GSN February Digital Edition

• It is accessible if is it accidentally
or deliberately released?
As you catalog your data, start
with your data centers on-premise
and then move to your cloud and
virtual environments. Examine data
in storage, file servers, applications,
databases, and even removable media.
Don’t forget data that travels
across your network. Remember,
when data leaves your organization’s
borders, you lose control of it.
Protect your data
The place to start here is data in
motion. The availability of greater
bandwidth has allowed us all to
exchange information faster and
more frequently. Unfortunately, the
growth of huge volumes of oftensensitive
data transmitted across
networks presents real risks ranging
from malicious attacks to unintentional
transmission errors. Therefore
sensitive data in motion—
whether it’s moving across your
network or traveling between your
data centers—must be encrypted.
There are two main types of network
encryption for Ethernet networks:
integrated or dedicated.
Integrated encryption capability
within routers is sometimes called
‘onboard encryption’ or Layer 3 (Internet
Protocol Security – IPSec)
encryption. Dedicated encryption is
hardware-based and is referred to as
Layer 2 encryption.
In general, dedicated encryption
is the preferred way to protect data
in motion. Compared to Layer 3
(IPSec) encryption, Layer 2 networks
can be secured and encrypted
with dedicated appliances without
any loss of speed and performance,
minimal management, and greater
reliability. This results in a comparatively
lower cost per gigabyte.
But data in motion is only part of
an effective data protection strategy.
After all, data is not only at risk
when in motion, but also when at
rest on your servers or in storage.
For storage and media, the choices
are generally straightforward – usually
an “encrypt all or nothing“ approach.
For servers, there are many
different options that enable you to
encrypt dynamically. You can encrypt
specific files or folders, have
applications that make custom encryption
decisions, encrypt specific
columns of structured data, or encrypt
entire disks. These choices,
and the rules that can be applied
along with them, are a vital part of
your in-depth data defense.
Manage your protection
33
In addition to employing strong
encryption, it’s vital that your cryptographic
keys are treated with the
same level of care. Remember, the
only way to decrypt or unlock encrypted
data is through the accompanying
keys.
Indiscriminately protecting these
keys counteracts the entire process
of encryption and creates a false
sense of security. Therefore, the security
deployment should utilize
best practices for both encryption,
as well as key management.
For maximum security, dedicated
hardware key management protects
sensitive cryptographic keys from
attack. Its high security design ensures
the integrity and protection of
encryption keys throughout their
lifecycle. Storing cryptographic keys
and certificates in hardware that
wraps multiple levels of security
eliminates the risk of loss or theft,
and is the only definitive method
of ensuring and enforcing trusted,
granular security policies.
By thoroughly understanding
these three steps to encrypting data,
you have the foundation for any
successful data protection strategy.
Shawn Campbell is VP of Product
Management, SafeNet Assured Technologies.
He can be reached at
Shawn.Campbell@safenetat.com