Enterprise encryption and key management strategy
Posted on 16 April 2012.
Encryption technologies are being implemented in a disorganized, ad hoc manner that leads to increased security risks and costs, according to a report by Jon Oltsik, Senior Principal Analyst with research firm ESG.


According to Oltsik, "When it comes to information strategy, large organizations tend to focus on firefighting rather than long-term strategy. Unfortunately, this short-sighted approach has its limits. Ad hoc encryption leads to redundant processes, complex operations, and high costs while placing sensitive data at risk of accidental compromise or malicious insider attack."

Several factors are driving the increase in data encryption, including: regulatory compliance, an increase in publicly disclosed breaches, and the need to protect intellectual property from APTs. According to ESG, 54% of organizations have deployed data encryption technologies in response to APTs.

"Current point products do a good job of protecting private data in isolated areas, but they don't provide a comprehensive solution to data privacy issues across the enterprise," states Oltsik.

The report cites the four most common enterprise encryption and key management shortcomings as:

1. A lack of standards and management by disparate functional IT groups without data security expertise.

2. No central command and control - each tool has its own policies, provisioning and management of keys.

3. Disorganized key management systems that place data at risk for a security breach and unrecoverable critical files.

4. Organizational misalignment that doesn't address insider threats by providing adequate access management and separation of duties.

"CISOs have lots of choices with ad hoc encryption, but they will find a much shorter list of qualified vendors as they begin researching and evaluating options for an enterprise encryption and key management architecture," concluded Olstik.

The report provides the following checklist for evaluating vendors that can support a unified encryption and management key strategy on an enterprise scale:
  • Support for heterogeneous servers including Linux, UNIX, and Windows
  • Protection for structured and unstructured data
  • Centralized policy creation and management
  • Distributed policy enforcement
  • Tiered administration
  • Separation of duties
  • Key management that spans both third party and DBMS-based encryption.
The complete report is available here (registration required).





Spotlight

What can we learn from the top 10 biggest data breaches?

Posted on 21 August 2014.  |  Here's a list of the top 10 biggest data breaches of the last five years. It identifies the cause of each breach as well as the resulting financial and reputation damage suffered by each company.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //