Companies are moving more and more sensitive data over the internet and are heavily migrating their infrastructure to the cloud, in different types of service models. As this happens, the need to use and manage encryption keys grows.
Faced with this reality, security professionals actively protect this data with tried and tested techniques, which are used at different stages of an organization’s productivity cycle, always with the aim of guaranteeing privacy.
However, the guarantee of data protection and availability may not be possible through the use of encryption alone.
Even if there is advanced technology against data breaches, without encryption key management, the risk of information being leaked or stolen will still be high.
Why is managing cryptographic keys important?
Management means protecting cryptographic keys against loss, theft, corruption and unauthorized access. Its objectives include:
- ensure that the keys are kept safe;
- change the keys regularly;
- control how and to whom keys are assigned;
- decide on the granularity of the keys.
In practice, encryption key management means assessing whether a key should be used for all backup tapes or whether, on the other hand, each one should receive its own, for example.
It is therefore necessary to ensure that the cryptographic key – and anything related to it – is properly controlled and protected. So you can’t not think about management.
If everything isn’t properly protected and managed, it’s like having a state-of-the-art lock on your front door but leaving the key under the mat.
To make the importance of cryptographic key management clearer, we only need to remember the four objectives of cryptography: confidentiality, integrity, authentication and non-repudiation. So we see that with it we can protect personal information and confidential corporate data.
In fact, it makes no sense to use technology that guarantees data security without efficient management.
Managing encryption keys is a challenge, but it’s not impossible
In fact, managing cryptographic keys is not as simple as calling a locksmith. You can’t write the keys on a piece of paper either. You need to provide access to as few people as possible and ensure that it is restricted.
Successful crypto management in the corporate world requires good practices on several fronts.
First, you must choose the right encryption algorithm and key size to have confidence in your security.
It must then ensure that the implementation of the corporate encryption strategy complies with the standards established for this algorithm. This means being approved by a recognized certification authority – in the case of Brazil, those approved by the ITI, within ICP-Brasil.
Finally, it must guarantee efficient encryption key management, combined with security policies and processes that can ensure productive use of the technology.
To have greater confidence in your encryption key management strategy, the first questions to ask are the following:
- where are the encryption keys kept?
- who owns them?
Many management services retain private keys at the service layer, so your data can be accessible to the administrators of this activity. This is great for availability, but not for confidentiality.
So, as with any technology, the efficiency of encryption depends completely on its implementation. If it is not done correctly or if the components used are not properly protected, it is at risk, as is the data.
|
|
From policy creation to cryptographic key management
A common approach to protecting company data through encryption key management is to take stock, understand the threats and create a security policy.
Companies need to know which devices and applications are trusted and how policy can be applied between them and in the cloud. It all starts with knowing what you have.
Most organizations don’t know how many keys they have, where they use encryption and which applications and devices are really trustworthy. This undeniably characterizes a total lack of management of encryption keys, data and its structure.
Undoubtedly, the most important part of an encryption system is its key management, especially when the organization needs to encrypt a large amount of data. This makes the infrastructure more complex and challenging.
Standardizing the process is fundamental
The standardization of products is fundamental. After all, even properly implemented encryption means little if an attacker gets into someone’s machine or if an employee is dishonest.
In some cases, for example, encryption can enable an attacker and render the entire security investment useless, causing damage that goes far beyond financial losses. So standardization is vital to creating useful policies and processes, reducing the possibility of loopholes that can result in cyber attacks and data theft.
Encryption really does create more business opportunities for different types of companies, not just by mitigating concerns such as cyber attacks, but by creating an organized, efficient and strategic data access cycle.
Finally, in times of digital transformation and so many technological and market disruptions, adopting encryption key management is vital for companies seeking sustainable growth.
Now you know a little more about cryptographic key management, keep up to date with this subject via our LinkedIn page.
About EVAL
EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.
With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and the General Data Protection Law (LGPD). In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.
Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.
Eval, safety is value.
