A Letter to Homegrown Data Protection

Dear Homegrown Data Protection,

I wanted to write you a letter to say thank you for being an option in our company’s quest to find an encryption solution that works for us.  You have some neat algorithms and some pretty cool features that we haven’t seen before.  However, just because you look secure and have a bit of sparkle around doesn’t mean that we’re ready for you to protect our sensitive data.

Sure, you seem like a great idea on paper; you’re cheap up front, you’re pretty sure that you can help us meet all of our compliance regulations, and your algorithms seem to make you  just as secure as anything else on the market.  What’s not to like?  Still, I feel that you might be missing something in a few key areas.  Before you start encrypting our data there are three things I want to ask you about.

First off, how are you planning on securing our sensitive data?  Are you planning on doing scrambling, masking, or doing actual encryption?  Scrambling sounds great in theory, but if all your program is going to do is mix up all the letters and numbers, I’m not sure how comfortable we would feel about that.  When it comes down to choosing between data scrambling and data encryption, encryption is going to be much more secure.  There are lots of widely accepted encryption libraries out there like AES or Triple DES that you could use to be sure our data will stay safe.  AES has been around since 2001, and is the de facto encryption library to use.  It’s strength lies in its 128-bit, 192-bit, and 256-bit encryption keys.

That brings up the next point: how are you going to manage the keys?  Where are you going to keep them?  Who is going to handle them?  In order to be compliant with many regulations, we will need a solution that has dual control, meaning that at least two people need to authenticate a process before a key can go to work.  It will need separation of duties, which keeps the people handling the key away from the people handling the sensitive data, and visa versa.  Now this isn’t always easy to implement on some OS's, and on some OS's it’s nearly impossible. One way to accomplish that would be to use a hardware security module (HSM).  These HSMs allow companies to keep their keys separate from their sensitive data, and out of the hands of anyone who might break into their system.

Lastly, is your encryption solution going to be NIST Certified?  If you haven’t heard of the National Institute of Standard and Technology (NIST) you might want to check them out.  Being NIST certified means that your product follows proper cryptographic implementation standards, and meets best practices for security.  Every solution that has gone through the NIST certification process has been through a series of rigorous and complex tests to find even the smallest error that could cause the encryption algorithm to fail.  Your algorithms look fine and have some pretty cool features, but we are looking for something that is going to stand the test of time.

Again, I really appreciate you being an encryption option, but when it comes to protecting data we want to be sure that we are getting the right thing.  Give us an encryption solution that is secure, stable, and certified.

Sincerely,

Jacob