End-to-end encryption is the key to protecting data and reputations

PCI DSS is a set of requirements developed by the card issuers to safeguard cardholder data security throughout its lifecycle, while it is stored, processed or transmitted. Organizations that work with the card schemes are obliged to undergo annual verification of their compliance with PCI DSS each year by qualified assessors. Then there is the whole issue of encryption.

Encryption is new for many organizations striving to become and remain PCI-compliant and there is a limit to how aggressive you can be in mandating its deployment. PCI DSS therefore addresses the two most vulnerable areas – data in transit across public networks such as the Internet and during storage.

In order to avoid the financial and brand damage associated with data breaches, businesses need to consider deploying end-to-end encryption as a tamper proof way of securing data, regardless of whether encryption is explicitly mandated by a piece of regulation or simply recommended. To date it has largely been banks and governments who have taken advantage of encryption to secure information. However, almost every organization handles information that someone somewhere regards as being private or valuable and there is an implicit and increasingly explicit obligation to protect it.

Specific reference to the use of encryption is increasingly found in privacy mandates and industry best practices that attempt to go beyond the traditional focus on “people and processes”. Furthermore, encryption is often favored by regulators and policy makers because of the black and white nature of the technology. Data is either encrypted or it is not, which in theory means it is either secure or not; a very measurable parameter which is well received by auditors and regulators.

Under lock and key
Of course, things are never quite that simple. Despite the growing recognition of the benefits of encryption, there remains a general lack of understanding about deploying and, more importantly, managing it. Encryption itself is simple, it’s just mathematics. The hard bit is controlling the keys – the secret codes that have the power to unlock the data. Without good encryption key management, what you thought was black or white may actually have many shades of grey. A 2008 Trust Catalyst survey found that organizations see key management as the biggest challenge in encryption.

As the use of encryption grows, companies need to be able to manage (or control) a growing number of encryption keys. This is crucial not only to prevent keys from being lost or stolen, but also for important operational reasons such as on-demand recovery of encrypted data, automated updates and compliance reporting. Once encrypted, information only becomes readable if the encryption key is available to unlock it. Consequently, the key becomes as valuable as the data it is protecting. This situation can be likened to the security of a home – locking the house significantly increases the security of its contents. However, if the key is then left under the mat, then the level of security is compromised. In the same way, while encryption is an effective first step in enhancing data security, encryption keys need to be stored and managed effectively in order to ensure data is secure. Many companies have found themselves in a situation where they need to manage thousands or even many millions of keys as they deploy separate encryption and key management systems to protect different areas of their IT infrastructure, such as laptops, storage systems and databases. This typically involves manual processes to generate, distribute, store, expire, and refresh encryption keys and very often results in increased operational costs, delays in meeting audit and compliance requirements and increased risk of human error.

With new silos of encryption taking root across the organization, security officers and administrators are being forced to act and to formalize and institutionalize good key management practices. Finding the encryption keys is a lot easier than cracking the encryption and this is where much criminal activity is focused. With encryption effectively impossible to break, the key management system becomes a natural target for attack. Consequently, key management issues need to be at the core of every company’s IT security infrastructure.

Good key management
Keys stored in software are subject to attack by Trojans, other spyware or even malicious use of debugging and system maintenance tools. To mitigate these threats, techniques to provide enhanced physical and logical security in hardware have become well established, for example through the use of hardware security modules (HSMs) and security certifications such as the Federal Information Processing Standard (FIPS) and Common Criteria.

Whilst much of the burden of implementing good key management lies with security professionals within organizations, there are several initiatives underway that are designed to guide the process. Key management standards such as the Key Management Interoperability Protocol (KMIP) and IEEE 1619.3 are nearing ratification, deployment best practices are well understood within the auditing community and second generation key management products are reaching the market. Measures such as these will help enable organizations to implement cohesive key management strategies moving forward. Once a well thought-through approach to key management is established, effective security policies, reporting practices and, ultimately, a stronger sense of control over your data will be achieved.

Before PCI DSS many companies’ data was horribly insecure and because of it, most card data is now better looked after than it was two years ago, but the standard only covers the obvious areas of vulnerability and does not prescribe end-to-end encryption. PCI DSS offers a good base line for protection, but as with any standard it will not be an exact fit for every organization and being PCI DSS compliant is not on its own sufficient to protect an organization from the security risks it faces.

It is the responsibility of each organization to deploy PCI in a way that gives them what they want then fix the gaps. Maintaining a security program that incorporates ongoing compliance with PCI at its foundation remains a base line of defense against potential data breaches, but organizations must understand their own specific security risks and deploy appropriate security measures. biography
Bio for Paul Meadowcroft Paul Meadowcroft is Enterprise and Government Business Unit Director for the information systems security activities at Thales and has more than 15 years experience in information security. He is a frequent speaker at seminars and conferences on a wide range of information security topics particularly the use of cryptography, key management, public key infrastructures and payment systems.