GSN February Digital Edition

Campbell on Crypto
Encryption Basics: Three Steps
to Better Data Protection
By Shawn Campbell
In previous columns for Government
Security News, I’ve said that
security professionals need to accept
the fact that security breaches
will happen.
Perimeter security isn’t sufficient
for protecting your
organization from
breaches. For overall
protection of sensitive
data, you have to
focus on safeguarding
your data, not just
your network. That
means encryption.
Encryption is the hot topic in cybersecurity.
It’s at the core of many
security tools we use for everyday
transactions and communications.
And because it protects data in
motion and data at rest, it’s often
thought to be the holy grail of data
protection.
During the encryption process,
plaintext (data in its original format)
is encrypted through an algorithm
into unreadable ciphertext
(the result of applying a cryptographic
cipher to plaintext). The
encryption process generates cryptographic
keys that can be used to
lock (encrypt) and unlock (decrypt)
the ciphertext.
Effectively protecting your data
boils down to three steps, and at
The growth of huge volumes of often-sensitive
data transmitted across networks presents
real risks ranging from malicious attacks to
unintentional transmission errors.
their core they all involve encryption:
• Know your data. You have to
know what you need to protect.
• Protect your data. Once you’ve
identified the data you need to protect,
you have to encrypt the data to
keep it safe.
• Manage your protection. Encrypted
data requires encryption
keys to lock and unlock data, and
you have to be sure your keys are all
securely stored and managed.
It’s important to remember that
32
encryption inherently applies protection
to the data itself. Even if
your perimeters are breached, your
data is still protected. That should
offer some relief in these days of
more frequent network security
breaches, and it underscores
the reason
you should extend
your controls from
protecting the perimeter
to protecting
the data.
Now let’s take a
closer look at each
of the three steps for effective data
encryption.
Know your data
First, you need to catalog the data
you have, and determine its level of
sensitivity. Then you must assess
where it resides, and what protections
are in place for the sensitive
data. Some key questions to ask are:
• Is it in a physically secure environment?
• It is accessible only to people
who need to see it?