In-Depth
5 Rules for Reining in Key Sprawl
Following these five rules will help your organization get your security keys under control.
By Larry Warnock
Lock it up and throw away the key. It's a satisfying notion to imagine the peace of mind you would have if you could secure something forever. Unfortunately, that's not a realistic solution when it comes to data security -- not when stored data must be accessed and acted upon in real time.
In the real world, where keys safeguard and provide access to encrypted data, it's surprising how careless some organizations can be. Take, for example, a recent Symantec survey in which 40 percent of respondents said their enterprises are less than "somewhat confident" they can retrieve keys, and 34 percent have lost a key.
There are a few theories about why this is happening. First, there's a high likelihood that the person responsible for managing the keys is not a security expert. In fact, safeguarding encryption keys may be far down on the list of his or her responsibilities. We can also attribute these figures to a relatively new and serious concern when it comes to enterprise security: key sprawl.
Enterprises' attempts to protect sensitive information in hybrid IT environments is generating a virtual avalanche of keys and related security objects such as passwords, tokens, and certificates. It's important that organizations take the necessary steps to protect these objects, which often act as surrogates for your sensitive data. That means locking them up and safely securing the keys.
Rules for Reining in Key Sprawl
Key management is one of the most difficult tasks associated with encryption, and it's also the most important. The bottom line is to treat key security with as much rigor as securing the data itself.
Following these five rules will help any organization get their keys under control:
Rule #1: Isolate the key from the data it protects
A surprising number of companies using encryption solutions store their keys in the same place as their data, exposed within the configuration file or on the very server that stores the encrypted data. That's kind of like "hiding" the key to your car in the ignition. You just made it that much easier for a thief who breaks in to steal it.
The best way to keep your keys safe is to store them in a secure location far away from the encrypted data.
Rule #2: Centralize storage and management for all keys, tokens, and other IT objects
To maintain a secure posture, organizations need to store and protect their keys and other "opaque objects" including passwords, access codes, encryption keys, and other tokens that control access to data. Too many companies are managing these bits of "IT DNA" using homegrown spreadsheets or databases. Encrypting these objects and storing them in a centralized location with strict policies and controls improves efficiency, reduces unauthorized access, and assures back up and availability.
Rule #3: Don't rely on hardware security modules alone
These traditional key management appliances have been around for a decade or more and were built for enterprise data centers where a single organization owns and operates all the computing assets. Expensive, hard to program, and limited by the variety of objects they support and store, these appliances are also incompatible with most cloud computing environments. Look for solutions that are easy to use, offer limitless object variability, and can support mixed or hybrid IT environments where sensitive information is stored in public and private clouds or behind a firewall in an on-location data center.
Rule #4: Establish a robust set of data retrieval policies
Defaulting to a policy that allows data retrieval only by the client that deposited that data won't work in big data or cloud computing scenarios that require flexible policies to support a range of access scenarios. Look for a key management solution that can support a robust range of policies, including retrieval limits, custom URLs with expiration periods, one-time passwords, and voting.
Rule #5: Make encryption and key management a priority before starting a big data project.
Security should be a key consideration during the design and implementation phases of any big data project. Too often, companies leave data unprotected in a big data environment only to realize later that usernames and passwords, credit card data, or health records were accidentally exposed. Retrofitting security into an existing big data cluster, which may contain thousands of nodes, is challenging. Data encryption and key management can act as a relatively inexpensive last line of defense that won't noticeably impact performance or availability of big data.
Larry Warnock is CEO of Gazzang, a provider of cloud-based encryption and key management solutions for big data. You can contact the author at larry.warnock@gazzang.com.