Cryptography Plays Critical Role in Data Protection Compliance
Thales, an information systems and communications security company, has released a survey and report, ‘What Auditors Think about Crypto Technologies’. The report, based on research recently conducted by The Ponemon Institute, reveals that crypto technologies play a crucial role in data protection and compliance activities across a wide range of industry sectors, in both private and public organisations.
More than 500 auditors were surveyed for the report with roughly half representing internal IT security audit teams and half representing independent external audit companies and consultancies. Almost half (44%) of those surveyed had more than 10 years of experience, with 46% holding the certified information systems auditor (CISA) accreditation and 24% acting as qualified security assessor (QSA) for Payment Card Industry Data Security Standard (PCI DSS) audits.
One of the key findings of the research is that encryption and other uses of cryptography have become essential components of a data protection strategy and compliance programme. Seventy-one percent of the auditors surveyed believe that an organisation’s information assets cannot be fully protected, even within the corporate boundary, without the use of cryptography. Eighty-one percent believe that sensitive or confidential data should be encrypted whenever practical. Business confidential information, health information and financial or accounting information and payment transactions (including credit cards) were considered the most important types of information to encrypt.
In considering where to recommend that cryptography should be most effectively deployed the, auditors cited an organization’s internal application infrastructure, external service providers (particularly cloud-based software-as-a-service (SaaS)), end user devices (laptops and desktops) and external business partners as the areas that are the greatest source of audit failures. Selecting from the numerous scenarios where cryptography can be deployed within a typical organisation the auditors most frequently rated the following as being highly effective in achieving compliance goals – desktop and mobile device encryption (76%), encryption of traffic over public networks (71%), database encryption (63%) and storage level encryption (56%).
Focusing specifically on the area of data confidentiality, encryption, whether deployed to protect a database, storage system, application or data entry system, is recommended more frequently over other techniques for protecting data such as tokenisation, truncation and data masking – within databases and storage systems, encryption is recommended more than three times more often than any of these alternatives. However, the auditors highlight key management as a primary deployment challenge. In particular, when auditors were asked to identify the most pressing issues, top of the list came the administration of key management systems (29%), protecting stored keys (20%) and controlling the use of keys (19%).
“The use of encryption to protect data is now past the point of debate, everyone is using it and this report corroborates this. However, the question to be addressed now is how, when and where to deploy the technology. The research indicates that there are indeed genuine areas of uncertainty when deploying encryption, particularly arising from the numerous business drivers and diverse compliance requirements,” said Dr Larry Ponemon, chairman and founder of The Ponemon Institute. “What organisations now need to do is ensure they adopt a strategic approach, proactively identifying and then following best practice when deploying cryptography to ensure they not only meet compliance around data protection but they also serve their wider security and operational needs.”