Rapport

FFI-RAPPORT 16/00707

500 year longevity. What good is a longevity of this magnitude if the information cannot be

accessed in the future without additional references?

However, this trade-off between security issues and the concept of self-containment should be

up to the user to decide. If a user, for instance a national archive, wishes their information stored

on the piqlFilms to be accessible to all, also in the future, then cryptography is a non-issue and

the concept of self-containment is paramount. If, however, a user, perhaps a competitive

business storing patents, wishes their information to remain secret or private no matter what,

then cryptography is vital. The decision depends on whether the user values availability or

confidentiality the most.

Piql AS’ current security architecture addresses integrity – through the measure of verification –

and availability – by not deleting the original file from their computer system until the

production process is complete. Conversely, they do not offer anything to address

confidentiality. Though this may run counter to their vision for the Piql Preservation Services,

not at least offering it as a part of their security architecture for users to choose is a weakness.

Apart from the abovementioned weaknesses in the Piql IT system, there are also some worth

mentioning in the piqlVault IT system during the storage phase.

As mentioned previously in this chapter, the only real logical threat to the piqlVault system is

sabotage in the form of a threat actor gaining access to the system and wreaking havoc in the

piqlVault grid. They can create complete chaos with regards to the locations of piqlBins within

the grid and thus affect the availability of the piqlFilms, but the information security properties

are not otherwise affected. It was also said that a threat actor had two ways to achieve this level

of chaos. In the following we discuss how these events can come to pass by highlighting the

exploited vulnerabilities of the piqlVault system.

The first option was to gain access to the piqlVault IT system through the potentially vulnerable

B interface network between the Piql IT system and the piqlVault IT system and install malware

in the EWMS which switches the reel IDs around or orders random pick-ups continuously. The

mere role of the B network as an interface between the two systems makes it a point of

vulnerability. However, it seems that the setup it delivered from the supplier as a robust system

when it comes to computer security, and it is up to Piql AS and their realisation of the system to

keep it secure. It seems that Piql AS has done just that. Yet, such an interface can always be

turned into the chink in the otherwise solid armour and exploited by threat actors with the

proper know-how.

The second option was to affect the radio signals controlling the movements of the robots

through the use of a malicious transmitter. The use of a 2.4 GHz frequency to send the radio

signals through enhances security, as there is less radio propagation of the signals. However,

FFI has not learned of any cryptographic methods used in the information in the signals.

Without this feature the information in the signals can be accessed and possibly distorted. With

See figure 5.4 in chapter 5 as a reference.