Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Curtis Franklin, Principal Analyst, Omdia
May 3, 2018
3 Min Read
InteropITX 2018 — Las Vegas — Encryption is critical and encryption can be complicated. Fortunately, there are tips, techniques, and information tools that can help reduce the difficulty and make proper encryption more achievable and affordable for most organizations. That was the message Ali Pabrai was preaching from the platform in an early morning session on Thursday.
Pabrai, CEO of security consulting firm ecfirstm, began the session by running through some of the critical security incidents that have forced companies to the conclusion that encryption is not merely an option for enterprise security — it's a necessity.
October 21, 2016 was one of the dates Pabrai recalled because it was the day on which the Mirai botnet activated and went on the offensive against DNS provider Dyn. At the time the most powerful DDoS attack on record, Pabrai said that Mirai will be the model for more powerful attacks to come. Avoiding having company computers and IoT devices become part of an attacker's weaponized network is just one of the reasons he gave for encrypting as much data (and data traffic) as possible. Many of the other reasons involve regulations.
May 25, 2018 is the day that GDPR begins to be enforced. It has a lot to say about protecting data and notifying customers if unprotected data is breached. It's also not the first regulation with those requirements. "HITECH has been with us since 2010," said Pabrai, noting that the Health Information Technology for Economic and Clinical Health (HITECH) Act defines "unprotected data" and specifies actions to be taken when it is breached.
Beyond the various regulations regarding encryption and data, there are frameworks and tools that help organizations understand how to go about protecting data both at rest and in transit.
"You can't be in cybersecurity without being literate in the NIST framework," Pabrai said, noting that, on April 16, NIST introduced the Cybersecurity Framework 1.1. The framework is quite prescriptive regarding best practices for building encryption into an enterprise process. That makes it and PCI DSS — another highly prescriptive standard — especially valuable resources for enterprise data security professionals.
In addition to the large frameworks and regulations, Pabrai argued in favor of a low-tech tool and basic strategy for dealing with encryption.
The low-tech tool is a spreadsheet listing every possible enterprise attack surface (data base, mobile devices, IoT, etc.) and whether the state of encryption is yes, no, or unknown. He said that this tool allows him to understand the basic security stance of an organization in a matter of minutes during the initial encounter.
The basic strategy is taking the argument for wide-spread encryption — that it dramatically reduces risk exposure — to the executive committee with questions about why they would want to take this critical step.
There's no doubt that encryption requires investment, Pabrai said, but compared to the financial risk of unprotected data it is an investment that makes sense for practically every organization.
About the Author(s)
Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes
Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.
Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.
When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.
You May Also Like
Unbiased Testing. Unbeatable ResultsFeb 22, 2024
Unbiased Testing. Unbeatable ResultsFeb 22, 2024
Your Everywhere Security guide: Four steps to stop cyberattacksFeb 27, 2024
Your Everywhere Security Guide: 4 Steps to Stop CyberattacksFeb 27, 2024
API Security: Protecting Your Application's Attack SurfaceFeb 29, 2024
A screen displaying many different types of charts and graphs to show what data is being analyzed.Cybersecurity Analytics