s to ensure their validity.
Research various encryption solutions, read technical reviews, and contact the customers of vendors that interest you. Nothing beats a try-before-you-buy approach in this arena because what works well for one company doesn’t necessarily work for another. Ultimately, you must select one or more encryption solutions that best fit your organization.
Prior to deployment, develop a written policy endorsed by management and communicate both policy and operational instructions to end-users, including business partners and third parties that handle sensitive data. If they can’t meet your company’s policies and demonstrate as much, they don’t get your data. Encryption responsibility should be fixed and have consequences for noncompliance.
Consider implementing a tool to monitor and detect the leak or theft of confidential information. The policy should always include a statement indicating that any lost or stolen data should immediately be reported to the key stakeholders for evaluation. It should include specific steps to take when a data breach is detected. Exactly who should be contacted, how quickly? When will customers be notified, who decides, and how? Will customers be given free credit reports? All of these questions should be answered ahead of time.
Although only loosely related to encryption, a proactive data destruction policy should be enforced as well. Many of this year’s embarrassing data-theft stories involved data that should have been destroyed long ago. If the data isn’t needed, get rid of it -- and the risk that goes with it. A good policy indicates how long data should be kept, from the instant it is created or obtained, as well as how it should be secured and destroyed.
Unfortunately, no single encryption product protects all data areas. Some vendors offer nearly holistic solutions, but eventually an IT project manager will have to cobble together multiple solutions.
Detailed technical standards and guidance is available at the National Institute of Standards and Technologies (NIST) Cryptographic Toolkit Web page. NIST publications tend to be drab and overdone with technical jargon, but most government agencies, contractors, and vendors must follow its recommendations. And because its recommendations are thoroughly tested and vetted with expert public review and input, nongovernment agencies would do well to follow its advice.
Encryption products are broken down into five major categories: file- or folder-level, volume or partition, media-level, field-level, and communications. They are further defined by their cryptographic key storage mechanism.
File-level encryption protects data on a logical file-by-file basis. File encryption includes on-disk file and folder solutions, as well as password-protected encrypted archival formats -- Pkzip, for example. File encryption allows specific files to be protected, such that less important files don’t waste the additional resources necessary to encrypt and decrypt.
File-level encryption routines are among the most mature ciphers, often sharing well-tested underlying standard protocols with names such as 3DES (Data Encryption Standard), AES (Advanced Encryption Standard), Diffie-Hellman, Blowfish, and RSA (Rivest-Shamir-Adelman). File encryption is often available at the OS level. Microsoft has EFS (Encrypting File System), and the Mac OS uses FileVault. OS-level encryption often has a problem extending to new portable media types or across foreign volume partitions, so application-level file encryption solutions abound. The most popular is produced by PGP. It comes in both open source and commercial versions.
Folder-level encryption products encrypt the contents of entire folders, such as the Windows My Documents directory or the Linux or Mac user’s home directory. Be aware that many seemingly folder-level encryption products don’t encrypt the entire folder as a single object. Instead, they individually encrypt each file within the folder, using a file-specific or a folder master encryption key -- or a combination of both. For instance, Mic