Quick, Encrypt Everything!

On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices, encryption is gaining traction in more mainstream IT environments (you no longer have to be a three-letter government intelligence agency to justify the investment). That's OK, as long as you know how to properly manage it.

My story in the Sept. 25 issue of InformationWeek navigates you through the tricky process of managing encryption. For those of you who just can't wait until Monday, here's what you should know, along with some examples of what can go wrong.Encryption adds cost and complexity to IT systems that are already expensive and difficult to manage. Why would anyone do that? Simple: They can't afford not to. When the Veteran's Affairs Department in May had a laptop and hard disk drive stolen from an employee's apartment, this loss of data on about 26.5 million veterans and their spouses spurred a tumultuous couple of weeks that put VA Secretary James Nicholson in the hot seat. Calls were made for his resignation, and by the time the situation had calmed down, Pedro Cadenas Jr., the VA official in charge of information security, had announced his resignation and Deputy Assistant Secretary for Policy Michael McLendon had resigned. The VA then moved to sign Systems Made Simple to a $3.7 million contract to install mobile encryption software from GuardianEdge Technologies and Digital Trust on all its laptops by mid-September (a self-imposed deadline the department has subsequently missed, although it reports to be making "good progress").

Other federal agencies have avoided this sort of upheaval by long ago implementing encryption on mobile devices. The Justice Department has for the past four years been using encryption software from Pointsec Mobile Technologies and other vendors on all its laptops. To further contrast the VA's predicament, after the Commerce Department Sept. 21 admitted that 1,137 of its laptops have been "lost, misplaced, or stolen" since 2001, Commerce was quick to point out that it uses "access passwords, complex database software, systemic safeguards and/or encryption technology [to] significantly limit the potential for misuse of data on the laptops." This has kept outrage to a minimum and the focus on why Commerce hadn't reported this sooner, rather than on who's going to pay to provide the victims with free credit monitoring services. Nearly half of the absent laptops were from the Census Bureau, and 249 contained personally identifiable information.

So encryption (as part of a larger laptop security strategy) came to Commerce's rescue. "All of the equipment that was lost or stolen contained protections to prevent a breach of personal information, and we are moving to institute better management, accountability, inventory controls, 100% encryption, and improved training," Commerce Secretary Carlos Gutierrez said in a prepared statement. Since 2001, the Census Bureau has been adding encryption technology on a rolling basis for extra protection, and today all new laptops have encryption protection.

That's the sunny side of encryption as a policy. The dark side involves irretrievable data, networks and systems bogged down by devoting resources to encrypt and decrypt information, and the fact that many network security systems can't adequately inspect encrypted data packets.

Anecdotally, a couple of stories surfaced when I was researching my story that illustrate what can go wrong. One involves a company that had lost a copy of the decryption keys for the data they'd recently encrypted. While details weren't forthcoming regarding how these keys were lost, a source brought to my attention that without access to those keys, this company had essentially done the digital equivalent of shredding all the data it had encrypted.

In another situation, a company fearful of falling into the trap previously described decided it didn't need an automated means of retrieving decryption keys. Instead, it kept an unencrypted copy of the data it had encrypted, just in case something went wrong during the decryption process or its keys were lost. Kind of like locking your door and leaving the key under the doormat.

When it comes to encryption, you've got to be all in, or you might as well find some other way to protect your systems and data. For a more in-depth analysis of the benefits and challenges of properly managing encryption, check out my feature story in this week's issue.