{"id":2486,"date":"2013-06-13T00:00:00","date_gmt":"2013-06-13T00:00:00","guid":{"rendered":"http:\/\/otava.test\/why-what-and-how-to-encrypt-security-expert-insights\/"},"modified":"2013-06-13T00:00:00","modified_gmt":"2013-06-13T00:00:00","slug":"why-what-and-how-to-encrypt-security-expert-insights","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/why-what-and-how-to-encrypt-security-expert-insights\/","title":{"rendered":"Why, What and How to Encrypt: Security Expert Insights"},"content":{"rendered":"

Not sure if your organization\u2019s sensitive data is properly encrypted? It\u2019s time to be sure. Chris Heuman, Practice Leader for RISC Management and Consulting, broke down the reasons why (and how) in the latest webinar hosted by Online Tech.<\/p>\n

Heuman cites that unencrypted data is being breached regularly, and those breaches come at a staggering cost. On average, security breaches affect 42,659 individuals and cost organizations $8,275,865 (yes, that\u2019s nearly $8.3 million) to respond.<\/p>\n

That price tag includes the cost of fines, penalties, legal counsel and distribution of settlements to harmed individuals, but does not include the financial equivalent of the damage made to an organization\u2019s reputation, the resources needed to respond to unannounced audits in the future or myriad other related costs.<\/p>\n

\u201cWhen you think of these numbers and compare it to the cost of implementing an encryption program, you\u2019ll find the expense of the program isn\u2019t quite as high as you thought it was,\u201d he said.<\/p>\n

Heuman\u2019s presentation, titled Encryption: Perspective on Privacy, Security & Compliance<\/a><\/em>, was the first of three encryption-focused presentations scheduled for the month of June. Online Tech software development manager Farooq Ahmed and Mark Stanislav of Duo Security will co-host Encryption at the Software Level: Linux and Windows<\/a><\/em> on June 18 and Stanislav will join Online Tech systems support manager Steve Aiello on June 25 for Encryption at the Hardware and Storage Level<\/a><\/em>.<\/p>\n

In his 48-minute presentation, Heuman discussed why to bother encrypting, what data to encrypt, how to encrypt it, how to document that encryption and how to test it. A brief summary of his presentation follows, but we suggest checking out the slides and a video replay of the presentation here<\/a>.<\/p>\n

Why Bother to Encrypt<\/strong>
\nIf the figures above weren\u2019t motivation enough, there are a myriad of reasons to encrypt data, including the government regulations (HIPAA<\/a>, PCI<\/a> and SOX compliance<\/a>), frameworks and industry requirements that any organization that stores sensitive information has to deal with.<\/p>\n

\u201cPrivacy and security is a life cycle, not a one-time event,\u201d Heuman said. \u201cEncryption is a control mechanism that is implemented after proper analysis has been completed and policies stating the intent have been put into place.<\/p>\n

\u201cDon\u2019t jump the gun and start implementing encryption without attending to all the analysis and preparatory steps. It\u2019s important to walk through this in a logical manner and to make well thought-out decisions rather than to jump head first into technical implementation.\u201d<\/p>\n

What to Encrypt<\/strong>
\nThe first key step to proper encryption of data is to perfectly understand all of the places that data is stored.<\/p>\n

\u201cIf you don\u2019t know where your data is located or how sensitive it is, you can\u2019t protect it,\u201d Heuman said. \u201cThis is not just for encryption, but any information security control. If you don\u2019t have a good understanding you either have to protect everything, which can be very expensive, or risk being paralyzed at the analysis phase and not accomplish anything at all.\u201d<\/p>\n

Heuman presented an encryption project management plan that all organizations should follow:<\/p>\n