Story image

The basics of data encryption: What you need to know

17 May 2018

Encryption has long been held as one of the top data protection techniques available. While many are aware of the security advantages that encryption can offer, there is one main threat to its protection: the fact that some have yet to adopt it. With Europe’s GDPR only a few weeks away (25th May) there is no better time for organisations to be unlocking the potential in encryption and encryption keys.

Decoding the best encryption practices

When done properly, encryption provides one of the best starting points for protection against unauthorised intrusion, ensuring that only those permitted to view the content are able to. To ensure top notch security it’s necessary to understand the following best practices when deploying and utilising encryption.

Know your data

In today’s digital world, there’s a raft of information that’s valuable to hackers; payment card information, names, birthdates, tax file numbers and intellectual property belonging to a company. Organisations need to identify company critical valuable data, and data that could be a part of a notifiable breach and ensure that data is encrypted.

It’s also important to think about when to encrypt. When data is sitting in an overarching system with its own security measures, encryption may not be necessary. On the other hand, when content is in transit, or being sent to internal or external parties, encryption is the sender’s best bet to ensure the information is not intercepted along the way. It’s also best practice to ensure encryption is part of IT projects – whether new or when migrating to cloud.

Know who needs access

Not everyone within your organisation will require access to all encrypted data. Access should be restricted based on the need to know and least privilege security principles. This is imperative for organisations that want to enforce security policies for data access.

Once you’ve defined who needs access, ensure its actually them seeking access. Organisations can add a second layer of security through multi-factor authentication; whether configured to phone or text message. This will ensure that even if a hacker is attempting to imitate someone with a legitimate need for access, they won’t be able to access encrypted information.

Ensure encryption isn’t clouded when migrating

Cloud environments introduce all sorts of complexities to think through before embracing encryption. In hybrid or cloud environments, an organisation’s cloud vendor manages certain aspects of the system containing data and because of this organisations need an added protection measure to ensure that their company information remains secure.

When encryption is deployed within cloud-based materials like SaaS and data analytics applications, there are several important elements to consider. These include whether or not all functions of the program will remain available, if encryption will meet compliance needs and how keys will be generated.

In recent years cloud providers, including Microsoft and AWS have made encryption a lot easier and offer guidance for customers. While taking into account these extra precautions may seem cumbersome, including encryption in cloud security can not only offer protection for company information, but peace of mind for administrators as well.

Key management is key

Once the technology is set up, administrators must ensure the decryption key is properly managed. The keys themselves are subject to a number of security vulnerabilities. Decryption keys can be lost, stolen or destroyed accidentally. They can also expire after a predetermined period of time.

Organisations should select a secure location in which to keep their encryption keys, ensuring access is limited to only those authorised. A secondary, protected site should be chosen for the backup key and these locations should be maintained for the life of the secured information and its connected key.

In order to respond to the changes in privacy and breach notification laws, organisations must learn not only the benefits encryption can offer, but also the best practices needed for deployment.  With encryption, organisations stand a much better chance of thwarting unauthorised access and keeping information secure.

Article by Trend Micro Australia senior data scientist Jon Oliver.

Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
Ransomware’s decline equals cryptomining’s rise
ESET’s Security Days Conference recently took place to go over the current threat environment and what to look out for next.
IoT and DDoS attacks: A match made in heaven
A10 Network’s Adrian Taylor uses findings from a number of reports to illustrate his point that advances in technology are facilitating cybercrime.
ForgeRock launches Sandbox-as-a-Service to facilitate compliance
The cloud-based testing environment for APIs enables banks to accelerate compliance with Open Banking and PSD2 deadlines.
Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.