Data makes the financial world go round – meaning that protection of that data is paramount. From cybersecurity frameworks to information security to privacy, firms are expected to maintain high standards of defense to mitigate potential risk and support market integrity.
A core aspect of security is applying encryption processes to shield data from unauthorized view. Encryption ensures that readable data is transformed into an unreadable, coded format so that only those who are meant to see it can obtain access. Considering how often data is transferred and in transit within institutions and between third parties, end-to-end encryption features allow data to remain safe.
When implementing solutions to safely manage and handle sensitive data, firms should be inquiring about the thoroughness of encryption processes, as well as ensuring that the right security hardware is in place to support data protection end-to-end.
The encryption playbook
End-to-end protection and verification
Encryption should be continuous, from the moment data enters a system to the time it departs. The National Institute of Standards and Technology (NIST), which has previously worked with financial regulators on outlining risk frameworks applicable to the industry, has recommended cryptographic standards organizations can follow to maintain high levels of security, including encryption standards.
Global Relay ensures that messages are encrypted once they enter the archive environment, and before any other processing occurs. This is particularly important when large volumes of messages are sent, if a message is corrupt, or if there are any other transient issues within the processing pipeline. Encrypting messages on receipt ensures that they are never accessible at any point.
While processing messages, we determine their signature hash values, which is a digital fingerprint that confirms the integrity of each message. Messages are then extracted, and any associated metadata is enriched so that messages are structured for searchability. Finally, we re-encrypt messages using a key specifically made for each customer, which support cryptographic separation and prevents unauthorized access.
Hardware security modules
Encryption protections are a non-negotiable, though are only effective when encryption keys are properly managed. To address this, Global Relay has invested in hardware security modules (HSMs) and implemented industry best practices for key management.
A HSM is a tamper-resistant device for securely generating, storing, and managing cryptographic keys, and performing sensitive operations in a protected environment. It offers secure key generation and storage, hardware-accelerated cryptography, and enforces strict key usage policies.
Messages are encrypted with a symmetric key, which can perform both encryption and decryption. This symmetric key is also encrypted using an RSA public key, which encrypts data. Then an RSA private key, which allows for decryption, is securely stored within the HSM.
When decryption is needed, the encrypted symmetric key is sent to the HSM, which decrypts it so the message can be accessed. This design ensures private keys never leave the HSM, making it extremely difficult to decrypt messages from a remote location.
The Financial Services Information Sharing and Analysis Center (FS-ISAC) outlined how firms can protect financial data with encryption controls, highlighting that HSMs add layers of safety and provide a critical level of threat management.
Hardware security modules versus software key management
The primary alternative to HSMs is software key management. With software key management, keys are generated and used within software (such as in application configuration or databases). The protection of these keys often relies on encryption at rest and Operating System level access controls. A master key may be used to wrap other keys, but that master itself lives in software.
While this approach is often used within the industry, it presents security gaps that could weaken protection. For example, there is a higher potential for insider threats, as admins and developers have access to production environments, allowing them to easily access encrypted data.
Since keys are stored in memory, it’s also easier for malware to bypass software-level protections. Due to a lack of central control, key backups may be mishandled, exposing plaintext keys in source code repositories or logs. Therefore, if a system is breached, attackers can extract keys from memory, disk, or backups.
With HSMs, it is possible to specify the allowed usage for every key and to keep a detailed log of where each key was used. In software key management, keys are just files or objects that can be copied, modified, or leaked without detection. Overall, it can be difficult to achieve compliance without hardware-backed key management systems – especially when it comes to the storage of sensitive data.
Keyed into compliance with complete encryption
When evaluating recordkeeping solutions, encryption protections and HSMs should be high priority items when conducting due diligence processes to ensure data integrity, regulatory compliance, and long-term risk mitigation. End-to-end encryption ensures that data stays secure throughout all phases of its lifecycle and is the golden key to maintaining security in a landscape of advancing threats.
Comprehensive encryption processes and hardware uphold data protection, which strengthens security and maintains regulatory compliance. Explore Global Relay’s security strategy and how we can seamlessly empower your firm to safeguard communications data.
