Posted 2 months, 1 week ago
In a survey of several thousand IT professionals across a dozen countries, 57% of respondents said that encryption key management at their company was “painful.” In a similar study, the risk and cost associated with key management was, on average, rated a seven out of 10. Those percentages change from year to year, but as the importance of encryption becomes increasingly obvious across different sectors, the total number of businesses dealing with serious encryption key pain is only going to go up.
If you have sensitive data that needs to protected—and, let’s face it, every modern business does—you need to consider how easy or difficult it is for admins and users on your systems to actually keep that data safe. Human error is the single biggest threat to your organization’s cyber security, which means that the more difficult it is to manage encryption and encryption keys, the less safe your operations are from hackers. If your central key server is misconfigured because it doesn’t play nicely with your cloud data storage, the odds of a hacker gaining access to private keys goes way up.
By the same token, if your corporate email communications are encrypted in such a way that makes it too difficult to read and write messages, users will start communicating over less secure channels like personal email or instant messages. In this way, significant key management pain can quickly evolve into the pain that comes from a data breach or wire fraud.
At this point you might be wondering, “What is it, exactly, that makes encryption key management such a significant pain point?” Frankly, there are any number of challenges that businesses might be facing in this area, but they tend to fall into a few distinct buckets:
In the same survey we cited above, the top hurdle that businesses listed for encryption management was unclear ownership. Simply put, no one in the company knows who owns which aspect of the encryption key management process. Whose responsibility is it to change out keys or certificates before they expire? Who distributes keys to users when they join? Who’s in charge of figuring out where to store keys and/or certificates? It’s easy to imagine how confusion on these points could make successful cyber security practices nearly impossible. After all, if no one knows who’s supposed to be taking ownership of a particular task, those tasks might be completely ignored, leaving you almost completely unprotected even after you’ve invested in an encryption solution. This is especially problematic when you’re relying on manual efforts to store keys and change them out on a periodic basis—a practice far too common even among large companies.
For companies that are trying to move beyond manual key management (a tactic that we wholeheartedly recommend), the first option for decreasing overall encryption pain to present itself is usually a key management system (KMS) of some kind. If you’re a cloud user, this might be the KMS that’s native to whatever cloud you happen to be using, e.g. AWS KMS or Azure’s Key Vault. This can be a useful system to have in place—provided you’re only using one cloud provider for all of your email servers and data storage. For businesses that might be using multiple cloud providers for storage, or perhaps a mix of cloud-hosted and on-premise, however, this kind of solution can fall apart quickly. These cloud-specific systems simply aren’t designed for compatibility in multi-cloud environments, meaning that you’ll wind up with a patchwork of different solutions that’s hard to track and even harder to administer.
Of course, whether you’re using multiple KMS platforms or not, there’s still a good chance that you’ll find yourself in a position where there’s very little visibility into where encryption keys are actually stored. To wit, a recent survey found that in many organizations even the staff who are supposed to be managing encryption processes don’t know where every relevant key is stored. With multiple redundant solutions managing your keys across different application surfaces, it’s easy to imagine how this could happen. At the same time, it creates a situation that’s basically untenable: if you can’t figure out where your keys are stored, you’ll have no way to ensure that best practices are being followed, keys are being changed out as frequently as they should be, and that your encryption systems are actually providing you with the protection you’re paying for.
If you don’t have a way to overcome these challenges, then encryption becomes an albatross around the neck of users and admins alike. Rather than keeping hackers and fraudsters away from your private information, communications, bank transfers, etc., you leave your protection to chance.
Above, we remarked on human error and its potential to derail your cyber security practices—but what does that actually look like in practice? To put it another way, what pain points do you create for your users and admins when you fail to address the challenges listed above, and how do those pain points translate into phishing attacks, data breaches, business email compromise, and other forms of attack? For users—many of whom won’t be technical enough for encryption processes to come easy—having to keep track of one’s own key is often a real pain point in and of itself. If the user then has to take manual steps to use that key to encrypt and decrypt corporate messages, or if he or she has to keep track of the expiry date of the key and make sure to change it out in time, you’re setting yourself up for the emergence of shadow IT. In a case like this, a user might decide that it’s too much effort to go through a series of laborious steps to send a simple email, and decide that to use an unsanctioned, potentially insecure means of communication instead. Conversely, the user might let his or her key lapse, resulting in a lockout from the system—creating serious headaches for whichever tech support or admin staff happens to be in charge of recovering their account access. Unfortunately, if you’re not able to provide a more user-friendly solution (one in which users don’t even have to know that they have keys, let alone their locations), this same scenario stands to play out over and over again, widening your potential attack surface each time.
Let's say you’re a CIO at a bank or other financial institution, and you want to integrate encryption end-to-end across your entire back office dataflow, in accordance with SWIFT’s CSP guidelines. You choose a solution (or possibly several solutions) that will ostensibly provide protection for SWIFT messages and everything on your backend that touches the SWIFT network, and you leave it to your sysadmins and other IT support staff to implement and administer those solutions. With most of the solutions on the market right now, you’re setting your admins up for complex, lengthy, expensive and labor-intensive process—after which they’ll still be on the hook for complex manual encryption key management processes. If they can’t keep track of the relevant keys and certificates and their expiry dates (for any of the reasons we listed above), you could be looking at significant disruptions and delays when you find that the certificate you need to send a message has expired.
At this exact moment, there isn’t a KMS that can effectively solve these problems for businesses. So why not skip the KMS altogether? Why not skip PKI while you’re at it? If you could find a solution that automatically distributed keys, signed and encrypted messages (both for things like email messaging and back office processes like SWIFT transactions), and rotated those keys on a regular basis, you could erase most of the challenges we outlined above from the moment the solution is installed. In this way, the overall encryption pain your company deals with would drop precipitously for both users and admins.
Luckily, just such an automated solution exists. With a turnkey installation, p≡p for Email signs and unbreakably encrypts all your corporate communications. It’s transport- and encryption-agnostic, meaning that the baseline technology can be used to cover all kinds of messages and any sort of encryption—automatically distributing keys to users who don’t have to think about them or even know that they exist. Key, trust, and identity are all managed automatically, and the user doesn’t have to worry about them at all, eliminating pain points and radically decreasing the possibility of human error.
The solution offers entirely decentralized, opportunistic encryption in transit, meaning that your text, attachments, and metadata can’t be read by anyone but the intended recipients. p≡p can’t read this information, and neither can hackers or fraudsters who might be trying to gain a foothold in your system by compromising an executive’s email account—likewise, hackers can’t spoof your CEO’s email to trick email users into changing wire instructions or giving up PII, because p≡p warns the user with a red indicator light when a message is compromised. Thus, you get all of the benefits of encryption without the key management headaches. With SWIFT transactions and other back office processes, the same logic applies: No one can read the information you send to the SWIFT network, and no one can change that information in transit without the fact becoming glaringly obvious, and it all happens automatically. Admins don’t have to worry about expired keys and certificates, just like they don’t have to keep tabs on a series of complex and overlapping storage or HMS solutions. Just plug and play to achieve pain-free encryption.
p≡p Security launches p≡p for Thunderbird and p≡p for iOS, together with new versions for Outlook and Android
Sept. 7, 2020, 6 a.m.