For most organizations, the entire impetus to encrypt is closely tied to the need to be compliant with one regulation or another. There is the PCI regulation, the HITECH act of 2009, HIPAA, Sarbanes-Oxley, and a whole host of state privacy laws. If you are going through the due diligence of database encryption, you sure as heck want to get it right the first time.A big part of getting it right is using the right encryption tool. There are plenty of tools on the market that claim to do encryption, and you probably know a clever programmer or two who thinks he can come up with a nifty little data scrambling algorithm that no-one has ever seen before. But encryption — real encryption — demands that we reach for a higher standard.
The U.S. Department of Commerce publishes the definitive encryption standard on its National Institute of Standard and Technology (NIST) website and to date, hundreds of cryptographic providers have achieved this high standard. As of this writing, NIST has certified over 1,300 AES encryption implementations.
A Fundamental Truth
Cryptographers do not suffer fools lightly. Their science is mathematically based and their algorithms are well known and well vetted. A fundamental truth of cryptography is that real encryption cannot rely on keeping the algorithm secret. Instead the secret that protects the data is the encryption key, and only the encryption key. Anyone who says different may find themselves on the receiving end of an extra-long mathematical dissertation on the mathematical correctness of accepted encryption algorithms.
When you stop to think about it, this makes perfect sense. If the world used a secret algorithm to encrypt data, if that algorithm were ever to be discovered then all the world’s data would be at risk. But if the key is the one-and-only secret that unlocks the data, then a compromised key only puts the data at risk that was encrypted with that particular key. All the other data that has been encrypted with other keys is still safe. This demonstrates both the wisdom of strong (and open) algorithms, but also the essential importance of strong key protection.Another benefit of open algorithms is that they are peer reviewed and extremely well vetted. The AES standard that is the de-facto standard for encrypting data at rest is well known in cryptography and mathematical circles and is recognized the world over as the most effective method for encrypting business data. Its modes of encryption are well known and proven. And there is a strong body of knowledge about how to correctly implement the AES standard. From the perspective of a cryptographic (encryption) provider, encryption libraries are not easy to write, but they are known to be solid when implemented according to accepted standards.
Homegrown Encryption
Unfortunately, some software providers seemed to have taken a different road. AES encryption must have seemed too difficult, or too cumbersome, so instead they found loopholes and/or shortcuts to simplify their implementation. Some software providers use untested software, or unique and un-vetted methods of encryption. These data scrambling methods aren’t (and never could be) NIST or FIPS certified, but if their customers never ask about certification or independent validation, those providers are not likely to raise the topic.
So we are seeing a raft of uncertified, and un-vetted cipher methods introduced in the market place. Some, like OMAC, CS, and CWC have languished on the NIST list of “Proposed Modes” for years, while others like CUSP have never even been submitted as a proposed standard. And while it is possible that one or more of these upstart modes could be better than one of the current, standard modes, there is no way to know this because these new modes have not been properly tested and crypto-analyzed. Without testing and peer review, each of these modes is just another premature idea that is statistically more likely to be a bad encryption method than a good one.
Show Me the Cert!
Many software vendors are beginning to recognize the value of certifications. Some claim certifications they don’t actually have (HINT: PCI does not certify encryption software) and some will use confusing language to infer they have achieved levels of certification they haven’t. Recently I visited a website that claimed (I’m paraphrasing):Our stuff uses FIPS 140-2 certified algorithms to ensure the highest level of data security.
The NIST AES website displays no record of this company ever having received a certification for any encryption software. Clearly they recognize the value of certification, but have not yet knuckled down to do the hard work to make it so. And if you don’t check their supposed “facts,” it’s likely that you’ll soon regret it.
My advice? When someone claims to be certified for any type of encryption, ask a simple question: “Can you show me the cert?” It ought to be available on the web, or in paper form that they can show to you so that you know this software has passed an independent evaluation. If they have a cert, then you can dig down deeper and find out whether the software will fit your needs. But if they are claiming a certification that they cannot prove, my advice is to keep your hand on your wallet and then run.
For more information on encryption and key management, download our white paper titled "AES Encryption and Related Concepts."
When we walked in the room at St. Martins University, there was a look of amazement in my eyes to see the amount of people involved in our community. Two hundred people filled the room Tuesday for a lunch put on by United Way for their Spirit of Giving celebration. Today was not just a lunch date, it was for honoring businesses and community members for their stewardship. We had the chance to enjoy listening to one of the local high school choir groups and Bill Grace, the director of Common Good Works, speak to us about “Leadership for the Common Good.” We had a few heart felt moments during our special lunch, for example when handing out the Gladys Burns Human Service Award. The award went to a man who has recently passed away, but has left a hand print in the world with his generosity toward Thurston County. His wife accepted the award on his behalf and explained how his life was spent helping others. 
Townsend Security received the award of corporate sponsor of the year, by increasing our donations by 132%. Here at Townsend, our company matches our donations dollar for dollar to any 501(c)(3) non-profit organization, up to $500 per employee each calendar year.
The Advanced Encryption Standard (AES) is the standard for data encryption adopted by the NIST in 2001. This encryption standard replaced the earlier Data Encryption Standard (DES). The DES encryption standard became weaker due to the advancing power of computer systems. The NIST began a process in the late 1990’s to find a replacement for DES. After a lengthy examination of several alternatives, the AES standard for encryption was adopted and codified as FIPS-197. AES encryption is now the de-facto standard for strong data encryption.
The modern Enterprise uses a wide variety of server platforms from a number of different vendors. In addition, data is exchanged with customers, vendors, and service provides outside the organization. To meet these challenges the 
As companies work to meet regulatory requirements to protect Personally Identifiable Information (PII), one option to minimize the risk of loss is to replace sensitive data with a non-sensitive replacement value, or “token.” 
I found the data breach of Epsilon just shocking for several reasons:
We're just recently back from the COMMON 2011 conference in Minneapolis. What a great experience for Townsend Security and our IBM i customers. The encryption and key management sessions that Patrick and I presented were well received and well attended. Many of the attendees were interested in the mechanics of encryption, and many of those were pleasantly surprised to learn that there is now a way to encrypt database fields without doing massive application program changes. 
Encryption and tokenization are the two leading technologies used to protect sensitive data from loss and subsequent breach notification and legal liability. Organizations who try to meet compliance regulations struggle to understand when to use strong encryption and when to use tokenization to protect information. Many organizations will find both technologies helpful in different places in their IT infrastructure.
We've been tracking the growing need for encryption and key management to secure the mass of data that is (or soon will be) residing in the Cloud. To address this issue, a security group was recently formed that is completely focused on Cloud security. If you’ve not visited the Cloud Security Alliance web site, it is well worth a visit at www.cloudsecurityalliance.org.
The other night I went to my very first WLC meeting. WLC is apart of United Way, it stands for Women's Leadership Council. WLC’s mission is to positively impact the lives of women in our community by promoting self sufficiency and financial stability through philanthropy and community service.
Pretty Good Privacy (PGP) is the de facto standard for encrypted file exchange among the world’s largest financial, medical, industrial, and services companies. Based on open standards and tested by time, PGP has won the trust of governments and private enterprises to protect their sensitive data. Here are the six key things to know about 