eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
To date, it has largely been banks and governments that have taken advantage of encryption to secure information. However, almost every organization in every industry handles information that someone somewhere regards as being private or valuable. There is an implicit, and increasingly explicit, obligation to protect it.
Some of the advantages of encrypting data include minimizing the risk of card fraud, complying with regulations such as the Payment Card Industry Data Security Standard (PCI DSS), and implementing industry best practices. Let’s take a closer look at each of these advantages:
1. Minimizing the risk of card fraud
It has been estimated that the cost of a data breach for a large organization is approximately $200 per compromised record. As such, the financial implications of the recent data breach at Web hosting firm Network Solutions-which compromised approximately 574,000 individuals’ credit card information-stands at around $100 million. It is easy to understand how costs can add up so quickly if elements such as forensic investigations, managing relations with affected customers, reducing the impact on the media, and legal costs (just to name a few) are taken into consideration.
Retailers store customer data, for example, in order to be able to refund payments. However, in doing so, they must also keep this data secure. Strong cryptography is the most sophisticated and successful approach for protecting stored cardholder data. It ensures that the information remains safe, even if the other layers are breached. Encryption also allows data to be stored for as long as necessary and as flexibly as possible.
With strong cryptography, a secret “key” value is used in an encryption algorithm to protect the cardholder data. As long as this key remains secret, the encrypted data is safe. Consequently, the best way to store the secret key is to use a cryptographic Hardware Security Module (HSM) that performs all of the encryption and decryption of data-and never allows users or applications to see the key.
Complying with Industry Regulations
2. Complying with industry regulations
Compliance with the PCI DSS may be perceived by the industry as another regulatory burden that they could do without, particularly when it comes to implementing the more challenging requirements (such as protecting stored cardholder data). However, as fraudsters become increasingly sophisticated and data breaches among retailers continue to make the headlines, PCI DSS-compliance should be viewed as an opportunity to review security processes.
Organizations that work with the card schemes are obliged to undergo annual verification of their compliance with PCI DSS each year by qualified assessors. PCI DSS requires organizations to address the two most vulnerable areas: encrypt transmission of cardholder data across open, public networks and during storage. The improved security resulting from this approach is a considerable benefit, not only in terms of demonstrating compliance with the PCI DSS but also in mitigating risk for an organization-and avoiding fines and penalties associated with non-compliance.
3. Implementing industry best practices
Specific reference to the use of encryption is increasingly found in privacy mandates and industry best practices that attempt to go beyond the traditional focus on “people and processes.” Furthermore, encryption is often favored by regulators and policymakers because of the black and white nature of the technology. Data is either encrypted or it is not, which in theory means it is either secure or not-a very measurable parameter which is well received by auditors and regulators.
For example, Visa recently issued its global industry best practices for data field encryption, also known as end-to-end encryption. Also included in Visa’s best practices is guidance to use robust key management solutions and encryption consistent with international and regional standards. This includes the management of encryption/decryption keys within secure cryptographic devices such as PIN Entry Devices (PEDs) or HSMs.
Deploying and Managing Encryption
Deploying and managing encryption
Despite the growing recognition of the benefits of encryption, there remains a general lack of understanding about deploying and, more importantly, managing it. Encryption itself is simple; it is just mathematics. The hard bit is controlling the keys-the secret codes that have the power to unlock the data.
Without good encryption key management, what was thought to be black or white may actually have many shades of grey. A recent survey found that organizations see key management as the biggest challenge in encryption.
As the use of encryption grows, companies need to be able to manage (or control) a growing number of encryption keys. This is crucial, not only to prevent keys from being lost or stolen, but also for important operational reasons such as on-demand recovery of encrypted data, automated updates and compliance reporting.
Once encrypted, information only becomes readable if the encryption key is available to unlock it. Consequently, the key becomes as valuable as the data it is protecting. This situation can be likened to the security of a home: locking the house significantly increases the security of its contents. However, if the key is then left under the mat, then the level of security is compromised. In the same way, while encryption is an effective first step in enhancing data security, encryption keys need to be stored and managed effectively in order to ensure the data’s security.
Many companies have found themselves in a situation where they need to manage thousands (or even many millions) of keys as they deploy separate encryption and key management systems to protect different areas of their IT infrastructure such as laptops, storage systems and databases. This typically involves manual processes to generate, distribute, store, expire and refresh encryption keys. It very often results in increased operational costs, delays in meeting audit and compliance requirements, and increased risk of human error.
With new silos of encryption taking root across the organization, security officers and administrators are being forced to act and to formalize and institutionalize good key management practices. Finding the encryption keys is a lot easier than cracking the encryption and this is where much criminal activity is focused. With encryption effectively impossible to break, the key management system becomes a natural target for attack. Consequently, key management issues need to be at the core of every company’s IT security infrastructure.
Good Key Management
Good key management
Keys stored in software are subject to attack by Trojans, other spyware, or even malicious use of debugging and system maintenance tools. To mitigate these threats, techniques to provide enhanced physical and logical security in hardware have become well established (for example, through the use of HSMs and security certifications such as the Federal Information Processing Standard (FIPS) and Common Criteria).
While much of the burden of implementing good key management lies with security professionals within organizations, there are several initiatives underway that are designed to guide the process. Key management standards such as the Key Management Interoperability Protocol (KMIP) and IEEE 1619.3 are nearing ratification, deployment best practices are well understood within the auditing community, and second-generation key management products are reaching the market.
Measures such as these will enable organizations to implement cohesive key management strategies moving forward. Once a well-thought-out approach to key management is established, effective security policies, reporting practices and, ultimately, a stronger sense of control over data will be achieved.
Before PCI DSS, many companies’ data was horribly insecure. But thanks to the regulation, most card data is now better looked after than it was two years ago. However, the standard only covers the obvious areas of vulnerability and does not prescribe end-to-end encryption. PCI DSS offers a good base line for protection but, as with any standard, it will not be an exact fit for every organization. Plus, being PCI DSS-compliant is not on its own sufficient to protect an organization from the security risks it faces.
It is the responsibility of each organization to deploy PCI DSS in a way that gives them what they want, and then fix the gaps. Maintaining a security program that incorporates ongoing compliance with PCI DSS at its foundation remains a base line of defense against potential data breaches. But organizations must understand their own specific security risks and deploy appropriate security measures.
Paul Meadowcroft is Enterprise and Government Business Unit Director for the Information Systems security activities at Thales. Paul has more than 15 years experience in information security. Paul is an expert on a wide range of information security topics, including the use of cryptography, key management, public key infrastructures and payment systems. He can be reached at paul.meadowcroft@thales-esecurity.com.