In-Depth

Encryption Provides Safety Net for Enterprises

A new encryption solution promises to keep employees honest and reduce the number of enterprise "insiders."

• By Jason Turcotte
• 10/10/2006

Enterprises need not look far to pinpoint their most menacing security threat. According to CSOonline, 2006 research shows that more than 70 percent of private data breaches are at the hands of those on the payroll. A new encryption solution promises to keep employees honest and reduce the number of enterprise “insiders."

Last week PGP Corp. released NetShare, an encryption-based system of checks and balances that works in conjunction with the company’s single security platform. The product lets enterprises create group-encryption policies and establish “split" keys that require multiple users to access sensitive data. Now intellectual property (documents, spreadsheets, presentations, Web, video, audio, and image files) shared among departments, teams, partners, and clients are secure.

Other encryption solutions often require that IT staff create folders with private access for upper-level management. The problem with that approach, says John Dasher, director of product management at PGP, is that the IT department has too much visibility. With NetShare, enterprises can establish private access folders without keeping everyone abreast of sensitive data.

“You really don’t want your employees to decide what’s encrypted and what’s not," said Dasher. “With this there are no more accidental insiders. While IT can see the files are there, they can’t access them."

That’s the crux of the key encryption system. It ensures only high-level employees have access to important transactions, financial information, customer data, mergers, acquisitions, and other material deemed sensitive to an enterprise. The on-the-fly encryption product lets users set up group policies with corporate split keys that divide access among a group.

Before NetShare, says Dasher, businesses were wary about corporate keys for fear of employees leaving on bad terms and, with them, taking the “key" information needed to access the encrypted files. The split key divides key information among a number of people, all of whom are required to partake for access to be granted. This feature prevents one employee from dictatorial access and provides enterprises with an additional safety net.

In today’s information era, enterprises are learning the hard way that security breaches (largely internal) are costing millions of dollars and delivering major blows to reputations. According to PGP and The Ponemon Institution, a typical security breach costs a company $14 million. Last year, as cited by Enterprise Storage Group, the U.S. alone saw 150 known breaches. These threats, along with outsourcing and ever-changing compliance laws, have enterprises taking a keener interest in the matter.

“Everyone’s got to deal with some aspect of this, and we’re dealing with a broad adoption here," said Dasher. “It’s really the whole concept of central management taken to its logical extreme."

Dasher says “broad" adoption is the best way for enterprises to go. When several security applications are needed for an infrastructure, it creates what he refers to as a “rat’s nest" of silo systems. PGP can handle multiple users with no hindrance to the server, and once files are encrypted with user keys, those files remain encrypted as they move from laptops to desktops and USB ports. The single-platform process, Dasher says, reduces IT costs and eliminates repetitious security steps.

In conjunction with the Palo Alto, Calif.-based company’s release of NetShare, PGP also unveiled upgrades to its Whole Disk Encryption, Universal Server, Universal Gateway Email and Desktop products. The upgrades and NetShare are available now.