Crypto technologies play a crucial role in data protection and compliance activities across a wide range of industry sectors, in both private and public organizations, according to The Ponemon Institute.

More than 500 auditors were surveyed for the report with roughly half representing internal IT security audit teams and half representing independent external audit companies and consultancies. 44% of those surveyed had more than 10 years of experience with 46% holding the CISA accreditation and 24% acting as qualified security assessor (QSA) for PCI DSS audits.


One of the key findings of the research is that encryption and other uses of cryptography have become essential components of a data protection strategy and compliance program. Seventy-one percent of the auditors surveyed believe that an organization’s information assets cannot be fully protected, even within the corporate boundary, without the use of cryptography. Eighty-one percent believe that sensitive or confidential data should be encrypted whenever practical.

Business confidential information, health information and financial or accounting information and payment transactions (including credit cards) were considered the most important types of information to encrypt.

In considering where to recommend that cryptography should be most effectively deployed the, auditors cited an organization’s internal application infrastructure, external service providers (particularly cloud based SaaS), end user devices (laptops and desktops) and external business partners as the areas that are the greatest source of audit failures.

Selecting from the numerous scenarios where cryptography can be deployed within a typical organization the auditors most frequently rated the following as being highly effective in achieving compliance goals – desktop and mobile device encryption (76%), encryption of traffic over public networks (71%), database encryption (63%) and storage level encryption (56%).

Focusing specifically on the area of data confidentiality; encryption, whether deployed to protect a database, storage system, application or data entry system, is recommended more frequently over other techniques for protecting data such as tokenization, truncation and data masking – within databases and storage systems, encryption is recommended more than three times more often than any of these alternatives.

However, the auditors highlight key management as a primary deployment challenge. In particular, when auditors were asked to identify the most pressing issues, top of the list came the administration of key management systems (29%), protecting stored keys (20%) and controlling the use of keys (19%).

The findings support the use of hardware security modules (HSMs) to ease these key management challenges and achieve compliance. Sixty eight percent of the auditors responded that the use of HSMs for encryption and key management reduces the time spent on demonstrating compliance with privacy and data protection requirements. This compares to a figure of 63% when the Ponemon Institute asked the same question of more than 200 PCI DSS auditors (QSA’s) a year ago.

With the apparent growing recognition that HSMs play a critical part in the deployment of cryptography, it is not surprising that more than two thirds (79%) of auditors that took part in this new survey recommend the use of an HSM instead of relying on software-based systems to protect keys and enforce key management policies. Furthermore, 46% of the auditors surveyed go one step further and actually require the use of HSMs, a significant increase over the figure of 35% that imposed the same requirement among the QSAs surveyed a year ago.

In addition to quantifying attitudes towards cryptography the survey also questioned auditors regarding their general attitudes to compliance and IT security. The research found that the majority of auditors believe organizations are still not taking data security seriously and are not allocating sufficient resources to achieve data compliance requirements. Only 32 % of those surveyed say that the organizations they audit are proactive in managing privacy and data protection risks with less than half (45%) applying sufficient resources to achieve their data compliance requirements.