Owing to the ever increasing risk of breaches, ensuring data security has become a crucial consideration in devising organisational strategies. With the number and complexity of threats in the cyber security landscape on the rise, IT teams across sectors are striving hard to safeguard their organisation’s data assets. Also, the changes brought about by the evolution of cloud environments have made it even more difficult to protect data, be it at rest or in transit. Thus, organisations are now taking a data-centric approach to protecting sensitive information, which has led to data encryption gaining more importance in the recent past.
The main issue that plagues the industry is that while most organisations still doubt if they should encrypt their backups, others remain unsure about how/where to store the keys to their backup encryption. In addition, the high overhead cost involved in encryption key management, which is imperative for safeguarding and accessing data effectively, has also made businesses shy away from storage encryption technology. Apart of this, there are also a few other risks associated with data encryption.
- It is applied in different ways to protect a wide range of data types. Usually, layers are used, with each of them playing a crucial role. Thus, the lack of a strategic approach to execution results in increased business risk, costs and complexity.
- Since encryption is a mature technology, attackers seldom try to break the encryption algorithm. They mostly target the encryption processes and keys used to manage it. However, since most businesses are prone to focusing more on encryption and overlooking the problem of key management altogether, their data becomes vulnerable.
- Organisations often fail to understand that the risk of key loss is graver than that of key theft. Losing the key would mean losing all the data available/stored. Thus, in scenarios where manual processes are used for key management, poorly trained staff and poor documentation pose a great threat.
In addition, it is necessary to maintain regulatory compliance and incorporate best practices in the system. However, the relationship between authentication and encryption needs to be kept in mind while employing defence-in-depth strategies for data protection. While encryption itself isn’t complicated, businesses fear that the processes used for verification can affect user experience significantly. At the same time, however, they also understand that strict and effective measures are required for authentication in order to prevent unauthorised access and instances of missing, corrupted or compromised keys, which inevitably lead to loss of data.
Compounding the problem even further is the lack of unified tools. In addition, most keys and key management tools aren’t interoperable, since every supplier implements encryption in a different way.
Thus, what organisations need is a comprehensive encryption platform that would not only deliver robust access controls, but also ensure efficient key management to help them leverage encryption cost-effectively for addressing their data security objectives. Also, they must establish clear policies to ensure that the practices are consistent and effective across deployments.
Iranna is a former Happiest Mind and this content was created and published during his tenure.
