2

We have an app running where among other things people can send messages to each other. Obviously admins and content managers that have access to CMS can see what people are sending to each other. Is this usually encrypted and if yes, how, with what encryption?

UPDATE

The entire site is SSL encrypted, I'm specifically talking about admins being able to read users' messages between themselves. Sure, we can prevent certain admins to have access to that, but to be honest I would like to even hide it from the super admin with encryption. But then, in case one needs to read those for any purpose, how to decrypt them, how to structure the admin protocol for that?

  • The problem with encryption is where to store the key. – CodesInChaos Jan 7 '14 at 10:06
6

We have no way of knowing.

What needs to be done is:

  • Identify the risks arising from this vulnerability. (What bad things might your admins do? What bad things might other people be able to do if the messages are not encrypted?)
  • Assess the severity of these risks.
  • Decide if these risks are acceptable or if they must be treated.
  • Identify suitable ways of treating these risks.
  • Treat the risks.

To do all that requires a good understanding of what your app is used for, what your customers want, what the law requires of you, what your contractual obligations are, what resources you have available, what security capabilities are in your infrastructure, and what level of risk your business finds acceptable.

Not the kind of answer you hoped for, I fear, but if security is important then you need to make good, informed decisions about it.

  • I would also include "what commitments have we made to our customers" to your list. If your T&Cs state that communications are protected or put "Secure" in the name or description of your product, have a responsibility to live up to that. – u2702 Jan 3 '14 at 19:55
  • @Graham Hill: I understand your comment and have updated the question. What encryption / decryption tools and protocols can be used to even hide the messages from super-admin in most of the usual cases. – Ska Jan 6 '14 at 23:30
1

Yes, you should encrypt any messaging -or data transfer- algorithm. Depending on the size of the company, you may find it over pricey to add encryption to your code, which is understandable. However, this is not a good practise.

Basically, an insider could easly sniff the packets and read the messages, which may be about critical business data, or somebodies secret crush ect... Either way it would cause a lot of headaches...

Also an outsider could sniff too... It doesn't has to be perfect, but some encrytion is needed. If you use secret keys, you can log them at someplace, or make them get generated by using time and username, so that; when needed admins may read the texts.

  • What sort of encryption / decryption technologies are commonly used? – Ska Jan 6 '14 at 23:34
  • Well it depends on many things... For example is there going to be a server, which could handle the keys? Or is it a more simple app where if A and B are chatting, A becomes server B becomes client? I would suggets, give each user a public and private key and go with it... Like RSA or something... Or you can use IDEA or Blowfish since they are free... Or even write your own! en.wikipedia.org/wiki/List_of_algorithms#Cryptography – cengizUzun Jan 7 '14 at 13:14
  • 1
    cengizUzun's comment about "even write your own encryption algorithm" is very bad security advice. As Schneier said, "it's very easy to design crypto you can't break. It's very hard to design crypto nobody else can break." – atk Jan 7 '14 at 15:23
  • @atk I agree...sorry for the mislead, I misexplained myself... I wanted to say it like, even write your own but don't leave it without encryption... which is still a bad advise probably – cengizUzun Jan 8 '14 at 11:45
  • @cengizUzun: ah, so you mean write your own implementation of a standard algorithm. I totally didn't get that :-) And, yeah, that's risky, too, since it's so easy to introduce a critical flaw by accident and at least standard implementations are well tested. – atk Jan 8 '14 at 12:29
1

A second answer since it's now a quite different question: what controls can I implement to prevent admins from reading users messages for illegitimate reasons, while retaining their ability to read messages for legitimate reasons. This is a hard problem.

Some approaches you can investigate:

First, the simple one. Tell your admins that they will be fired if they are naughty. Mean this, and make sure HR and management mean this, and make sure your admins all believe you mean this. Make them sign scary documents. Remind them regularly.

Second, implement segregation of duties. You'll need a split-key encryption scheme where it requires two admins (or and admin and a manager) working together to decrypt a message.

Third, implement ruthless change control. Log everything every admin does. Audit it regularly. (Because there are other ways to get at the messages besides getting the key.)

Much of this will be expensive and all of it will tell the admins you don't trust them, so make sure the value of the messages justifies it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.