EncryptionEverywhere

(1/3) Poor key management may give malicious actors not only access to data, but also to encryption keys

(2/3) Loss of the keys means not only compromised data, but also genuine users may be locked out

(3/3) Pervasive encryption, including centralised key management, helps prevent this

Sure, better protecting their data, is a like a quality insurance.

There's also the challenge of restoring trust in a company following a data breach - pervasive encryption can be part (but not all) of the solution here

Moreover, #pervasiveEncryption and #GDPR – Controllers may not need to report breach to data subjet if the data was encrypted.

@adamjollans Absolutly true, this is not the alpha and the omega, but part of the solution. It needs to be completed by others security measures

@GuillaumeIBM quite right - in fact reputational damage expected to be far more 'costly' than fines for non-compliance

@adamjollans this is why it is so important that boards are making decisions based on a proper understanding of the risk they face!

and it's the Board members who will get the blame if there's a signficant data breach

Business support is the critical term – it cannot be a security or IT project, should be a business-wide one

#Pervasive Encryption is a journey. Its application requires a step by step approach (Possibly you can adopt one feature a time).

@DominicTrott how do you get right sponsors in the organisations to support such a project?

Collaboration & alignment of ALL business areas is key to truly PERVASIVE encryption

@f_stamou what is the right sponsor?!?!? Need to find person/team with right profile to drive org-wide change

You can also consider a selective approach first (encrypting critical data first) and then extend to all data second once ready.

do you find that companies ''cut corners'' when it comes to security due to budget and resource restrictions?

@f_stamou @IDCUKI research shows involvement of COO & non-exec board sponsor adds to security maturity

@f_stamou a big challenge! lack of awareness can lead to mistaken prioritisation - see @WannaCry outbreak at UK NHS

@f_stamou As data owner or security officers, we should point common interest to protect data without impacting their activities

Great opportunity for security professionals to show business understanding/leadership

#GDPR #Article32: encryption an example tech for security of processing personal data

#GDPR #Article25: data protection by design and by default … Taking into account the state of the art #SOTA

#pervasiveEncryption - 2 technical controls mentioned in GDPR text: #Pseudonimisation and #Encryption.

The practice of #pervasiveEncryption decouples encryption from classification. Protect first, classify second.

Also @GuillaumeIBM - if Art32 says encryption is an e.g. of data security, need a good reason not to use it for Art25 compliance!

how would you rate organisations' readiness regarding #GDPR?

readiness is patchy - @IDCUKI research shows many European enterprises still at the 'blissfully unaware', or 'dawning recognition' state of readiness. Let alone 'risk-based compliance'

@f_stamou currently >50% Western European enterprises not ready for compliance, 25% pragmatic compliance, 18% beyond compliance, 1% compliance exemplar

it should not just be about job titles, but about finding the right champion for YOUR enterprise

is it so strategic to make it a CEO issue? Do you hold so much marketing data to make it a CMO issue? Does CIO/CISO have the weight to drive change on a pan-enterprise basis?

: Not encrypted = exposed!

#PervasiveEncryption - Requires the alignment of enterprise data owners and security officers (segregation of duties, confidentiality)

@GuillaumeIBM agreed! The champion for encryption is the one that can drive consistent, collaborative, enterprise-wide impact

@DominicTrott So true!

From Security officer, LOB data consumers, database and storage administrators have a role to play. Applying encryption where it needs to be, they all protect organization against risk.

#pervasiveEncryption simplifies & reduces the costs associated with protecting data & achieving compliance mandates.

#PervasiveEncryption is not a product or a solution - it is a state of mind or a ‘journey’

#pervasiveEncryption is a transparent and consumable approach to enable extensive encryption of data in-flight and at-rest

#PervasiveEncryption means data is encrypted no matter its state – in transit or at rest

1) #pervasiveEncryption is a Data Centric Approach. The data is the new perimeter and benefits of tight platform integration of the crypto #z14

modern approaches to enable goals include #DataMasking and #FormatPreservingEncryption

2) CPACF – Performance improvements of up to 6x (compared to z13) for selective encryption modes of operations. We are talking about more than 12 GB of encryption per second per processor.

3) Crypto Express6s – Doubling of asymmetric encryption performance for TLS handshakes (compared with previous generation)

@IDCUKI research agrees that encryption adoption is ‘patchy’ http://ow.ly/Rww630g...

Organizations struggle with questions like: What data should be encrypted? Where should encryption occur? Who is responsible for encryption?

@DominicTrott Encryption is hard & not a panacea!

: due to finite budgets and limited resources

Comprehensive data protection requires investment 
to deploy point solutions and/or enable #encryption 
directly in the applications.

Encryption no ‘single shot’ solution - must be met with companion tech process & skills (esp key management)

Companies tend to struggle with key security and rotation

Encryption can have data usability implications, maybe forcing a security vs usability decision