How to Secure Data with End-to-End Encryption

Good key management

Keys stored in software are subject to attack by Trojans, other spyware, or even malicious use of debugging and system maintenance tools. To mitigate these threats, techniques to provide enhanced physical and logical security in hardware have become well established (for example, through the use of HSMs and security certifications such as the Federal Information Processing Standard (FIPS) and Common Criteria).

While much of the burden of implementing good key management lies with security professionals within organizations, there are several initiatives underway that are designed to guide the process. Key management standards such as the Key Management Interoperability Protocol (KMIP) and IEEE 1619.3 are nearing ratification, deployment best practices are well understood within the auditing community, and second-generation key management products are reaching the market.

Measures such as these will enable organizations to implement cohesive key management strategies moving forward. Once a well-thought-out approach to key management is established, effective security policies, reporting practices and, ultimately, a stronger sense of control over data will be achieved.

Before PCI DSS, many companies' data was horribly insecure. But thanks to the regulation, most card data is now better looked after than it was two years ago. However, the standard only covers the obvious areas of vulnerability and does not prescribe end-to-end encryption. PCI DSS offers a good base line for protection but, as with any standard, it will not be an exact fit for every organization. Plus, being PCI DSS-compliant is not on its own sufficient to protect an organization from the security risks it faces.

It is the responsibility of each organization to deploy PCI DSS in a way that gives them what they want, and then fix the gaps. Maintaining a security program that incorporates ongoing compliance with PCI DSS at its foundation remains a base line of defense against potential data breaches. But organizations must understand their own specific security risks and deploy appropriate security measures.

Paul Meadowcroft is Enterprise and Government Business Unit Director for the Information Systems security activities at Thales. Paul has more than 15 years experience in information security. Paul is an expert on a wide range of information security topics, including the use of cryptography, key management, public key infrastructures and payment systems. He can be reached at paul.meadowcroft@thales-esecurity.com.