I am a big advocate of encryption. It is such a great tool for protecting sensitive and personally identifiable information (PII), particularly for such data that moves…while on mobile devices, storage devices, and while being transmitted through networks. Historically it was a challenge to implement.
In the past few years implementation has been getting much easier, and continues to improve. However, it is still no surprise, but yet a disappointment, that a recent study from Credant Technologies, Inc., yes, an encryption solution vendor, found that out of 426 IT practitioners interviewed throughout the world, 88% know sensitive data and PII is on their personnel’s mobile computers, but the only 20% have deployed encryption for such devices. Note the encryption is deployed; I would bet that the actual amount of PII and sensitive data encrypted on those devices is actually much lower.
“The Credant survey asked respondents to list reasons why their companies hadn’t adopted encryption. Fifty-six percent said it was due to a lack of funding; 51% said encryption was not an executive priority; and 50% said they were impeded by limited IT resources.”
I believe there are other factors the study probably did not consider as well. Most of the companies I speak with have not even defined or classified their sensitive data and PII. They also really have no idea where all this data is located. Some were very surprised to find that significant amounts of sensitive data and PII were located on mobile computers and storiage media, even though they had policies against put the data in those areas.
Another issue is personnel using their own personally-owned computers at home and other places away from the work site to process, access, store and otherwise use business sensitive data and PII.
It will be great when some day operating systems come with full disk encryption standard, and transparent to the user, won’t it?
Tags: awareness and training, encryption, Information Security, IT compliance, mobile computer security, policies and procedures, privacy