Encryption is a staple security control for most organizations. In a recent Ponemon study, enterprise use of encryption hit an all-time high this year with 45 percent of organizations now having a comprehensive encryption policy in place. Conversely, just 13 percent of organizations have no encryption capabilities. What is the biggest challenge organizations face in implementing their encryption policy? Simply having visibility into their data and knowing which needs to be protected.
What is Encryption?
According to Techopedia, Encryption is the process of algorithmically transforming information to make it unreadable for unauthorized users. The encoded data may only be decrypted or made readable with a key and while it can be used to protect data at rest, it’s most often used during the transfer of information. In 2018, encrypted traffic reached 72 percent of all network traffic – a 20 percent increase over the year prior.
Encryption means data is only readable by senders and receivers, not third parties who may be trying to get their hands on it. In the age of big data, where organizations collect and share information at unprecedented rates, encryption is a critically important tool.
Adoption Driver: Compliance
Along with the need to protect against rising data breaches, another primary driver behind increasing encryption use is compliance. Data protection laws – including GDPR, CCPA, PIPEDA – require organizations to prove that encryption was in place at the time of a security incident or face some hefty fines – to the tune of $3.86 million dollars which is the average cost of a data breach now.
GDPR repeatedly highlights encryption as an ‘appropriate technical and organizational measure of personal data security.’ Under GDPR, organizations must notify regulators and impacted individuals of a data breach within 72 hours of the incident unless the data in question was sufficiently encrypted.
Having encryption in place can save your organization from potentially disastrous reputational damage. More than the cost of the fines, reputational damage caused by losing the trust in the eyes of customers and the public can ultimately be the factor that destroys an organization’s success.
The Human Element
Encryption isn’t without its challenges however and a big one is the very people who use it. Users are often the weak link in your security chain – another new study found employee mistakes continue to be the most significant threat to data security. Encryption may be mathematically guaranteed but it can also be complicated to implement and confusing for users. This often leads to employees disabling it or insecurely sharing decrypt keys which makes the entire program void.
Device Complexity Creates False Sense of Security
Encryption is a powerful tool but it’s still just one ingredient in your overall security mix. It is most often paired with other endpoint security solutions such as patch management, antivirus and antimalware along with firewalls, SIEM solutions and many others. All have their place, but the rising number of solutions deployed on any given device contributes to significant complexity making monitoring them a challenge. Tools don’t always integrate or work well together and/or controls easily become misconfigured.
The high volume of security tools often provides a false sense of security because broken tools can leave big gaps in an organization’s defenses. Instead, IT and security teams need to be able to better understand what’s happening on their devices and respond to suspicious events to reduce security failures. Adding more and more security controls to the endpoint may perpetuate the risk.
It’s imperative that encryption and any other fundamental security tools are working at all times, as intended in order to have visibility and control over devices that contain data or network access.
To learn more about how security tools degrade and how you can analyze the tools you already have to identify blind spots or opportunities to strengthen your defenses, listen to the recent webinar we did with Forrester analyst, Renee Murphy titled The State of Endpoint Security in 2019.