THE OFFICIAL BLOG OF THE SBS DIVA

Suppose you installed the biggest, strongest, most secure lock in the world on your front door, but you put the key under the front door mat. It wouldn't really matter how strong the lock is, would it? The critical factor would be the poor way the key was protected, because if a burglar could find it, he'd have everything he needed to open the lock. Encrypted data works the same way—no matter how strong the crypto algorithm is, the data is only as safe as the key that can decrypt it.

Many operating systems and cryptographic software products give you an option to store cryptographic keys on the computer. The advantage is convenience – you don't have to handle the key – but it comes at the cost of security. The keys are usually obfuscated (that is, hidden), and some of the obfuscation methods are quite good. But in the end, no matter how well-hidden the key is, if it's on the computer it can be found. It has to be – after all, the software can find it, so a sufficiently-motivated bad guy could find it, too. Whenever possible, use offline storage for keys. If the key is a word or phrase, memorize it. If not, export it to a floppy disk, make a backup copy, and store the copies in separate, secure locations. (All of you administrators out there who are using Syskey in "local storage" mode—you're going to reconfigure your server right this minute, right?)

I forgot to bring up Law number 7 in our discussion of Alice and Bob trying to email one another.... and it relates to our choices.  The choices of where that  decryption key is stored.  This reminds me of what we do with backups.  Placing the storage of the key...or a backup tape.....or whatever on the same site as the very thing you are trying to secure puts that 'thing' at risk.  You must make sure that you protect offsite the thing that is key to the security of your network.

Oh and can you make sure that where you keep that offsite storage location secure as well?  Because that location's security also affects your security as well.

Location...location...location.... remember... it's all about that security of the location.