Encryption

Encryption—and its opposite, decryption—is the process of converting data into code that is unreadable by a human who does not possess the necessary key for decrypting it, or turning it back to a readable form. It has its origins in the Greek word kruptos, meaning hidden. Encryption is one of the best methods that can be used for protecting sensitive data from loss or inappropriate access, but for many it is still often an afterthought, used in a largely ad hoc manner.

Why is it important?

Whilst data breaches appear to be everyday news, the vast majority are never reported. According to the Breach Level Index, 9.7 trillion data records have been lost or stolen since 2013, yet only 4% of those records were encrypted, rendering them useless to those who discover the records. When an adversary realises that an organisation is using encryption on a widespread basis, they are likely to move on, looking for easier targets to exploit.

As the number of breaches continues to rise, regulators are demanding higher levels of data protection, with increased sanctions for non-compliance. A prime example is the general data protection regulation (GDPR) of the EU, which affects every organisation that processes and stores data related to those resident in the EU, no matter where the data is handled or kept. As with most regulations, GDPR is not particularly prescriptive regarding the technologies that organisations should implement, with the exception of encryption and pseudonymisation. Data records that have been adequately encryption exempt an organisation from having to disclose that it has been subject to a data breach.

In light of factors such as these, it is clear that taking a data-centric approach to securing an organisation’s assets is the best option, using multilayered encryption for sensitive data both at rest and in motion. Encryption should be the cornerstone of any security programme.

Figure 1: Drivers for encryption

How does it work?

All too often, organisations have deployed encryption to meet specific needs as problems arise, which can lead to gaps in security that leave some sensitive data unprotected. To solve this, an enterprise-wide strategy should be established, led by security executives with input from IT and business units. This strategy will likely involve the implementation of a data security platform that provides for persistent encryption for all data in use in the enterprise, covering data at rest in storage, backup, on devices that include mobile equipment and in services based in the cloud. It will also provide for efficient encryption for data in transit.

Such a platform will solve some of the biggest bugbears of encryption deployments. One of these is key management which, according to the Ponemon Institute is very painful for 57% of organisations. A consolidated platform will ensure that encryption keys are centrally managed, refreshed regularly and kept separate from the data that are protecting to ensure that keys cannot fall into the wrong hands. 
Many vendors offering data security platforms offer key management services, which can be installed on-premise, in a private cloud or in the public cloud as a private instance.

Other beneficial services that can be offered by a centralised platform include data discovery and classification. Not all data needs to be encrypted, which would add to overheads and potentially negatively impact users. Therefore, organisations need to discover all data used and determine its sensitivity so that appropriate controls can be applied and enforced. Other services to look for include analytics and reporting, activity monitoring and real time alerting.