Cybersecurity

Data Security and Encryption

The number of data breaches and security threats has been steadily increasing for years.

In 2005 the annual number of reported data breaches was 157 million, and by the beginning of 2020 the number has increased by a factor of 10. [1,2] In 2020 we are witnessing a mass ongoing migration of various activities to virtual and online environments due to COVID. This means a sizeable increase of the attack surface, which is already being reflected in the number of successful security breaches. The data security of our companies is being compromised.

The concept of data security refers to the set of standards and technologies dedicated to protecting data from unauthorized access and modification. It prevents intentional or accidental destruction, modification or disclosure. It can even incorporate the physical aspect of security.

One of the tools we can use to implement data security is encryption. We have already talked about symmetric and asymmetric encryption on our blog and the different usecases where each can be used, though we can quickly refresh our memory of the basic mechanism they both use. On one side we have the sender, on the other the receiver, and they would like to exchange a message, plaintext, over an unsecured channel. Both have previously agreed on an encryption algorithm, a cipher, and both hold appropriate encryption keys. The sender encrypts the plaintext using their key into ciphertext, sends it over the unsecured channel, and the receiver can decrypt it and read the resulting plaintext.

One of the most important things to keep in mind is that before encrypting data, we need to understand what kind of data needs encryption, which algorithms are suited for a specific use case, and where will the encryption keys be kept. Encrypted information is only as secure as the encryption key. Would you like to encrypt data-at-rest? Use asymmetric cryptography to ensure authenticity of messages? Or maybe set up End-to-End Encryption (EEE)? Where and how will your keys be stored?

Apart from this, encryption is just one of the tools at our disposal that helps us to establish data security. There are also hashing, tokenisation, authentication and key exchange mechanisms, key management practices and more are, which are all components that a data protection strategy should consider.


---

Sources:
[1] J.Clement, Statista, 10.3.2020
https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/
[2] ITRC
https://www.idtheftcenter.org/2019-data-breaches/

News

Borzen with Utimaco HSM

Utimaco frontSlovenian company Borzen, a power market operator, has chosen to use quality hardware security module (HSM) from Utimaco for protection and management of cryptographic keys.

Read more ...

New Release of Atalla AT1000 HSM (8.40)

u.trust 360The Utimaco Atalla Team has announced the release of the Atalla AT1000 hardware security module (HSM) version 8.40.

Read more ...

u.trust 360 - Remote Monitoring and Management of HSMs

u.trust 360With the Utimaco u.trust 360 administration platform you can remotely access your Atalla HSMs for real-time monitoring, configuration or reporting purposes on premises or in the cloud.

Read more ...

Technical Training for Utimaco HSM

utimaco LAN V5 4CREAplus, authorized Utimaco training partner, is going to deliver an online hands-on technical training for Utimaco HSM, on 4-5 February 2021.

Read more ...

CREAplus awarded ISO 27001 certification

Utimaco video IG 4CREAplus has been awarded the ISO 27001 certification (full name ISO/IEC 27001:2013).

Read more ...