Encryption technologies are being implemented in a disorganized, ad hoc manner that leads to increased security risks and costs, according to a report by Jon Oltsik, Senior Principal Analyst with research firm ESG.


According to Oltsik, "When it comes to information strategy, large organizations tend to focus on firefighting rather than long-term strategy. Unfortunately, this short-sighted approach has its limits. Ad hoc encryption leads to redundant processes, complex operations, and high costs while placing sensitive data at risk of accidental compromise or malicious insider attack."

Several factors are driving the increase in data encryption, including: regulatory compliance, an increase in publicly disclosed breaches, and the need to protect intellectual property from APTs. According to ESG, 54% of organizations have deployed data encryption technologies in response to APTs.

"Current point products do a good job of protecting private data in isolated areas, but they don't provide a comprehensive solution to data privacy issues across the enterprise," states Oltsik.

The report cites the four most common enterprise encryption and key management shortcomings as:

1. A lack of standards and management by disparate functional IT groups without data security expertise.

2. No central command and control - each tool has its own policies, provisioning and management of keys.

3. Disorganized key management systems that place data at risk for a security breach and unrecoverable critical files.

4. Organizational misalignment that doesn't address insider threats by providing adequate access management and separation of duties.

"CISOs have lots of choices with ad hoc encryption, but they will find a much shorter list of qualified vendors as they begin researching and evaluating options for an enterprise encryption and key management architecture," concluded Olstik.

The report provides the following checklist for evaluating vendors that can support a unified encryption and management key strategy on an enterprise scale:

• Support for heterogeneous servers including Linux, UNIX, and Windows
• Protection for structured and unstructured data
• Centralized policy creation and management
• Distributed policy enforcement
• Tiered administration
• Separation of duties
• Key management that spans both third party and DBMS-based encryption.

The complete report is available here (registration required).