What is encryption and how does it work?

Why is data encryption necessary?

Privacy: only the owner and recipient of the data can read it, preventing attackers, ISPs and even governments from intercepting sensitive data.

Security: encryption helps prevent data breaches; if a corporate device is lost or stolen but its contents are encrypted, the data will still be secure.

Data integrity: encryption also prevents malicious behaviour like on-path attacks (intercepting information in transmission), as encrypted data cannot be viewed or tampered with along the way.

Regulations: many industry and government regulations require companies to encrypt user data, such as HIPAA, PCI-DSS and the GDPR. US government agencies and contractors must use the FIPS (Federal Information Processing Standards).

Encryption algorithms

An encryption algorithm is how data is converted to cipher text. The encryption key is used by the algorithm to consistently alter the data so that even though it looks random, the decryption key can easily convert it back to plain text. Common encryption algorithms include AES, 3-DES, SNOW (all symmetric), and elliptic curve cryptography and RSA (both asymmetric).

Like all asymmetric encryption, RSA uses prime factorisation (multiplying two very large prime numbers together). Cracking it is very difficult because the original prime numbers must be determined, which is mathematically taxing. Brute force cracking an RSA key is next to impossible.

Brute force

When a computer makes millions or even billions of attempts to crack a password or decryption key, it is called a brute force attack. Modern computers can go through these possible permutations incredibly rapidly. Modern encryption needs to be resilient to this kind of attack. The field of cryptography is a constant arms race between those developing faster ways to crack encryption, and those developing more sophisticated encryption methods.

How can encryption help your company?

Cybersecurity strategies need to incorporate data encryption, especially as more businesses take up cloud computing. There are multiple ways that encryption can support company operations.

Email encryption: since email is fundamental in organisation-wide communication and business operations, bad actors target it for attack or inadvertent disclosures. Industries such as financial services or healthcare are highly regulated but enforcement can be hard, especially with email where end-users often resist change to standard operating procedures. It is possible to augment operating systems and common email clients with encryption software so that sending an encrypted email is as easy as sending one unencrypted.

Big data: continuous data protection for privacy compliance, secure cloud analytics, encryption and tokenisation tech for cloud transfers; encryption can streamline multi-cloud operations by centralising data-centric protection. Whenever sensitive data traverses multi-cloud environments, it will be encrypted by these technologies.

Payment security: merchants, payment processors and enterprises alike have big challenges securing high-value sensitive data e.g. payment cardholder data so that they can comply with PCI DSS (Payment Card Industry Data Security Standard) and data privacy laws. However, encryption software can protect retail POS, web and mobile ecommerce transactions.

In addition to the above services and protections offered by encryption, it provides confidentiality (encoding a message’s content), authentication (verifies a message’s origin), nonrepudiation (prevents credible denial of an encrypted message’s dispatch) and integrity (proves message contents are untampered).

Are there disadvantages to encryption?

Encryption is designed to lock unauthorised entities out of comprehending ill-acquired data. However, in some situations it can also lock out the data owner. Key management is tricky for enterprises because they need to live somewhere and attackers are often savvy about looking for them. Key management adds additional complexity to backup and restoration as, in the event of disaster, key retrieval and addition to backup servers is time-consuming. Admins must have a plan for key management system protection e.g. a separate backup that is easy to retrieve if a large-scale disaster occurs.

Software exists to streamline key management, such as key wrapping. This encrypts an organisation’s encryption keys, individually or in bulk. They can be unwrapped when needed, usually with symmetric encryption.

While brute force attacks can be ineffective against high-bit keys, vulnerabilities do exist. Many attempts focus on gaining unauthorised access to keys via social engineering methods. That is to say, attacking not the system but the humans that maintain and interact with it. Phishing, malware, BadUSB attacks: there are many methods by which hackers can circumvent the security measures put in place to shield networks from external attacks by exploiting the fallibility of humans.

Software-based encryption is also considered to be less secure than hardware-based encryption. Software-based encryption is called ‘removable encryption’ by some, as it can potentially be circumvented by bad actors making physical attacks. Hardware-based encryption is often thought to be more secure, as it includes physical defences to prevent tampering.

#KingstonIsWithYou #KingstonIronKey