Hello, I'm Eric Trabro of Information Security Media Group, and I'm pleased to be speaking with Chris Fettty, Chief Executive Officer of an Encryption Provider Safe Net. Welcome, Chris. Thank you, Eric. Pleasure.
How is encryption as a technology evolving? What's different today about encryption and how it's used in, say, five or ten years ago, and how will encryption evolve in the coming years? Encryption's evolving in terms of how it's being used and how it's being used against current imminent threats. Everybody is learning just how insidious the threats are today.
The advanced persistent threats are here, they're very sophisticated. They can do tremendous damage, and I think people are learning that encryption is one of the things that can be used, one of the very strong tools that can be used against those against persistent threats. The reason is, once you've encrypted information, whether that information is stolen or misplaced, lost, misused, that information is protected as long as it's encrypted. And so it really reduces the proper control of that information to one of how you control the keys, not how you control the information.
Controlling information itself, protecting it, hiding it, all of those things can be very difficult. That's exactly what sophisticated threats do is they find the information, they get around the walls, they get through the walls. When encryption is used to protect the information, what you have to manage is the keys to the encryption, which reduces the field of sophistication needed to that. And so that's how people are using it more and more today, is to change the nature of how you protect the information.
Now, is that what the encryption was doing 10 years ago? 10 years ago, it was used in limited cases, it was used to move information from point A to point B, and that was against the unsophisticated threats, so that you could put information out on public transport mechanisms, like the Internet, for example, so it was used in a much more limited field. Now, you're more toward data at rest, or is that something that was 10 years ago? Yes, it is different.
It's now used so that it's independent of whether data is at rest or not. Whether data is at rest or movement is irrelevant to the encryption itself, and so that's why, again, it makes it more of a ubiquitous solution to a very sophisticated threat in that manner. You signed a light on the other very relevant aspect, especially in today's environment, which is identification and authorization, who has access to what information. That is something you read about every time you pick up a newspaper, especially now, because there's been some breaches, there's been some vulnerabilities due to the way identities are managed, and identity management authorization and encryption all go hand-in-hand form today's current methodology of protection against threats.
It's just alluded to encryption has gotten a lot of attention recently, because the files pilfered by hackers that had not been encrypted. For example, I think it's with a Sony case in the PlayStation breach, an encrypted customer credit card information, but not the personal identifiable information. What do you hear from customers and others for reasons why organizations don't fully use encryption? I could say there's a couple of different answers that one is people can be unaware of the threat.
It really is surprising. People see other hacks. There's been high-level breaches ever since, TJ Maxx, WikiLeaks, like you say, Sony, and people still don't recognize that it applies to them, too, and part of that also is these advanced threats are very quiet. The whole goal is to steal information silently so that the person losing information is unaware of it.
I think people just don't recognize that the threat is real and the target could very well be them. They don't have an appreciation for how imminent, how insidious, how right in their own backyard this problem really could be, and so part of it is that. Part of it is if people can find a way to meet regulatory requirements through policy, that's usually their first approach because that's more comfortable, right? Any organization is used to dealing with policies and used to dealing with government regulations through how they address the rules and regulations and audits and things like that, and so they kind of take that approach first because it's a familiar approach to them, but as we all know, that's not going to protect against the festive information.
In other words, they may be under certain requirements to encrypt the finance operations, but they may not be under the same kind of rules to encrypt birth dates or addresses or email addresses. Well, you bring up a great point there because right now the PCI requirements require you to actually encrypt certain information by credit card information. Once you've been forced to encrypt, once the regulations say encrypt this piece of data, that is actually the best learning tool because then people that are start to use encryption because they have to realize that, you know what, not only do I have credit card information to protect, I have intellectual property to protect. I have personal information on my employees to protect.
Once they learn to encrypt because they don't have a choice, they are the people that start using encryption in more and more places and getting more and more protection by using encryption technology. It's that first step. How do you encrypt? How do you implement it?
What's the benefits of it? That's the first hurdle that people have to get over. They have to understand that that's a solution more than simple policy management. In determining what to encrypt?
I mean, are there situations where if you encrypt a lot of data that makes it harder to perhaps even share that information with people who might need it at some point? Yes. So it is very important to encrypt these sensitive information because if you encrypt things that don't need to be encrypted, you can run into a lot of issues. It's harder to share information if it can be anyway.
