March 17, 2011
WESTON, Fla. & CAMBRIDGE, England, March 17, 2011 --Thales, a in information systems and communications security, announces a newly released survey and report, What Auditors Think about Crypto Technologies. The report, based on research recently conducted by The Ponemon Institute sponsored by Thales e-Security, reveals that crypto technologies play a crucial role in data protection and compliance activities across a wide range of industry sectors, in both private and public organizations.
More than 500 auditors were surveyed for the report with roughly half representing internal IT security audit teams and half representing independent external audit companies and consultancies. 44% of those surveyed had more than 10 years of experience with 46% holding the CISA accreditation and 24% acting as qualified security assessor (QSA) for PCI DSS audits.
One of the key findings of the research is that encryption and other uses of cryptography have become essential components of a data protection strategy and compliance program. Seventy-one percent of the auditors surveyed believe that an organization’s information assets cannot be fully protected, even within the corporate boundary, without the use of cryptography. Eighty-one percent believe that sensitive or confidential data should be encrypted whenever practical. Business confidential information, health information and financial or accounting information and payment transactions (including credit cards) were considered the most important types of information to encrypt.
In considering where to recommend that cryptography should be most effectively deployed the, auditors cited an organization’s internal application infrastructure, external service providers (particularly cloud based SaaS), end user devices (laptops and desktops) and external business partners as the areas that are the greatest source of audit failures. Selecting from the numerous scenarios where cryptography can be deployed within a typical organization the auditors most frequently rated the following as being highly effective in achieving compliance goals – desktop and mobile device encryption (76%), encryption of traffic over public networks (71%), database encryption (63%) and storage level encryption (56%).
Focusing specifically on the area of data confidentiality; encryption, whether deployed to protect a database, storage system, application or data entry system, is recommended more frequently over other techniques for protecting data such as tokenization, truncation and data masking – within databases and storage systems, encryption is recommended more than three times more often than any of these alternatives. However, the auditors highlight key management as a primary deployment challenge. In particular, when auditors were asked to identify the most pressing issues, top of the list came the administration of key management systems (29%), protecting stored keys (20%) and controlling the use of keys (19%).
The findings support the use of hardware security modules (HSMs) to ease these key management challenges and achieve compliance. Sixty eight percent of the auditors responded that the use of HSMs for encryption and key management reduces the time spent on demonstrating compliance with privacy and data protection requirements. This compares to a figure of 63% when the Ponemon Institute asked the same question of more than 200 PCI DSS auditors (QSA’s) a year ago. With the apparent growing recognition that HSMs play a critical part in the deployment of cryptography, it is not surprising that more than two thirds (79%) of auditors that took part in this new survey recommend the use of an HSM instead of relying on software-based systems to protect keys and enforce key management policies. Furthermore, 46% of the auditors surveyed go one step further and actually require the use of HSMs, a significant increase over the figure of 35% that imposed the same requirement among the QSAs surveyed a year ago.
“The use of encryption to protect data is now past the point of debate, everyone is using it and this report corroborates this. However, the question to be addressed now is how, when and where to deploy the technology. The research indicates that there are indeed genuine areas of uncertainty when deploying encryption, particularly arising from the numerous business drivers and diverse compliance requirements,” says Dr. Larry Ponemon, chairman and founder of The Ponemon Institute. “What organizations now need to do is ensure they adopt a strategic approach, proactively identifying and then following best practice when deploying cryptography to ensure they not only meet compliance around data protection but they also serve their wider security and operational needs.”
“Protecting customer and business data ought to be top priority for every organization, but demonstrating compliance does not inherently translate into data security. This survey reinforces the increasingly widespread acceptance that encryption and other uses of cryptography are important for achieving compliance requirements such as PCI DSS, HIPAA/HITECH and avoiding the penalties of many data breach disclosure laws,” says Franck Greverie, Thales Vice President in charge of Information Technology Security activities. “The report provides a valuable insight into the standards of due care that auditors expect to be applied when deploying cryptography, particularly regarding key management. With more than 40 years of proven experience in the field, Thales has long been a proponent of these best practices and works closely with its customers and partners to maximize the effectiveness of their protection investments. By providing hardware security modules, encryption appliances and key management solutions that are certified to the highest industry standards we enable our customers to address their ever growing data protection needs.”
In addition to quantifying attitudes towards cryptography the survey also questioned auditors regarding their general attitudes to compliance and IT security. The research found that the majority of auditors believe organizations are still not taking data security seriously and are not allocating sufficient resources to achieve data compliance requirements. Only 32 % of those surveyed say that the organizations they audit are proactive in managing privacy and data protection risks with less than half (45%) applying sufficient resources to achieve their data compliance requirements.
What Auditors Think about Crypto Technologies is a Ponemon Institute report, sponsored by Thales and is the result of a survey of 505 auditors of information security systems, information security auditors, qualified security assessors and EDP auditors. To download the report please visit www.thales-esecurity.com/l/program/Ponemonreport.aspx.
About the Ponemon Institute
The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries.
Thales is a global technology leader for the defence & security and the aerospace & transport markets. In 2010 the company generated revenues of €13.1 billion, with 68,000 employees in 50 countries. With its 22,500 engineers and researchers, Thales has a unique capability to design, develop and deploy equipment, systems and services that meet the most complex security requirements. Thales has an exceptional international footprint, with operations around the world working with customers as local partners. www.thalesgroup.com
Large-scale, worldwide scientific initiatives rely on some cloud-based system to both coordinate efforts and manage computational efforts at peak times that cannot be contained within the combined in-house HPC resources. Last week at Google I/O, Brookhaven National Lab’s Sergey Panitkin discussed the role of the Google Compute Engine in providing computational support to ATLAS, a detector of high-energy particles at the Large Hadron Collider (LHC).
Frank Ding, engineering analysis & technical computing manager at Simpson Strong-Tie, discussed the advantages of utilizing the cloud for occasional scientific computing, identified the obstacles to doing so, and proposed workarounds to some of those obstacles.
The private industry least likely to adopt public cloud services for data storage are financial institutions. Holding the most sensitive and heavily-regulated of data types, personal financial information, banks and similar institutions are mostly moving towards private cloud services – and doing so at great cost.
May 16, 2013 |
When it comes to cloud, long distances mean unacceptably high latencies. Researchers from the University of Bonn in Germany examined those latency issues of doing CFD modeling in the cloud by utilizing a common CFD and its utilization in HPC instance types including both CPU and GPU cores of Amazon EC2.
May 10, 2013 |
Australian visual effects company, Animal Logic, is considering a move to the public cloud.
May 10, 2013 |
Program provides cash awards up to $10,000 for the best open-source end-user applications deployed on 100G network.
05/10/2013 | Cleversafe, Cray, DDN, NetApp, & Panasas | From Wall Street to Hollywood, drug discovery to homeland security, companies and organizations of all sizes and stripes are coming face to face with the challenges – and opportunities – afforded by Big Data. Before anyone can utilize these extraordinary data repositories, however, they must first harness and manage their data stores, and do so utilizing technologies that underscore affordability, security, and scalability.
04/02/2012 | AMD | Developers today are just beginning to explore the potential of heterogeneous computing, but the potential for this new paradigm is huge. This brief article reviews how the technology might impact a range of application development areas, including client experiences and cloud-based data management. As platforms like OpenCL continue to evolve, the benefits of heterogeneous computing will become even more accessible. Use this quick article to jump-start your own thinking on heterogeneous computing.