Enterprise key management deciphered

In recent years, high-profile data breaches and identity thefts have grabbed countless headlines. The media coverage suggests it's an emerging problem, but unfortunately these cybercrimes and their frequency are nothing new. Instead, what's changed are the new laws requiring organisations to notify individuals when unencrypted personal information has been — or at least is reasonably believed to have been — acquired by an unauthorised entity.

Driven by these laws and their safe-harbor protections, along with regulatory bodies such as the Payment Card Industry Data Security Standard (PCI-DSS), HIPAA (Health Insurance Portability and Accountability Act) and Sarbanes-Oxley (SOX), enterprises are rapidly adopting encryption to protect their customer data, trade secrets and intellectual property. As encryption becomes more widely adopted, organisations are also experiencing an increasing concern about the management of a growing set of encryption keys. Effective management of these keys is essential to ensure both the availability and security of encrypted information.

Two distinct systems can be leveraged to manage keys: enterprise key management (EKM) and integrated key management. The idea of EKM has emerged as an apparent panacea for addressing this management complexity. An EKM provides centralised management, including key generation, backup and recovery, to ensure data can always be recovered. It also provides the ability to manage and change keys throughout their life cycle.