Feeds

Who cares about encryption?

Mobility holds the, ahem, key

  • alert
  • submit to reddit

Internet Security Threat Report 2014

So, what drivers are most relevant when deciding where to place the emphasis when it comes to encryption? The answer is: "It's not as simple as that." When we compared these drivers against what organisations were actually up to with encryption, we didn't find any one making a particular difference. The smart people I work with suggested coming up with an index based on the number of respondents that scored 4 or 5 for each of the options shown in Figure 1 above, from which we ended up with a subset of 77 respondents, for whom all four areas were seen as a major driver – let's call this group the Focus group.

As you’d expect, the Focus group were more likely to feel the need for certain types of encryption, and indeed were more likely to have done something about it already. When we look at the ideal-world situation however, what this group gives us is a pretty stark view on how they believe things should be, particularly in the area of mobility (Figure 3).

Here's the thing: the chart shows us that the Focus group believes that all data stored on notebooks used by mobile workers should be encrypted – or at least 95 per cent of the group believes this to be true. A smaller but still significant proportion believes this is also the case for computers used in home locations, data on handheld devices, and indeed data stored on USB sticks.

Figure 4

Fundamentally, the Focus group makes a pretty solid case for encryption in the mobile context, based on the drivers involved. Of course not all organisations will be quite so affected by the drivers – but we know these are things that are of growing concern to most. The implication is that as organisations face up to the challenges, they should be encrypting data across the range of mobile devices.

Or at least it would be, if it were simple to do. Interestingly, when we asked about the challenges involved, it turned out that cost was not the number one factor. This stands to reason given the increasing availability of low-cost encryption tools, including those built into operating systems. No, the number one reason according to respondents, involves practicalities around implementation – which are particularly challenging when it comes to mobile data (Figure 5). As we can see, this even trumps the key management issues that we are so often told pose a challenge.

Figure 5

So we have a dilemma. The Focus group recognise that mobile encryption should be switched on by default, and many organisations will reach the point where they too face the same drivers, to the same level. Right now, however, we are told that encryption remains too difficult to deploy, despite the availability of low-cost or bundled options.

The message to vendors is that they need to get their act together when it comes to simplifying encryption across the board – remember, we're learning from a self-selecting sample of IT pros with an interest in security here, and not a bunch of random people from the street who might not have the technical smarts.

Meanwhile, the message to end-users is, if you haven't already encrypted your laptop data, you'd best get on with it - or at least ask your IT department how to do it. ®

Beginner's guide to SSL certificates

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.