Story image

The basics of data encryption: What you need to know

17 May 18

Encryption has long been held as one of the top data protection techniques available. While many are aware of the security advantages that encryption can offer, there is one main threat to its protection: the fact that some have yet to adopt it. With Europe’s GDPR only a few weeks away (25th May) there is no better time for organisations to be unlocking the potential in encryption and encryption keys.

Decoding the best encryption practices

When done properly, encryption provides one of the best starting points for protection against unauthorised intrusion, ensuring that only those permitted to view the content are able to. To ensure top notch security it’s necessary to understand the following best practices when deploying and utilising encryption.

Know your data

In today’s digital world, there’s a raft of information that’s valuable to hackers; payment card information, names, birthdates, tax file numbers and intellectual property belonging to a company. Organisations need to identify company critical valuable data, and data that could be a part of a notifiable breach and ensure that data is encrypted.

It’s also important to think about when to encrypt. When data is sitting in an overarching system with its own security measures, encryption may not be necessary. On the other hand, when content is in transit, or being sent to internal or external parties, encryption is the sender’s best bet to ensure the information is not intercepted along the way. It’s also best practice to ensure encryption is part of IT projects – whether new or when migrating to cloud.

Know who needs access

Not everyone within your organisation will require access to all encrypted data. Access should be restricted based on the need to know and least privilege security principles. This is imperative for organisations that want to enforce security policies for data access.

Once you’ve defined who needs access, ensure its actually them seeking access. Organisations can add a second layer of security through multi-factor authentication; whether configured to phone or text message. This will ensure that even if a hacker is attempting to imitate someone with a legitimate need for access, they won’t be able to access encrypted information.

Ensure encryption isn’t clouded when migrating

Cloud environments introduce all sorts of complexities to think through before embracing encryption. In hybrid or cloud environments, an organisation’s cloud vendor manages certain aspects of the system containing data and because of this organisations need an added protection measure to ensure that their company information remains secure.

When encryption is deployed within cloud-based materials like SaaS and data analytics applications, there are several important elements to consider. These include whether or not all functions of the program will remain available, if encryption will meet compliance needs and how keys will be generated.

In recent years cloud providers, including Microsoft and AWS have made encryption a lot easier and offer guidance for customers. While taking into account these extra precautions may seem cumbersome, including encryption in cloud security can not only offer protection for company information, but peace of mind for administrators as well.

Key management is key

Once the technology is set up, administrators must ensure the decryption key is properly managed. The keys themselves are subject to a number of security vulnerabilities. Decryption keys can be lost, stolen or destroyed accidentally. They can also expire after a predetermined period of time.

Organisations should select a secure location in which to keep their encryption keys, ensuring access is limited to only those authorised. A secondary, protected site should be chosen for the backup key and these locations should be maintained for the life of the secured information and its connected key.

In order to respond to the changes in privacy and breach notification laws, organisations must learn not only the benefits encryption can offer, but also the best practices needed for deployment.  With encryption, organisations stand a much better chance of thwarting unauthorised access and keeping information secure.

Article by Trend Micro Australia senior data scientist Jon Oliver.

Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.
Why total visibility is the key to zero trust
Over time, the basic zero trust model has evolved and matured into what Forrester calls the Zero Trust eXtended (ZTX) Ecosystem.
Gartner names Proofpoint Leader in enterprise information archiving
The report provides a detailed overview of the enterprise information archiving market and evaluates vendors based on completeness of vision and ability to execute.