eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Enterprises are using encryption in more places than ever, but they are not properly securing the keys or using consistent products, a recent report found.
Despite using encryption, poor key management and lack of control over the technologies being used can cost the organization an average of $124,965 a year, according to the 2011 Enterprise Encryption Trends Survey report released by Symantec on Nov. 30.
Most of the costs were related to reduced stock price and brand damage. The cost of improperly securing data does not include the cost of a data breach but reflects the expenses organizations bear because of the time it takes IT to try to find and recover the business data or the key used to secure the data, Tim Matthews, senior director of product marketing at Symantec, told eWEEK.
About 48 percent of the survey participants reported their organization had increased their use of encryption over the past two years, with one third reporting “somewhat to extremely frequent” deployments of “rogue” projects without any centralized management oversight, Matthews said.
Business groups and employees are often independently encrypting the data without involving the IT department, according to Matthews. While the move to encrypt is a good thing, these unauthorized deployments are a challenge for IT because the data is lost and irretrievable if the employee loses the key, forgets the passphrase or leaves the company without passing on custody of the encryption keys. If IT doesn’t have the key, it also becomes harder to properly backup the data or to access the information as part of an e-discovery request, he said.
Rogue projects pose a “recovery issue” for organizations since that’s data the IT department has no control over and if told by the courts to hand over data, the “enterprise can’t really say ‘I can’t,'” Matthews said.
The costs of improper key management and fragmented encryption deployments result in the organization not being able to meet compliance requests, said 48 percent of the respondents in the survey. Others named the inability to respond to e-Discovery requests and to access important business information.
About 52 percent of the respondents said they have had serious key management problems, with about a third claiming that keys were lost or misplaced keys and another third citing key failure. A little over a quarter, or 26 percent for the participants, said former employees refused to hand over keys when they left the company, according to the survey.
Organizations need to think about the “employee lifecycle” and consider what happens to business data when an employee leaves, Matthews said. It’s not enough to just think about the data lifecycle, he said. There needs to be a consistent process for how keys are generated, deployed and managed within the enterprise, according to Matthews.
About 40 percent of the enterprises in the survey were less than somewhat confident they would be able to retrieve keys and 39 percent were less than somewhat confident they would be able to protect data from disgruntled employees, the survey found.
“As the Enterprise Encryption Trends survey demonstrates, encryption needs to evolve from a fragmented protection historically implemented at the line of business level to a capability that is managed as a core component of organizations’ IT security operations,” said Joe Gow, director of product management at Symantec.
It has become fairly easy to get encryption software online and users are becoming more aware of encryption, according to Matthews. Malicious insiders may encrypt some files to hide their activities.
There may also be a “shadow IT” situation in place where the business has to comply with regulations because of a partner company, Matthews said. For example, regulations may require an insurance company to encrypt certain types of data. The insurance company may in return require partners that handle payments or other business functions to have a system in place to decrypt and encrypt transaction data. With that system from the insurance company in place, the employee at the third-party provider may be encrypting other types of data used internally without IT knowledge, Matthews said.
The survey examined encryption use at 1,575 enterprises around the world. Matthews said this was the “largest sample size” he’s ever had for this annual survey. The survey is usually conducted by encryption vendor PGP, which was acquired by Symantec last year.