A deeper look at Data Security readiness

Nishant Verma,
Country Manager India & SAARC, WinMagic

A key foundation or the first pillar of any data security solution should start with data encryption and key management. If a solution is built with the proper foundation, the risks associated with data loss or exposure are greatly reduced, including the negative impacts on the process and capabilities. But this begs the question: what is your organization thinking and approach to securing their environment? How far down the path have they gone in securing their environments and is encryption a key foundation? There are, of course, different levels of security that can be established across different areas or sectors of the business - encryption solutions are no different. 

More than ever before, data encryption and security are top of mind among most IT administrators as more and more regulations and laws are put in place to curb the risk of data loss. As organizations seek to improve their security models, they are faced with a myriad of options to lock down systems, processes and networks.   

However, in our experience organizations have avoided looking at a robust encryption solution because they feel:

• It can be too costly and expensive.

• It will slow down overall device performance.

• Process and capabilities become complicated and affect user experience.

• There are too many devices to secure and monitor leaving organizations at a loss from where to start. 

Nishant Verma, Country Manager India & SAARC, WinMagic, opines, "If the right data encryption solution is implemented, it is possible to fully secure your organizational data while reducing  IT costs and being completely invisible to the end-user." Also, the idea of maturing your processes and solution approach is critical to understanding and controlling your security. There are five levels of data encryption maturity that organizations can find themselves in:

Level 1 – Unaware

A level where there is no data protection solution utilized by an organization. As far as the business is concerned, there is no business driver to adopt encryption.

Organizations in this category are at a high level of risk in the event a device is lost or stolen. They typically haven’t evaluated their security needs and the risks associated with not adopting such a foundational approach to data security.

Level 2 – Tactical

This is a level where a company selectively deploys basic software or OS-based encryption to a defined and often very limited number of laptops devices. There are no central management capabilities and is managed via desk side support only. It is a baseline solution that may be “good enough” but lacks control and efficiency as it will generally encrypt only one type of device (like a laptop), in a silo’ed team or department.   

This tactical approach is often born out of the need for compliance to specific laws, legislation or regulations.

Level 3 – Defined

This level is defined as encryption being leveraged across most, if not all endpoint (laptops) devices and may begin to include some removable media. Centralized management is also introduced at this level. There is room for improvement as there are still devices and endpoints that do not have data security and could act as an access point to authorized users. 

In this instance, like the Tactical level, compliance is driving the need for encryption but in addition to this, there is a requirement for better audit and control capabilities. 

Level 4 – Managed

A level where most, if not all, devices are encrypted, including desktops. This is all controlled through a fully centralized management solution and gives administrators the granularity of control they need without being a hindrance to the end-user. 

Building on the same business drivers as the Defined category, Managed organizations also need to improve their overall IT management process and ensure they maintain a positive brand image. 

Level 5 – Optimized

At this level, organizations are taking complete control of all devices and are deploying encryption for all data no matter where it resides. Management capabilities enable a view and control of all endpoints, irrespective of platform, and key management capabilities for securing and encrypting data that resides in public or private cloud.

The big difference for Optimized organizations is that their need is to have a solution that can help decrease IT management costs and reduce or eliminate the impact on the end-user experience that could hurt productivity.

At this level, organizations are in the best position to reduce risks significantly and safeguard confidential data.