NSA Type 1 Encryption Products vs. Commercial Solutions for Classified (CSfC)

For decades, Type 1 has been the National Security Agency ’ s most prize cybersecurity appointment, describing technology that can effectively keep the state ’ s most classify information under lock and key .
recent years, however, have seen the growth of NSA ’ s commercial Solutions for Classified ( CSfC ) plan, which offers an option to Type 1 products .

With these two competing options, it is authoritative to understand what the difference between Type 1 and CSfC truly is and which one is best for your use sheath.

Below, we ’ ll discus everything you need to know about both NSA Type 1 and the CSfC program .

— article Continues Below —

Everything you need to know when it comes to the CSfC process .

What Is NSA Type 1 Encryption Equipment?

The U.S. federal government controls huge quantities of classified data, ranging from Confidential to Secret and Top Secret .
In order to constantly maintain a high level of IT security, the U.S. has established in-depth requirements for how this datum can move over electronic systems and networks .

NSA Type 1 encoding equipment is any NSA-certified product that has been approved to handle classified ad data for the U.S. government .

More specifically, NSA defines a type 1 intersection as “ cryptanalytic equipment, forum or part classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed. ”

The term “ Type 1 ” besides refers to any cryptanalytic algorithm ( or “ Suite, ” as NSA refers to them ) that has been approved by NSA for use within Type 1 equipment .

Examples of Type 1 cryptanalysis include 256-bit AES ( Advanced Encryption Standard ) – which falls under NSA Suite B – american samoa well as the classified SAVILLE voice encoding algorithm .

One exercise of NSA Type 1 equipment is a HAIPE ( High Assurance Internet Protocol Encryptor ), which is a device that protects network dealings with NSA Type 1 encoding. The general term COMSEC ( communications security system ) material is besides frequently used to refer to Type 1 cryptanalytic hardware and keys .

NSA devotes tens of millions of dollars per class out of its “ black budget ” in ordain to develop Type 1 equipment. As such, Type 1 devices come with highly stern requirements for use and protection .

Because Type 1 appliances are themselves considered classified, they must be accompanied and guarded at all times. Users besides need to obey regulations when securing and storing Type 1 devices and losing Type 1 equipment can have serious consequences, up to and including criminal prosecution .

What Is CSfC (Commercial Solutions for Classified)?

type 1 equipment is broadly considered to be highly effective and guarantee. however, there ’ s one major problem : type 1 security requirements are so rigorous as to be much airy. For exercise, users subject to Type 1 requirements may have to leave home and drive to the office in order to check their electronic mail .

In order to address this write out, the commercial Solutions for Classified ( CSfC ) plan is an NSA first step that allows U.S. government agencies to use commercial off-the-rack ( COTS ) solutions that have been verified and approved to meet national security system standards .

The basic estimate behind the CSfC program is “ defense in depth ” ( DiD ), a well-established concept in cybersecurity. By layering multiple commercial IT security solutions on lead of each early, the hazard that all of these solutions will fail is much lower than it would be when using a single solution .

just think of how banks defend against robberies, combining a kind of security system methods : cameras, security guards, panic buttons, and even dye packs and bait money .

similarly, combining IT security best practices like firewalls, intrusion detection systems ( IDS ), and encoding is a lot more probably to protect sensitive data than relying on a single solution .

One of the key requirements in CSfC is double encryption for data in transit and data at rest. 

For example, NSA ’ s guidelines for multi-site connectivity require classified data packets to be encrypted twice before being sent over an untrusted network : first by an Inner Encryption Component, and then by an Outer Encryption Component .

This twice-encrypted data must then be decrypted doubly after arriving at its finish .

What’s the Difference Between Type 1 and CSfC?

The technology within NSA Type 1 and CSfC is different, as are the manufacturers of this engineering : the NSA itself or trusted systems integrators in the erstwhile sheath, and third-party commercial vendors in the latter .

however, the function of both is the same : helping the U.S. politics to protect classified ad data .

