Despite added costs and complexity, business and government sectors are becoming wedded to data encryption, even though at times it’s like an arranged marriage driven by regulatory compliance and fear of data-breach fiascos.
“We now require encryption for data at rest on laptops in the Air Force,” says Greg Garcia, member of the senior executive service of the U.S. Air Force and director of the 754th Electronic Systems Group at Gunter Air Force Base in Montgomery, Ala. The group sets security policy for the 500,000 laptops used by the Air Force.
“The contract we awarded for this grew out of what happened at Veterans Affairs,” Garcia points out, alluding to the data-breach fiascos of this year and last that led to millions of veterans’ personal information being exposed on lost and stolen laptops.
The VA data-breach incidents spurred the White House Office of Management and Budget, the Department of Defence and the civilian-side General Services Administration to look at government wide approaches for “data at rest” encryption.
The outcome was the U.S. government’s first-ever blanket purchasing agreements (BPAs) for data-at-rest encryption products to protect sensitive but unclassified data on government laptops and removable storage devices.
BPAs were awarded in June to 11 resellers, including Intelligent Decisions, MTM Technologies and GovBuys.
The encryption products on the lists include Mobile Armor’s Data Armor, SafeBoot’s (acquired by McAfee for US$350 million in October) SafeBoot Device Encryption, Information Security’s Secret Agent, SafeNet’s SafeNet protectDrive, Encryption Solutions’ Skylock At-Rest, Pointsec Mobile Technologies’ Pointsec, Syprus’ Talisman/DS Data Security Suite, WinMagic’s SecureDoc, Credant Technologies’ CredantMobile Guardian and GuardianEdge Technologies’ GuardianEdge.
State and local government viewpoint
What’s known as the data-at-rest encryption BPAs are also available for use by state and local governments. The Tennessee Department of Revenue is going its own way in adding encryption to its mobile laptops by deploying Entrust encryption software this fall.
“Our data is very confidential, and we have a mobile workforce of about 300 auditors and revenue officers who travel across the country as well as the state,” says Don Derrick, director of information technology resources. “Our strategy is to encrypt these devices first.”
The two Entrust software products, Entrust Entelligence Disk Security and Media Security, costs US$149 and $28 per licensee, respectively. The department cannot afford to give encryption software to all its employees, although the department now requires encryption to keep personal financial information protected on a mobile computers carried from place to place.
“This is our policy now, and if you’re writing to a DVD or CD to be given to a citizen, any confidential data has to be encrypted there too,” says Derrick. The citizen would get a password courtesy of Tennessee to decrypt the data.
While the agency didn’t decide to deploy encryption specifically because of the VA data-breach incidents, Derrick acknowledges it’s hard to forget them.
Data privacy regulations driving encryption
Other factors, chief among them compliance with regulatory requirements for banking, healthcare and credit-card processing, are driving encryption of sensitive information around the world.
Outside of government, banks have long been the most ambitious in the commercial sector in deploying encryption.
“We use PGP to encrypt sensitive data,” says John Meakin, group head of information security at U.K.-based Standard Chartered Bank about encrypting mobile laptops for business travelers. “We have to satisfy regulatory requirements.”
These include the European Union Data Protection Directive, Japan’s Personal Information Privacy Act, and Canada’s Personal Information Protection and Electronic Documents Act. In the United States, the well-known drivers are the Health Insurance Portability and Accountability Act and the Sarbanes-Oxley Act.
“There are many state and federal regulations we have to comply with, such as Sarbanes-Oxley and HIPAA,” says Helen Thompson, CIO at Heartland Health, based in St. Joseph’s, Mo. The hospital makes use of encryption to ensure that patient information shared with health-insurance companies via the Internet is encrypted using either PGP or Microsoft Windows encryption.
Oftentimes companies adopt the approach of encrypting outgoing e-mail at the gateway.
Career Education Corp., which operates 80 post-secondary schools in the United States, Europe and the Middle East, now deploys the PGP Universal Encryption Gateway for encrypting outbound e-mail containing sensitive information in student records.
The sensitive information is detected by the Vontu data-leak-prevention gateway after the IronPort mail filter checks for authorized routes, and if the e-mail needs to be encrypted, it’s sent to the PGP Universal Encryption Gateway.
“This is all part of our privacy initiative,” says Michael Gabriel, chief information security officer at Hoffmann Estates, Ill.-based Career Education.
The Payment Card Industry Data Security Standard is a set of security requirements for organizations accepting credit- and debit-card payments. One of the requirements specifically requires encryption of card data, and its effect is spurring ever-greater use of encryption.
“If you don’t adhere to PCI, you risk fines against you, and you wouldn’t be able to accept credit cards,” notes Gavin Woolnaugh, infrastructure manager at U.K.-based AirMiles, which has deployed Ingrian Networks point-to-point appliances for encrypting credit cards.
Drawbacks to encryption?
PGP Director of Product Management John Dasher says the main barrier to encryption use over the years has been finding methods to exchange public encryption keys easily with large numbers of people outside the organization, such as business partners. Keys are used to encrypt and decrypt information.
The approach PGP has taken is to make its key look-up function automatic through a global directory. “We have hundreds of thousands of entries in it now,” he says.
“Just encrypting data is not the hard part,” says Paul Kocher, president and chief scientist at Cryptography Research, the San Francisco-based firm for design and analysis of security systems, who says the Advanced Encryption Standard is the most popular cryptography algorithm used in business today. “How do you decide how to regulate who should have access to keys? The strength of an encryption system is only as strong as the key.”
Some security vendors argue encryption can actually be viewed as a threat, too.
“Encryption could be used as a way to mask bad behavior,” says Tom Bennett, vice president of marketing at Oakley Networks. “There should be a mechanism to monitor if someone is using encryption as a way to hide something.”
Oakley’s endpoint-monitoring software can be used to determine if a very sensitive file is being encrypted in violation of the corporation’s security policy. “If a CAD file is encrypted and sent out early one morning, we’d be able to replay that event and reconstruct what happened,” Bennett says.
Related content:
Another data breach at Veterans Affairs
