The basics of data encryption: What you need to know

Encryption has long been held as one of the top data protection techniques available. While many are aware of the security advantages that encryption can offer, there is one main threat to its protection: the fact that some have yet to adopt it. With Europe's GDPR only a few weeks away (25th May) there is no better time for organisations to be unlocking the potential in encryption and encryption keys.

Decoding the best encryption practices

When done properly, encryption provides one of the best starting points for protection against unauthorised intrusion, ensuring that only those permitted to view the content are able to. To ensure top notch security it's necessary to understand the following best practices when deploying and utilising encryption.

Know your data

In today's digital world, there's a raft of information that's valuable to hackers; payment card information, names, birthdates, tax file numbers and intellectual property belonging to a company. Organisations need to identify company critical valuable data, and data that could be a part of a notifiable breach and ensure that data is encrypted.

It's also important to think about when to encrypt. When data is sitting in an overarching system with its own security measures, encryption may not be necessary. On the other hand, when content is in transit, or being sent to internal or external parties, encryption is the sender's best bet to ensure the information is not intercepted along the way. It's also best practice to ensure encryption is part of IT projects – whether new or when migrating to cloud.

Know who needs access

Not everyone within your organisation will require access to all encrypted data. Access should be restricted based on the need to know and least privilege security principles. This is imperative for organisations that want to enforce security policies for data access.

Once you've defined who needs access, ensure its actually them seeking access. Organisations can add a second layer of security through multi-factor authentication; whether configured to phone or text message. This will ensure that even if a hacker is attempting to imitate someone with a legitimate need for access, they won't be able to access encrypted information.

Ensure encryption isn't clouded when migrating

Cloud environments introduce all sorts of complexities to think through before embracing encryption. In hybrid or cloud environments, an organisation's cloud vendor manages certain aspects of the system containing data and because of this organisations need an added protection measure to ensure that their company information remains secure.

When encryption is deployed within cloud-based materials like SaaS and data analytics applications, there are several important elements to consider. These include whether or not all functions of the program will remain available, if encryption will meet compliance needs and how keys will be generated.

In recent years cloud providers, including Microsoft and AWS have made encryption a lot easier and offer guidance for customers. While taking into account these extra precautions may seem cumbersome, including encryption in cloud security can not only offer protection for company information, but peace of mind for administrators as well.

Key management is key

Once the technology is set up, administrators must ensure the decryption key is properly managed. The keys themselves are subject to a number of security vulnerabilities. Decryption keys can be lost, stolen or destroyed accidentally. They can also expire after a predetermined period of time.

Organisations should select a secure location in which to keep their encryption keys, ensuring access is limited to only those authorised. A secondary, protected site should be chosen for the backup key and these locations should be maintained for the life of the secured information and its connected key.

In order to respond to the changes in privacy and breach notification laws, organisations must learn not only the benefits encryption can offer, but also the best practices needed for deployment.  With encryption, organisations stand a much better chance of thwarting unauthorised access and keeping information secure.