It’s important to note that CSfC represents an alternative to Type 1 solutions, not a replacement for them as of yet.

According to the NSA CSfC handbook : “ NSA CSfC has not replaced Type 1 solutions. Based on the customer ‘s needs, NSA will use the adjust cock for the right job. ”

Type 1 products are however widely in use across U.S. politics agencies .
rather than converting from Type 1 solutions to CSfC, the debate is more about selecting between Type 1 and CSfC for new initiatives and replacing the bequest Type 1 solutions as IT refreshes occur .
NSA itself is promoting CSfC, and these days Type 1 is seen as more of a bequest solution .

As the CSfC program has continued to grow, it has developed more clear-cut policies, making it easier for users to deploy these solutions in practice .

Advantages of CSfC

The advantages of CSfC include :

• No need for specialized training: Using Type 1 products requires advanced knowledge that you can’t develop overnight. CSfC, on the other hand, requires only knowledge of commercial technologies that already make up standard cybersecurity architectures, so in most cases, your team doesn’t have to go through special training to use them.
• Total cost of ownership (TCO): The upfront cost of CSfC is higher when compared with Type 1 solutions. But after several years, the TCO of CSfC decreases significantly, to the point where it becomes the much less expensive solution.
• Faster to start: Although it depends somewhat on the organization, it’s usually easier to get up and running with CSfC. This will only become truer as adoption of the CSfC program increases. Type 1 can sometimes be quicker, because it’s a known quantity for the “old guard” who have been in the field for decades, but this should change with greater awareness of CSfC.
• Higher technical flexibility: If you have limited options for backhaul on your Internet connection, CSfC is often the wiser choice as it enables you to use any common type of Internet connection, from satellite to 4G. Type 1, on the other hand, often limits you to certain satellite networks or dedicated Internet connections such as MPLS links, which can be very expensive.
• Less risk of ownership: Using CSfC products involves lower risk of ownership due to the less stringent security requirements and the use of commercial hardware. There’s no need to place all of the devices in a secure safe watched by guards 24/7, for example. This also means that CSfC is good for situations that are inherently higher-risk.

Thanks to its flexibility and ease of getting started, CSfC excels when it comes to any type of outback workplace or any site where you need to set up a temp SOC ( security operations center ) .

It ’ s besides easy to imagine where CSfC would shine for future use cases such as drones, which can easily be shot down and lost to the enemy—in which font, you don ’ t want type 1 equipment falling into the amiss hands .

Getting Started with CSfC

A proper implementation of CSfC requires at least half a twelve components from different vendors in which each component within your final intersection will need to be CSfC approved .
To simplify the work, NSA provides Capability Packages, which are reference book architectures to be used as a start point for building a CSfC solution .
Using a Capability Package greatly increases the odds that your final CSfC solution will receive NSA certification .
NSA presently provides the pursue capability Packages :
If you ’ rhenium daunted by the very expectation of getting started, NSA besides provides a list of Trusted Integrators – third-party contractors who have met a nonindulgent set of criteria. These organizations can help you navigate the CSfC process, offering their aid and technical expertness along the way .

If you ’ d prefer not to develop a solution in-house, there are besides a number of vendors that make CSfC kits .

After finding the right CSfC seller and outlining your use case, you can remain fairly hands-off during the development process. once this is complete, you can submit the final CSfC solution to NSA for approval .

To sum up: no matter your level of technical expertise or time commitment, a CSfC solution is within reach.

The Bottom Line

CSfC is a new option for handling classified data that offers respective advantages over bequest NSA Type 1 encoding solutions, including less risk, and lower costs over the long haul .

As the CSfC program continues to evolve and mature, you can expect that the benefits of CSfC will only continue to increase.

If you ’ re deciding between Type 1 and CSfC for your own organization, we encourage you to check out CSfC for yourself—speak with an NSA Trusted Integrator or qualified CSfC seller who can help you understand where to get started .