Only 27% of Organizations Use Encryption 175
An anonymous reader writes "According to a Check Point survey of 224 IT and security administrators, over 40% of businesses in the last year have more remote users connecting to the corporate network from home or when traveling, compared to 2008. The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users. Yet, regardless of the growth in remote users, just 27% of respondents say their companies currently use hard disk encryption to protect sensitive data on corporate endpoints. In addition, only 9% of businesses surveyed use encryption for removable storage devices, such as USB flash drives. A more mobile workforce carrying large amounts of data on portable devices leaves confidential corporate data vulnerable to loss, theft and interception."
Dont blame IT (Score:4, Insightful)
Support for things is already maxing many people out, now you want to add this?
Please.
Business As Usual (Score:2, Insightful)
Does anyone beiieve this number? (Score:3, Insightful)
I'm a consultant. I have honestly NEVER encountered any user at any company encrypting disk/usb/cd/dvd/email.
Exactly where does this BS stat come from again?
Re:Does anyone beiieve this number? (Score:5, Insightful)
That's another problem altogether (Score:5, Insightful)
So long as you don't work for Equifax, Choicepoint, the IRS, FBI or any other organization that's going to have my SSN on your Laptop. :)
That's another problem altogether - that kind of information should never be carried on one's laptop, period. It should only be accessed through a secure tunnel, and it should reside at HQ. There it should be encrypted.
Re:Encryption drawbacks (Score:4, Insightful)
Depending on the size of the organisation and the purposes for using encryption, key management may not be necessary, though you still need a capable and reliable lost-passphrase-recovery helpdesk which is going to cost.
I think you need to review just how much time you think computers spend reading and preparing data from the hard drive. If you're in the middle of a number-crunching job, it's pretty much negligible. And besides that, most business laptop users (the target users of full-disk encryption) are trying to read e-mail and write Powerpoint slides, they aren't trying to simulate protein folding.
* access to data is a bit harder even for legitimate purposes
Yes, that's the whole point. It's usually only a bit harder (you have to authenticate before the operating system will boot) but in return for that, the confidentiality of your data is protected. Security is about risk management and if the risk of publicising your company's secrets is more significant than the risk of users losing time by forgetting their passwords, then the trade-off is worth making.
Firstly, the kind of encryption they're talking about in the article, as implemented by BitLocker on Windows and third-party products on many operating systems, is transparent to operating system processes.
Oh noes! I pay my systems managers to manage my systems but don't want to pay people who know what they're doing!
Re:As a road warrior I should be using encryption. (Score:3, Insightful)
It depends on your job. If you're, say, a marketing consultant, encryption probably isn't all that important. If you work for a credit card processing company (I previously worked in the IT department for one) you absolutely should be using encryption.
Re:As a road warrior I should be using encryption. (Score:3, Insightful)
It all comes down to a simple calculation - what is the mathematical probability of someone stealing my drive vs. my OS or disk crashing?(1) Anyone who has traveled knows the second far outweighs the first.
I would go even further - What is the mathematical probability of someone stealing my [laptop] AND be interested enough in the data on the disk to bother trying to get access to it.
Even without encryption, getting access to the data on a laptop which uses OS password authentication requires some time and knowledge. I would argue that most people who steal laptops would reinstall as soon as they see a login screen. In other words, the hardware is more valuable to them than the data.
Be sure, I'm not saying the risk is zero, but it's pretty low.
Orlando
Re:As a road warrior I should be using encryption. (Score:3, Insightful)
100% Agree. The simple fact is if I encrypt it here I can't un-encrypt it there. Translation. My hard disk uses version 1.5.3.6.3.222.43..56666.333 of software BLOTZO.supersafe.org and nothing else I own does. My HD goes cactus I'm screwed.
I simply can't trust that I can recover from a failure. Even if I carry the magic secret key to the encryption.
It'll cost "me" more to recover than to have stolen.
