based keys protect systems against remote access attacks.
Key-based authentication is covered by CMMC domains Identification and Access, System and Communications Protection and Systems and Information Integrity.
Final words
All sensitive data should be encrypted whether at rest or in transit. Encrypting all data per the standards provided by FIPs will ensure your organization stays in compliance, while protecting its own assets from the continuing threat of cyberattacks.
Charles IT provides full endpoint encryption, external vulnerability scanning, and other security services in line with the DoD CMMC framework. Contact us today to schedule a consultation.
