.svg "Layer_1 (1)"){kind=small}
.png)
.svg)
.svg)
.svg)
.png?width=2000&height=1005&name=Market%20-%20Tank%20(3).png)
Advanced Data Recovery Protection
Ensuring data edge is protected against sophisticated threat actors
Evolving mission requirements and technical innovation has resulted in the proliferation of devices at the edge. These devices will collect, process, and store sensitive data that will be vulnerable if adversaries gain physical access.
Sophisticated actors can employ advanced data recovery (ADR) techniques and technology to defeat protection measures.
Cigent Secure Storage Solutions utilize layered data protection utilizing proven methodologies and patented technologies to stopADR.
Cloning
Typically utilized when an actor has physical access, it utilizes COTS or open-source software (e.g., EaseUS, DD, Clonezilla). The software creates an exact copy of the device’s hard drive, including the operating system, installed programs, and all data. Cigent prevents cloning by locking all data ranges. With hidden encrypted partitions data is secured even if a device is in use.
Low Pin Count (LPC) Bus Sniffing
Cigent PBA and encryption key management effectively defeats these attacks. The keys are not visible to intercept and recreate the recovery key to authenticate. This approach requires physical access to a device and is used when software full drive encryption is in place. An actor utilizes tools to gain key access by intercepting the communication between the LPC Bus and TPM Module.Cigent utilizes full drive hardware encryption where keys are not stored in the TPM. Additionally, PBA provides a separate secure authentication environment.
Hex Editors
A hex editor is a forensic tool that reads the binary data of a drive or file and displays the binary data in hexadecimal format. With a hexeditor, an actor can see or edit the raw and exact contents of a file, circumventing protections or identify gaps.Preboot Authentication prevents the hex editor from reading because the device is powered off and encrypted. If a hex editor is used, it won’t be able to read the data contained within a hidden partition.
Other attacks
A multitude of other attack vectors exist including remote attacks using living-off-the-land binaries and data recovery tools including WinSCP, Putty, SSH. Nation states and other advanced actors are continuing to develop new approaches.Cigent utilization of PBA and MFA complemented with advanced protection features including Hidden Partitions and Storage Embedded AI, prevents unauthorized access from any data recovery approach
.png?width=2000&name=Layout%201%20(1).png)
Cigent Protection
Protection for Data at the Edge
Clone and wipe
Cloning is the process of duplicating data from the hard drive which may also include data wiping. Various techniques exist with actors utilizing COTS or open-source software (e.g., EaseUS, DD, Clonezilla) to nearly instantly clone the hard drive and/or initiate wipe. Typically executed with physical access but can also utilize Bluetooth or other wireless connections.
Cigent protection: Hardware Full Drive Encryption, Hidden Partitions, and AI
Data in encrypted state is unreadable with all ranges locked, preventing data from being cloned or wiped. When device is at rest hardware full drive encryption with PBA prevents access. If the device is powered-on data stored in hidden partitions remains encrypted with locked ranges.
Additional protection is provided with Cigent embedded AI data monitoring that monitors access patterns and will instantly lock all data upon detection of cloning attempt.
.png?width=560&height=531&name=Rectangle%203%20(3).png)
Alternative OS Boot
Advanced actors may employ an alternative OS boot to circumvent encryption protection. The approach tricks the device into exposing encryption keys by interrupting the boot process with an alternative OS. Once the adversary gains access to the encryption keys the encryption protection is disabled.
Cigent Protection: PBA with MFA
Alternative OS Boot can be prevented using PBA. PBA provides a separate, secure environment for user to authenticate prior to booting device. This prevents the insertion of an alternative OS. PBA protection can be further enhanced utilizing Cigent MFA providing separate credentials to validate user authorization.
Hex Editors
A hex editor is a forensic tool that reads the binary data of a drive or file and displays the binary data in hexadecimal format. With a hex editor, an actor can see or edit the raw and exact contents of a file, circumventing protections or identify gaps.
Cigent: PBA and Hidden Partitions
Pre-boot Authentication prevents the hex editor from reading drives because the data remains encrypted and inaccessible. Additionally, when a device is in use, data stored within hidden partitions also remains unreadable with ranges locked.
Low Pin Count (LPC) Bus Sniffing
This type of data recovery technique requires physical access to a device. It is used when software full drive encryption has been employed. If an organization has not set up a second factor authentication method (e.g., a PIN) a threat actor uses tooling to gain key access by intercepting the communication between the LPC Bus and TPM Module.
Cigent Protection: PBA and Encryption Key Management
Cigent PBA and encryption key management effectively prevent these attacks. The keys are not visible to intercept and recreate the recovery key to authenticate.
Quantum Computing
While quantum computing has not been practically applied to defeat cryptography it is only a matter of time. There have been continuous improvements in stability and performance, including China’s 2024 announcement of a 504-Qbit chip that is claimed to be 180 million times faster than the fastest supercomputer. Quantum computing’s speed and ability factor large integers will inevitably significantly disrupt current crypto protection methodologies.
Cigent Protection: Partitions, AI, and Verified Data Erasure
Cigent provides the ability to create secure partitions that can only be accessed with step-up authentication. Those partitions are unreadable at the sector level even if an adversary gets direct physical or remote access and logs into the operating system.
Cigent has embedded AI in its Cigent Secure Storage that monitors data access patterns. This unique protection attempts to clone the drive and automatically locks thwarting a cloning attempt.
The only full-proof approach to ensuring data cannot be compromised by quantum is to ensure it is permanently erased. Cigent provide patented verified data erasure that scan block-by-block to ensure that all data is erased and forever unretrievable.
TAGLINE
The Cigent Advantage
Cigent is prepared to support your mission navigating the complex compliance requirements to protect data at the edge. Its solutions were developed for and with US Federal agencies with deep expertise in data protection. Cigent protections have been thoroughly tested and validated by leading Federal agencies including MITRE, NIST, NSA, NIAP, the Air Force, Cyber Resilience of Weapon Systems (CROWS), and NSSIF (UK).
To ensure availability and provide flexibility, Cigent works with leading drive manufacturers including Digistor, Kanguru, and Seagate and Cigent offers our own branded drives.
provide value to the visitor
Edge Computing Requires Edge Security: Best Practices for Protecting Sensitive Data at the Edge
Edge computing demands robust security to protect sensitive data from unauthorized ..
Disk Cloning and Data Destruction to Prevent Data Security Issues
Data destruction, data erasure, and disk cloning all play a role in data security--and ..
FIPS 140-2 & FISMA — Understanding Cybersecurity Compliance for Cryptography Modules
Understand FIPS 140-2, its compliance requirements for federal agencies, and the ..
Cigent’s Federal Data Protection Solutions are second to none
Learn more about how Cigent can help you achieve your mission and protect data at rest and data on the edge from all forms of attack.
