TNGP-0001 – Enhanced Security Model for Early 2016
Created: Mar 06, 2016 | Updated: July 06, 2020
ChronoSync v4.6.6, ChronoSync Express v1.1.2, ChronoAgent v1.6.0, InterConneX v1.2.1 and ChronoMonitor v1.1.2 were all released simultaneously on March 6th, 2016. A principle reason for the simultaneous release was an upgrade to the security model employed by all these products when establishing secure data communication sessions between each other. This tech-note describes everything you need to be aware of to prepare for and deploy the updated version of these products.
WHY THE UPDATE?
Securing data is often a game of cat and mouse. While the technology of securing data is constantly improving, the same can be said of the technology used to crack security. Thus it is mandatory that we monitor the current trends in security and exploits, updating our products accordingly. This latest update is not the first time we’ve rolled forward the security model for our products and it certainly won’t be the last.
DEPLOYING SECURITY UPDATES
For the most part, all you need to do is update the products through normal means — be it the in-app update mechanism or through the App Store. However, you must be aware of the fact that, by default, secure connections between our products will not be possible if they don’t employ the same security model as each other. This will require that you update ALL of our products simultaneously in order to maintain compatibility.
For example, suppose you have ChronoAgent installed on a central server and two desktop computers with ChronoSync installed. You also have an iPad and iPhone running InterConneX. If you update ChronoAgent to v1.6.0, and you are using secure connections, none of the machines running ChronoSync will be able to connect to it. Since InterConneX always uses secure connections, your iPad and iPhone will not be able to connect to ChronoAgent either. Once you have updated ChronoSync and InterConneX on all your devices, connections between devices will be established as normal.
BACKWARD COMPATIBILITY
If you have deployed older versions of our software that cannot be updated, such as ChronoSync v4.5 on macOS 10.6, then you will have to enable backward compatibility in order to establish secure connections. For example, in the above scenario, if one of those ChronoSync machines could not be updated to v4.6.6, it would be unable to connect to ChronoAgent v1.6.0. To allow a connection to be made, you would have to enable the “Backwards compatible with older versions of ChronoSync” security setting found in the Advanced panel in ChronoAgent.
Conversely, suppose the ChronoAgent was v1.4 running on macOS 10.5 — it would not be upgradable to v1.6.0. If you upgraded all your copies of ChronoSync to 4.6.6, they would not be able to connect securely. You would have to enable the “Backwards compatible with older versions of ChronoAgent” setting in the connection profile used to connect to the ChronoAgent.
In the above example, the InterConneX devices would still be able to connect to ChronoAgent v1.5 since backwards compatibility is automatic on InterConneX.
Note: Backwards compatibility is a convenience setting but it should be avoided if at all possible. If a security model implemented on an older version of our products becomes exploitable, having backwards compatibility enabled on newer versions of our product could leave them vulnerable, too. By having backwards compatibility turned OFF, you guarantee that all copies of our software will only be using the latest security model available to them.
ENABLING SECURE COMMUNICATION
Secure connections between ChronoSync and ChronoAgent need to be explicitly enabled by the user. This can be done either on the ChronoSync or ChronoAgent side (or both). In ChronoSync, you enable secure connections when configuring the connection profile for a particular agent. The “Force all data to be encrypted” checkbox pictured above is what you would use to turn security ON.
On the ChronoAgent side, the “Require all connections to be secure” setting, also pictured above, would need to be turned on. When the setting is activated on the ChronoAgent side, ALL connections to that ChronoAgent will be secure, regardless of the connection profile settings in ChronoSync. If ChronoAgent is not enforcing security, however, it’s up to the connection profile in ChronoSync to determine whether or not security will be used on the connection.
If you are using InterConneX to communicate with ChronoSync, ChronoAgent or another instance of InterConneX, secure connections will always be established. There is no way to turn that off.
WHEN TO USE SECURE CONNECTIONS
Securing data communication is important because, without it, any computer that is on the same network as your devices can ‘snoop’ the information that is being exchanged, even though the data is being passed between two different devices. This is particularly of concern in public places such as wi-fi hotspots but it can also be a concern on private networks that may allow guest access. An eavesdropper doesn’t necessarily have to be a malicious individual — it could be an honest person whose computer has been compromised by malware. Even completely closed, private networks should be dealt with caution if there is a chance that any computer on that network may be compromised or individuals using those computers are not completely trusted.
Every user should take a serious approach to data security. Even though you might not be transferring top-secret, highly classified information between your devices, you should still take precautions against eavesdropping. Personal information may often be gleaned from run-of-the mill documents. This information can then be used for password cracking, social engineering, identity theft and many other nefarious schemes.
While enabling secure connections may sound like the solution for all fears, unfortunately, it comes at a cost — performance! In general you can expect data transfers between devices to take almost twice as long when using a secure connection (slower connections, such as wi-fi, will feel less of a performance penalty). This may impose quite a burden when transferring large amounts of data. Ultimately, you must decide on where and how to enable security based on the size of your data, how sensitive it is and the trustworthiness of your network.
ENCRYPTION STRENGTH
If you are using ChronoAgent on one of your devices, you have control over the strength of the encryption that is being used. ChronoAgent offers three general settings for this: Low, Medium and High. The settings corresponds to several behind the scenes attributes of the secure connections that we will not explain in detail. The one attribute that we will mention, however, is the encryption cipher that each setting corresponds to.
The encryption cipher determines what cryptographic algorithm is used to encode the data in such a way that will be unintelligible to humans and machines. The Low, Medium and High settings do not correspond to a specific cipher but instead correspond to a class of ciphers. The exact cipher to be used is negotiated by each side of the connection when the connection is established.
The security model employed by ChronoAgent v1.6 and the latest versions of our other products will roughly correspond to the following ciphers and transport protocols:
Low: 128-bit class, TLS v1.0 (aka SSL v3)
Medium: AES-128 class, TLS v1.2
High: AES-256 class, TLS v1.2
ChronoAgent v1.3 thru v1.5 have the following associations:
Low: Up to 64-bit class, TLS v1.0 (aka SSL v3)
Medium: Up to 128-bit class, TLS v1.0 (aka SSL v3)
High: 128 to 256-bit class, TLS v1.0 (aka SSL v3)
Versions of ChronoAgent prior to v1.3 used a proprietary transport protocol with Blowfish based encryption. Details are beyond the scope of this tech-note.
If using a product that does not provide explicit control over the strength of the security model, such as ChronoSync with InterConneX, you can expect the equivalent of “Medium” strength encryption will be employed.
In all cases, the strength of the encryption employed has a proportional effect on performance. The higher the setting, the slower the data transfer.
Confused by any of this? Wonder exactly which security settings you should employ in your environment? Just drop us a line at support@econtechnologies.com. We’ll be happy to help!
REVISION HISTORY
March-06-2016 – Created.