After the recent Salt Typhoon attack, which infiltrated U.S. telecommunication companies, the US government urged individuals and enterprises to implement end-to-end encryption to safeguard confidentiality, ensure data integrity, and minimize data exfiltration.
For CISOs, this raises an important question: Is your phone system ready to support end-to-end encryption requirements?
We at Continuant have created a three-step guide to help you assess the readiness of your communication platform for end-to-end encryption. Following these steps will help protect you from Salt Typhoon attack while preserving confidentiality and integrity of your communication session.
Encryption capabilities vary by manufacturer and firmware level. Here's a spectrum from worst to best-case scenarios:
Organizing this in a matrix, like the one below, will help you track whether any critical elements are missed.
Popular enterprise communication platforms include Avaya, Cisco, and Microsoft Teams. After consulting with our engineers, here’s a high-level assessment of these platforms:
Based on your findings from the previous steps, the final step is to create a plan that aligns with your risk appetite. Instead of waiting for the perfect moment when all conditions align, adopt Theodore Roosevelt's mindset: "Do what you can, with what you have, where you are." Progress is incremental, and something is still better than nothing.
If encryption is not supported or unavailable for certain parts of your infrastructure, consider implementing compensating controls to reduce the impact.
If you're not sure how to assess or requires assistance to enable end-to-end encryption, reach out to Continuant. Our engineers can assess your current infrastructure and recommend the best options moving forward.
This incident may be the final straw before that long-anticipated system migration. The threat is real now, and a full upgrade to a cloud solution with more robust security is more necessary than ever.
In short, follow these three steps, and you’ll more prepared to minimize the potential damage caused by Salt Typhoon attack.