P.S. I will go down on assault charges the next time some moron un-plugs my usb drive without safely ejecting it.
Which is why the correct response to "Oh dear my OS has failed and I now can't recover any of the encrypted data that was on the hard disk" is NOT "I'll have to crack out the bootable USB rescue disk that has never been properly tested and cannot possibly work in all circumstances".
The correct response is "Oh well, that's what the backup is there for".
(How easy it is to enforce your users not storing data on their laptops - or if they must do so guaranteeing they have a working backup facility in place - is another issue altogether).
Re:Business As Usual (Score:2, Insightful)
Security is not a product, I can give you the best security tools, but if you are too lazy to learn how to use them and the to use them with the needed competence(and paranoia) it will not work. There is no way to transform security in a magic button which an incompetent user just clicks and gets it.
Secutrity requires effort to check the keys, keep them private, accept the extra steps to apply and check it, remember passwords , keys and credentials ecc.ecc.
90% users are plainly and loudly annoyed by common access password expire time and complexity requirements. They are simply not intellectually ready to manage encryption of fixed and removable media.
A lot of organisations just are not that important (Score:4, Insightful)
Use systems that users dont need to think about... (Score:4, Insightful)
There do exist packages that can handle the encryption of at least fixed disks without the user needing to do anything more than the usual login. BitLocker for one (and BitLocker can plug into Active Directory easily)
With the right software, it is possible to protect the fixed disks of all PCs in the enterprise (including laptops that may only connect to the network through a VPN or may be used in places where there is no network access at all such as airplanes) and the only thing the users have to do is to log in just like they normally do. Mobile devices like Blackberries and Windows Mobile devices also have options for encryption that IT can enable. Even email can be encrypted without the users doing anything special using modern versions of Exchange (at least from what I read with Google)
Re:As a road warrior I should be using encryption. (Score:2, Insightful)
I also use a laptop often. However, I use TrueCrypt or BitLocker on Windows, and PGP WDE on my Mac. Why? Because if my laptop was stolen, I'd rather have it be "just" a hardware theft that I can get a police report, file a claim on my insurance, and replace my hardware. Without encryption, I would have not just a hardware theft, but a possible theft of:
* License keys to the OS and apps. A volume license key for a popular app is a boon for pirates.
* Personal Documents on the hard disk which can be used for ID theft, or used in combination with burglars to make finely targeted violent crime.
* Work documents. You would be surprised who has extremely company confidential material on personal machines because they need it for a remote presentation to a client. It could be something as simple as a roadmap of unreleased products that a prospective customer wants, but in the hands of competition, it would mean a major competitive loss.
* Passwords stored in a password manager, either the Web browser or another utility. I use different passwords for every Web site I go to, so if one site doesn't get compromised, it won't mean anything else does.
* Cached files. You can glean a lot of information even from deleted files about someone, the people they associate with, their job, and such.
* Identity. How many people put their Quicken files on a protected disk image or TrueCrypt partition, and make sure to unmount it when done balancing the checkbook?
* VPN settings. Even if someone doesn't know my VPN password, they will have account information, IP, and port number, and from this, they could try at the very minimum a brute force attack which either will work, or will have the account get denied. This would look very bad as an employee.
* Identity in another sense. A criminal can take a laptop and then masquerade as another individual to give the police someone to target and arrest.
On the road, I also take measures to contain data loss. I have a custom U3 USB flash drive that has a BartPE image on the CD part. I then have another USB flash drive with two TrueCrypt volumes on it. The first holds an OS image that I made before going on the trip. The second TC volume holds backup copies of my documents. Finally, I use a cloud computing backup service (using a keyfile so the documents leave my machine encrypted), so I am assured of fairly recent backups automatically. For maximum security, I keep a smart card on my keyring which can be used with PGP or TrueCrypt to ensure that if I have the smart card with me, no attacker is going to be able to mount those volumes.
