Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • IT Management
    • Storage

    How to Secure Data with End-to-End Encryption

    Written by

    Paul Meadowcroft
    Published January 13, 2010
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      To date, it has largely been banks and governments that have taken advantage of encryption to secure information. However, almost every organization in every industry handles information that someone somewhere regards as being private or valuable. There is an implicit, and increasingly explicit, obligation to protect it.

      Some of the advantages of encrypting data include minimizing the risk of card fraud, complying with regulations such as the Payment Card Industry Data Security Standard (PCI DSS), and implementing industry best practices. Let’s take a closer look at each of these advantages:

      1. Minimizing the risk of card fraud

      It has been estimated that the cost of a data breach for a large organization is approximately $200 per compromised record. As such, the financial implications of the recent data breach at Web hosting firm Network Solutions-which compromised approximately 574,000 individuals’ credit card information-stands at around $100 million. It is easy to understand how costs can add up so quickly if elements such as forensic investigations, managing relations with affected customers, reducing the impact on the media, and legal costs (just to name a few) are taken into consideration.

      Retailers store customer data, for example, in order to be able to refund payments. However, in doing so, they must also keep this data secure. Strong cryptography is the most sophisticated and successful approach for protecting stored cardholder data. It ensures that the information remains safe, even if the other layers are breached. Encryption also allows data to be stored for as long as necessary and as flexibly as possible.

      With strong cryptography, a secret “key” value is used in an encryption algorithm to protect the cardholder data. As long as this key remains secret, the encrypted data is safe. Consequently, the best way to store the secret key is to use a cryptographic Hardware Security Module (HSM) that performs all of the encryption and decryption of data-and never allows users or applications to see the key.

      Complying with Industry Regulations

      2. Complying with industry regulations

      Compliance with the PCI DSS may be perceived by the industry as another regulatory burden that they could do without, particularly when it comes to implementing the more challenging requirements (such as protecting stored cardholder data). However, as fraudsters become increasingly sophisticated and data breaches among retailers continue to make the headlines, PCI DSS-compliance should be viewed as an opportunity to review security processes.

      Organizations that work with the card schemes are obliged to undergo annual verification of their compliance with PCI DSS each year by qualified assessors. PCI DSS requires organizations to address the two most vulnerable areas: encrypt transmission of cardholder data across open, public networks and during storage. The improved security resulting from this approach is a considerable benefit, not only in terms of demonstrating compliance with the PCI DSS but also in mitigating risk for an organization-and avoiding fines and penalties associated with non-compliance.

      3. Implementing industry best practices

      Specific reference to the use of encryption is increasingly found in privacy mandates and industry best practices that attempt to go beyond the traditional focus on “people and processes.” Furthermore, encryption is often favored by regulators and policymakers because of the black and white nature of the technology. Data is either encrypted or it is not, which in theory means it is either secure or not-a very measurable parameter which is well received by auditors and regulators.

      For example, Visa recently issued its global industry best practices for data field encryption, also known as end-to-end encryption. Also included in Visa’s best practices is guidance to use robust key management solutions and encryption consistent with international and regional standards. This includes the management of encryption/decryption keys within secure cryptographic devices such as PIN Entry Devices (PEDs) or HSMs.

      Deploying and Managing Encryption

      Deploying and managing encryption

      Despite the growing recognition of the benefits of encryption, there remains a general lack of understanding about deploying and, more importantly, managing it. Encryption itself is simple; it is just mathematics. The hard bit is controlling the keys-the secret codes that have the power to unlock the data.

      Without good encryption key management, what was thought to be black or white may actually have many shades of grey. A recent survey found that organizations see key management as the biggest challenge in encryption.

      As the use of encryption grows, companies need to be able to manage (or control) a growing number of encryption keys. This is crucial, not only to prevent keys from being lost or stolen, but also for important operational reasons such as on-demand recovery of encrypted data, automated updates and compliance reporting.

      Once encrypted, information only becomes readable if the encryption key is available to unlock it. Consequently, the key becomes as valuable as the data it is protecting. This situation can be likened to the security of a home: locking the house significantly increases the security of its contents. However, if the key is then left under the mat, then the level of security is compromised. In the same way, while encryption is an effective first step in enhancing data security, encryption keys need to be stored and managed effectively in order to ensure the data’s security.

      Many companies have found themselves in a situation where they need to manage thousands (or even many millions) of keys as they deploy separate encryption and key management systems to protect different areas of their IT infrastructure such as laptops, storage systems and databases. This typically involves manual processes to generate, distribute, store, expire and refresh encryption keys. It very often results in increased operational costs, delays in meeting audit and compliance requirements, and increased risk of human error.

      With new silos of encryption taking root across the organization, security officers and administrators are being forced to act and to formalize and institutionalize good key management practices. Finding the encryption keys is a lot easier than cracking the encryption and this is where much criminal activity is focused. With encryption effectively impossible to break, the key management system becomes a natural target for attack. Consequently, key management issues need to be at the core of every company’s IT security infrastructure.

      Good Key Management

      Good key management

      Keys stored in software are subject to attack by Trojans, other spyware, or even malicious use of debugging and system maintenance tools. To mitigate these threats, techniques to provide enhanced physical and logical security in hardware have become well established (for example, through the use of HSMs and security certifications such as the Federal Information Processing Standard (FIPS) and Common Criteria).

      While much of the burden of implementing good key management lies with security professionals within organizations, there are several initiatives underway that are designed to guide the process. Key management standards such as the Key Management Interoperability Protocol (KMIP) and IEEE 1619.3 are nearing ratification, deployment best practices are well understood within the auditing community, and second-generation key management products are reaching the market.

      Measures such as these will enable organizations to implement cohesive key management strategies moving forward. Once a well-thought-out approach to key management is established, effective security policies, reporting practices and, ultimately, a stronger sense of control over data will be achieved.

      Before PCI DSS, many companies’ data was horribly insecure. But thanks to the regulation, most card data is now better looked after than it was two years ago. However, the standard only covers the obvious areas of vulnerability and does not prescribe end-to-end encryption. PCI DSS offers a good base line for protection but, as with any standard, it will not be an exact fit for every organization. Plus, being PCI DSS-compliant is not on its own sufficient to protect an organization from the security risks it faces.

      It is the responsibility of each organization to deploy PCI DSS in a way that gives them what they want, and then fix the gaps. Maintaining a security program that incorporates ongoing compliance with PCI DSS at its foundation remains a base line of defense against potential data breaches. But organizations must understand their own specific security risks and deploy appropriate security measures.

      Paul Meadowcroft is Enterprise and Government Business Unit Director for the Information Systems security activities at Thales. Paul has more than 15 years experience in information security. Paul is an expert on a wide range of information security topics, including the use of cryptography, key management, public key infrastructures and payment systems. He can be reached at paul.meadowcroft@thales-esecurity.com.

      Paul Meadowcroft
      Paul Meadowcroft
      Paul Meadowcroft is Enterprise and Government Business Unit Director for the Information Systems security activities at Thales. Paul has more than 15 years experience in information security. Paul is an expert on a wide range of information security topics, including the use of cryptography, key management, public key infrastructures and payment systems.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×