Ransomware Protection
Ransomware attacks have become alarmingly common, and, unfortunately, experts predict that they will only become more frequent and more severe in the coming years.
E-semnatura provides cybersecurity protection against ransomware with a variety of security controls, including restricted access to sensitive data and decryption keys, granular access controls like multi-factor authentication (MFA) and device authentication, and support for digitally signing and timestamping backups.
Timestamp Data Prior To Encryption
Passwords often create vulnerabilities, as end-users often set weak passwords. Key-based authentication provides superior cybersecurity and should be implemented whenever possible. Store all cryptographic keys in a hardware security module (HSM) and restrict end-users to proxied key access via E-semnatura to enable seamless integrations with all clients and ensure the keys are never exported from the HSM.
Encrypt Data With Self-Managed KMS
Whenever possible, encrypt data at rest using a self-managed (i.e., on-premise) Key Management Service (KMS). This is especially important when the third-party is the one storing the data, as is the case with cloud providers. By encrypting the data before it is sent to the storage provider, you benefit from the storage provider’s scale without sacrificing the confidentiality or integrity of your own data.
Disable All Decryption Keys
By default, keep the private keys for decryption disabled. Since they are only needed when restoring backups and are therefore not needed frequently, you should only enable them when necessary and immediately disable them again after they are used. With E-semnatura, any cryptographic key can be disabled with a few clicks from the E-semnatura interface.
Enforce Granular Access Controls
Ensure that only authorized and authenticated end-users can use the decryption keys needed to access backups. E-semnatura supports granular access controls, such as multi-factor authentication (MFA), device authentication, and approval workflows, on a per-key or per-user basis.