Cryptography is everywhere.
It has become an integrated layer of defense within all of the digital transformation initiatives now collectively referred to as digital business. As the foundation of modern security systems, cryptography is used to secure transactions and communications, safeguard personal identifiable information (PII) and other confidential data, authenticate identity, prevent document tampering, and establish trust between servers. Cryptography is one of the most important tools businesses use to secure the systems that hold its most important asset – data – whether it is at-rest or in-motion. Data is vital information in the form of customer PII, employee PII, intellectual property, business plans, and any other confidential information. Therefore, cryptography is critical infrastructure because increasingly the security of sensitive data relies on cryptographical solutions.
Weak or hidden crypto can expose critical infrastructure to vulnerabilities. Public attention to exposed data leads to brand erosion. This modern environment requires organizations to pay attention to how cryptography is being implemented and managed throughout the enterprise.
When wrapped within the invisible layers that form cryptography, sensitive data becomes unreadable and unmodifiable, preventing bad actors from carrying out nefarious activity. The core elements that make the cryptographic layers safe include algorithms, keys, libraries, and certificates as described here:
- Cryptographic Keys are used in conjunction with cryptographic algorithms to protect sensitive information. Cryptographic keys must use an appropriate key length as defined by NIST (National Institute of Standards and Technology) and private keys must be kept secret to be effective. Relying on insecure keys or disclosing secret keys makes cryptography obsolete.
- Digital Certificates are used to maintain trust between connected digital components. Digital certificates need to be properly managed to ensure that the use of compliant algorithms and key lengths, as well as being renewed prior to expiration to avoid security gaps. Non-compliant or hidden certificates can lead to massive systems outages or data
- Cryptographic Libraries contain an implementation of cryptographic algorithms that can be used by applications developers to protect sensitive information. Cryptographic libraries need to be selected carefully and must be up to date to meet the required security level. Relying on insecure implementation or end-of-life cryptographic libraries can introduce hidden critical vulnerabilities across applications and infrastructure.
- Cryptographic Algorithms are the mathematical foundation that maintain the integrity, confidentiality, and authenticity of sensitive information. Relying on standardized and mathematically secure algorithms is mandatory to prevent data disclosure, data tampering, or repudiation.
The topic of cryptography has been gaining popularity over the last few years due to the considerable impact it has when poorly managed, as well as the rise of quantum computing (post-quantum cryptography) and new cryptographic regulations. Hidden instances of weak and non-compliant cryptographic mechanisms represent a challenge for enterprises and the security, risk, and compliance teams who secure digital business. Fortunately, tools like our Cryptography-as-a-Service make compliance and management easy, giving you complete control over the creation, management, and use of your cryptographic keys without the need for your own on-prem experts or hardware security modules (HSMs).
Cryptography is a dynamic and a mandatory component of digital business. Organizations need visibility into their cryptographic instances as well as guidance from not only standards groups such as NIST and ISO (International Organization for Standardization), but also the web browsers who control the user interfaces that connect businesses with consumers via secure online communications. Crypto agility is the key to keeping pace with the latest cryptographic compliance requirements, standards, and recommendations that sustain and secure digital business.
The next blog in this series will look at the impact of the proliferation of cryptography and we will wrap up this series looking at the importance of Crypto Agility.
Learn about Entrust’s Cryptographic Center of Excellence (CryptoCoE)
Additional Resources
