Story image

The basics of data encryption: What you need to know

17 May 2018

Encryption has long been held as one of the top data protection techniques available. While many are aware of the security advantages that encryption can offer, there is one main threat to its protection: the fact that some have yet to adopt it. With Europe’s GDPR only a few weeks away (25th May) there is no better time for organisations to be unlocking the potential in encryption and encryption keys.

Decoding the best encryption practices

When done properly, encryption provides one of the best starting points for protection against unauthorised intrusion, ensuring that only those permitted to view the content are able to. To ensure top notch security it’s necessary to understand the following best practices when deploying and utilising encryption.

Know your data

In today’s digital world, there’s a raft of information that’s valuable to hackers; payment card information, names, birthdates, tax file numbers and intellectual property belonging to a company. Organisations need to identify company critical valuable data, and data that could be a part of a notifiable breach and ensure that data is encrypted.

It’s also important to think about when to encrypt. When data is sitting in an overarching system with its own security measures, encryption may not be necessary. On the other hand, when content is in transit, or being sent to internal or external parties, encryption is the sender’s best bet to ensure the information is not intercepted along the way. It’s also best practice to ensure encryption is part of IT projects – whether new or when migrating to cloud.

Know who needs access

Not everyone within your organisation will require access to all encrypted data. Access should be restricted based on the need to know and least privilege security principles. This is imperative for organisations that want to enforce security policies for data access.

Once you’ve defined who needs access, ensure its actually them seeking access. Organisations can add a second layer of security through multi-factor authentication; whether configured to phone or text message. This will ensure that even if a hacker is attempting to imitate someone with a legitimate need for access, they won’t be able to access encrypted information.

Ensure encryption isn’t clouded when migrating

Cloud environments introduce all sorts of complexities to think through before embracing encryption. In hybrid or cloud environments, an organisation’s cloud vendor manages certain aspects of the system containing data and because of this organisations need an added protection measure to ensure that their company information remains secure.

When encryption is deployed within cloud-based materials like SaaS and data analytics applications, there are several important elements to consider. These include whether or not all functions of the program will remain available, if encryption will meet compliance needs and how keys will be generated.

In recent years cloud providers, including Microsoft and AWS have made encryption a lot easier and offer guidance for customers. While taking into account these extra precautions may seem cumbersome, including encryption in cloud security can not only offer protection for company information, but peace of mind for administrators as well.

Key management is key

Once the technology is set up, administrators must ensure the decryption key is properly managed. The keys themselves are subject to a number of security vulnerabilities. Decryption keys can be lost, stolen or destroyed accidentally. They can also expire after a predetermined period of time.

Organisations should select a secure location in which to keep their encryption keys, ensuring access is limited to only those authorised. A secondary, protected site should be chosen for the backup key and these locations should be maintained for the life of the secured information and its connected key.

In order to respond to the changes in privacy and breach notification laws, organisations must learn not only the benefits encryption can offer, but also the best practices needed for deployment.  With encryption, organisations stand a much better chance of thwarting unauthorised access and keeping information secure.

Article by Trend Micro Australia senior data scientist Jon Oliver.

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.