Data Security Policy and Enterprise Key Management: To centrally Manage Encryption Keys from Vormetric
This is an excerpt of Vormetric’s whitepaper: Simplifying IT Operations Securing and Controlling Access to Data Across the Enterprise. http://www.Vormetric.com/key82 .The whitepaper outlines the challenges of enterprise key management and details ways to minimize the risk.
This whitepaper from Vormetric on Key management strategy strives to provide the reader with an understanding, of the importance of encryption key management and of its evolution. Additionally, understanding that companies today require actionable information, the paper provides the reader with a set of criteria for encryption key management as well as an understanding of the challenges that may be faced. This is followed by a review of the recent industry initiatives and compliance regulations that are shaping the future of key management strategy. Lastly, the paper describes Vormetric’s Key Management, a component of the Vormetric Data Security product family.
According to the whitepaper, encryption key management should meet four primary criteria:
1. Security – In implementing a comprehensive data security strategy, organizations are well - advised to consider the security of the encryption keys. Where are they stored and how are they protected? Improper key management means weak encryption, and that can translate into vulnerable data.
2. Availability – In addition to being secure, the keys must ensure that the data is available when it is needed by the system or user. Key management practices that add complexity can decrease availability or add overhead to the network. That results in damage to the over efficiency of the network.
3. Scalability and Flexibility – Growth and change are inevitable in an organization. The key management solution should be able to address heterogeneous, distributed environments so as not to hamper either growth or change.
4. Governance and Reporting – Reporting is essential to proper institutional governance. Often, third party entities (be they customers or regulatory authorities) will request, and in some cases mandate, proper governance and reporting of key management. That means implementing and enforcing things like separation of duties, authorization process and key lifecycle management.
This whitepaper from Vormetric on Key management strategy strives to provide the reader with an understanding, of the importance of encryption key management and of its evolution. Additionally, understanding that companies today require actionable information, the paper provides the reader with a set of criteria for encryption key management as well as an understanding of the challenges that may be faced. This is followed by a review of the recent industry initiatives and compliance regulations that are shaping the future of key management strategy. Lastly, the paper describes Vormetric’s Key Management, a component of the Vormetric Data Security product family.
According to the whitepaper, encryption key management should meet four primary criteria:
1. Security – In implementing a comprehensive data security strategy, organizations are well - advised to consider the security of the encryption keys. Where are they stored and how are they protected? Improper key management means weak encryption, and that can translate into vulnerable data.
2. Availability – In addition to being secure, the keys must ensure that the data is available when it is needed by the system or user. Key management practices that add complexity can decrease availability or add overhead to the network. That results in damage to the over efficiency of the network.
3. Scalability and Flexibility – Growth and change are inevitable in an organization. The key management solution should be able to address heterogeneous, distributed environments so as not to hamper either growth or change.
4. Governance and Reporting – Reporting is essential to proper institutional governance. Often, third party entities (be they customers or regulatory authorities) will request, and in some cases mandate, proper governance and reporting of key management. That means implementing and enforcing things like separation of duties, authorization process and key lifecycle management.