It can slow down your processes. I would say that security in general and encryption in particular should enhance your business processes. You should be able to use encryption. You should be able to use security to make your business processes more efficient, specifically meaning don't have regulations and things like that.
But if you use it wrong and you try to apply it where it shouldn't be applied, then you get in the way of business processes. You get in the way of smooth operational efficiencies. So yes, you need to understand what information should be protected through encryption technologies and then do it very well. And designing what information should be encrypted?
Who an organization should be making that decision? As one member of senior management, I think it has to be an executive decision because it ranges from intellectual property to personal information to things like that. And really, you need to be in an executive level within an organization to make a broad determination on what needs to be protected and what really doesn't need to be protected. Obviously, you get inputs from your compliance officer, you get inputs from your IT and your CISO.
Am I a way of thinking it's an executive decision on the breadth of security requirements within a company? Is the cost going back to becoming prohibitive? Were that prohibitive these days? The cost is almost never prohibitive.
I think we have found that if you try to meet government regulations through policy and try to meet a true encryption, the costs are comparable and sometimes favorable. So it is not a cost issue in my experience. What do you say to clients that may want to use your products but I have to show sort of an ROI return on investment from it because how do you show that you're safeguarding something that could cost you if we're not safeguarding it? You come at it too, Ace.
One is here's a cost of safeguarding information using encryption technologies. Here's a cost of safeguarding information with other technologies and in the event that you have to protect the information, it does kind of boil down to that. There are different ways to do it. What's the cost associated with the various ways?
But the second consideration is what's the cost of a breach? So everybody, no matter what business you're in, whether you have regulatory overhang or not, everybody has to say what is the cost of a breach? Now in the US, it's a patchwork of answers, right? There's not a federal answer to who has to report breaches, what has to be disclosed.
There's not a uniform answer, but a company has to consider if I have lost information, personal information, intellectual property, what are the consequences, what are the costs of that? What's the factor into a return on investment also? And as anybody other reads a paper knows that the cost of breaches are just going irreversibly skywards. It's a very expensive proposition.
You have the threat of losing that kind of information. Survey shows that most organizations have been breached in some respects. You know, encryption and end-all, I mean, if you encrypt things, you're safe or is a little too simplistic way to approach it? I'll have to preface it with if it's implemented well.
Encryption moves the vulnerability to how to manage the keys. And I will say that if you've got a professionally designed encryption system, an enterprise that is architected to accommodate encryption systems, and it's well designed, then you answer yes. You have in fact solved the problem. So does this sort of make a call computing safe?
It can. Yes. It'll be prefaced with the same thing. Has to be implemented well.
Has to be designed in. It can't be screwed in at the end like I like all this. Has to be architected in. But encryption is exactly the kind of technology that can make cloud operations safe because it means the security goes with the information.
It doesn't have to go through any kind of mechanisms. It's just the security goes with the information. If the information is in the enterprise, it's protected. The encryption protects it.
If it's moving outside the enterprise because it's being remotely accessed or being stolen or being sent to the cloud, the protection goes with it. That is the nature of the encryption. And we get access to it. What keeps that encryption the proper protected mechanism?
It's back to where we were a minute ago. It is who has access to it? And how do you know that that person that's accessing it has the right access? So you've got to have identity and authorization that extend into the cloud so that the key management can extend into the cloud and if both of those are properly implemented, that information in the cloud can be out there securely.
And does this go for the public cloud or any type of cloud model? Yes, it does. So should the defense department be secure of maintaining very sensitive information, classified information on a public cloud, if it's properly executed? Well, you use the word storage and I would give you an unqualified answer on that.
Yes, there are ways that you can store classified information in the cloud. The reason I can say that's an unqualified answer is you're never using that information that's in the cloud. You're simply storing it out there. It is not vulnerable while it's out there.
It's only vulnerable or can be rendered vulnerable when you're doing something with it, which, of course, in a cloud storage scenario, it's not being acted upon in the cloud. I would say, though, in advance your question specifically, you're going to make a blanket statement about the government using clouds with classified information, the answer is no, because you really want to run applications in the cloud, cloud computing in the cloud. There's other layers of and other complexities to protecting the information when you're running applications. So doing those in the cloud, at least with technologies today, that would be not appropriate for classified information.
Thanks, Chris. My pleasure. I'm speaking with Chris Fett, Chief Executive Officer of Encryption Providers 8net for Information Security Media Group. I'm Eric Chabral.
Thanks for listening.