USB flash drives are small, easily encrypted if you use known good software like TrueCrypt, Apple's Disk Image utility, LUKS, or EncFS, and easy to put in some sort of case (even a Ziplock bag) so they don't get lost in a laptop case.
Re:Does anyone beiieve this number? (Score:3, Insightful)
The fact that most of the laptops being stolen are falling into the hands of idiots is no excuse for failing to protect them from the real threats.
Re:Encryption drawbacks (Score:4, Insightful)
Using encryption has its drawbacks: .vs. ipsec) doesn't work well with encryption
* you must provide a meaningful key management
* you lose speed of your machines for number crunching
* you can easily lose data in the event of hardware corruption
* access to data is a bit harder even for legitimate purposes
* many systems (for example Active Directory domain controller
* skills of your systems management must be higher
I know you probably mean well, but every one of those statements is basically false.
- Active Directory + Bitlocker OR AD + Encrypting File System (EFS) both do automatic key management, key escrow, etc...
- Bitlocker has no performance impact, it uses the TPM chip. Also, most CPUs are MUCH faster at encryption than disks are at reading or writing data, so it's not a bottleneck even for software-only systems.
- hardware corruption causes data loss anyway, encryption just ensures that you only ever get valid data. In that respect, it's a little like ZFS -- encryption also provides integrity, as well as security.
- Access to data on encrypted volumes is NOT harder. It's usually transparent. If you have proper backup procedures in place, you need never access data in non-standard ways. Speaking of which, your backups should be encrypted too!
- AD works well with encryption, and has its own built in. It's already reasonably secure for most applications, and doesn't really need further encryption. The only AD related protocol that had issues with ipsec is DNS, but Windows 7 and 2008 R2 now support that as well.
- If you're already deploying Windows Vista or 7 SOEs, adding in Bitlocker trivial, it's basically a checkbox. Deploying ipsec is admittedly a little harder, but it's not exactly rocket science.
I've implemented extensive encryption before, and it wasn't hard, and the users never noticed. From what I've seen, the lack of encryption is not caused by technical issues, but laziness and politics.
Security is one of those things that's not a problem day to day, just like backups. The users don't notice, and nobody complains to the managers about it, so it must not be a problem, right?
You only need security on those rare occasions when there's a hack, or a laptop gets stolen, or some intern sells 10 petabytes of old backup tapes full of customer data on eBay for $35. Of course, when those things happen, it's already too late to implement security. The breach has already occurred. There's no going back in time to tick checkboxes.
In case you're wondering just how common data breaches are, check out this list of the publicly known ones:
http://www.privacyrights.org/ar/ChronDataBreaches.htm [privacyrights.org]
If that doesn't scare you, think about how many more there are that the public didn't find out about. Chances are good that your personal data has been leaked to God-knows-who, probably several times, because of lazy IT admins and inept managers.
Re:Business As Usual (Score:3, Insightful)
Well according to this article, it seems the vast majority of your peers cannot even be irked to do that much. Blaming users for not knowing how to use software they were never given in the first place takes a special kind of jackass.
Also, password expire times are idiotic that probably do more to reduce password security than increase it.
Re:Does anyone beiieve this number? (Score:3, Insightful)
I would mod you higher if possible.
This is exactly the case. Most places don't need encryption. I read a cleverly worded quote once that said something to the effect that security should serve business goals, and not just be there for security's sake. This is one of those cases. Encryption is a pain in the ass and not usually necessary.
The only data virtually every company needs to protect is their employees' personal info, generally in HR. SSN's, any Medical info from insurance claims, etc.
Of those 27% (Score:4, Insightful)
I wonder what percent of them wrote their password on a post-it note attached to their laptop.
Re:Does anyone beiieve this number? (Score:3, Insightful)
Whole disk encryption is really not difficult to do and it's a heck of a lot easier than having to apologize to all of your customers because you lost an unencrypted laptop with their information on it.