Encryption: Securing Sensitive Data in Changing Corporate Environments

As corporate data moves beyond the firewall and into the cloud and Internet of Things, encryption becomes more important than ever. We cover everything from encryption basics to solutions.

Data security has traditionally been seen as a matter of locking down data in a physical location, such as a data center. But as data migrates across networks, borders, mobile devices, and into the cloud and Internet of Things (IoT), focusing solely on the physical location of data is no longer relevant.

To prevent disclosure of sensitive corporate data to unauthorized people in this new corporate environment, data needs to be secured. Encryption and data masking are two primary ways for securing sensitive data, either at rest or in motion, in the enterprise.  It is an important part of endpoint security.

Encryption is the process of encoding data in such a way that only authorized parties can access it. Using homomorphic encryption, sensitive data in plaintext is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted.

In data masking, “fake” data replaces real data for users who should not have access to the real data, whether because of their role in the company or because they are attackers. Masking ensures sensitive data is obscured or otherwise de-identified.

Dynamic data masking can transform the data based on the user roles and privileges. It is used to secure real-time transactional systems and improve data privacy, compliance implementation, and maintenance.

With data masking, data is retained in its native form, and no decryption key is necessary. The resulting data set does not contain any references to the original information, making it useless for attackers.

Encryption scrambles data using nonreadable mathematical calculations and algorithms. An encryption system employs an encryption key generated by an algorithm. While it is possible to decrypt the data without possessing the key, significant computational resources and skills would be required if the encryption system is designed properly. An authorized recipient can easily decrypt the message with the key provided by the originator.

If the encryption key is lost or damaged, it may not be possible to recover the encrypted data from the computer. Therefore, enterprises need to set up rigorous key management processes, procedures, and technologies before implementing data encryption technologies. 

Organizations should consider how key management practices can support the recovery of encrypted data if a key is lost or destroyed. Those planning on encrypting removable media need to consider how changing keys will impact access to encrypted storage on removable media, such as USB drives, and develop solutions, such as retaining the previous keys in case they are needed.

Encryption can be applied to endpoint drives, servers, email, databases, and files. The appropriate encryption depends upon the type of storage, the amount of data that needs to be protected, environments where the storage will be located, and the threats that need to be stopped.

Public key encryption is one use of public key cryptography, also known as asymmetric cryptography. Digital signature, in which a message is signed with the sender’s private key and can be verified by anyone who has access to the sender’s public key, is another well-known use of public key cryptography.

There are three primary types of encryption solutions: full disk encryption, volume/virtual disk encryption, and file/folder encryption. When selecting encryption types, enterprises should consider the range of solutions that meet their security requirements, not just the type that is most commonly used.