Understanding encryption – from ancient Sparta to modern businesses
By Sergey Lozhkin, Kaspersky Lab Technology Evangelist
The process of converting data into an unreadable form in order to conceal it from unauthorised parties and, at the same time, granting access to those who are authorised – encryption is a very simple and extremely safe concept. If there is no way to read a piece of data, it becomes worthless.
Information that can only be viewed by authorised users is of no use to anyone else and therefore has no value. In other words, there’s no point in expending resources to gain access to it.
The history of encryption
Encryption used to be the exclusive prerogative of the military. The need to transfer orders and strategies, to agree alliances etc., without the information falling into the wrong hands, led to the appearance of steganography.
Steganography appeared around 440 BC, with the first encryption device being invented in Sparta. A piece of parchment was rolled over a stick with a particular diameter and a message was written along the axis of the stick. A stick of the same diameter was needed to read the text. This method is called a simple substitution cipher.
The appearance of computers in the post-World War Two period was the catalyst for the development of modern encryption. In the 1960s various block ciphers were created, which were cryptographically stronger than rotor machines. However, they required the use of digital electronics, signalling the end of manual and mechanical encryption methods.
The benchmark of modern encryption technologies was the creation of the Data Encryption Standard (DES) – a symmetric encryption algorithm developed by IBM and approved by the US government in 1977 as the official standard.
Types of encryption
Encryption is used to securely store and transfer sensitive data through insecure channels. Transferring this sort of data involves two inverse processes. First, data must be encrypted before being placed in storage or transferred via communication channels. To restore the source data the encrypted material has to be decrypted.
Initially, encryption was only used to transfer sensitive data, and only later to store it securely. A couple of algorithms, known as the cipher, carry out the conversions mentioned above. These algorithms are implemented using a key.
Encryption and decryption keys may differ, though they can also be the same. The secrecy of the second key (decryption key) makes the data inaccessible for unauthorised viewing, and the secrecy of the first one makes it impossible to corrupt data.
The first encryption methods used the same keys, but in 1976 algorithms for different keys were developed. Keeping those keys secret, and making sure they were distributed properly, was critical for ensuring sensitive data remained confidential when being transferred and kept. This task falls under encryption key management theory – also referred to as secret sharing.
Encryption technologies can also be divided according to the systematic approach to the process. For instance, when it comes to encryption on computers and other devices such as laptops, smartphones, tablets, etc., these methods can be divided into full-disk encryption and file-level encryption.
Full-disk encryption (FDE) technology is a special method of data protection that involves encrypting all the hard drive sectors, i.e. all the data stored on a hard drive is protected using FDE: swap space, system files, page files, hibernation files, and all temporary files. The technology can be used not only to protect data on a computer hard drive but also to fully encrypt all the data on removable devices.
A slightly different approach is used to encrypt individual files, file types or folders. The user decides himself what information needs to be encrypted, prioritises data according to its importance and decides what information is left in the open and what should be hidden away deep in the system and strongly protected.
The relevance of encryption today
The number of cyber threats such as targeted attacks on businesses and industrial espionage are constantly growing. In these circumstances the security of confidential data is a burning issue for companies of all sizes. According to a study conducted by B2B International in July 2012, 27% of IT specialists cited corporate data protection as being among the three most important tasks they face.
To protect data, it is necessary not only to combat malware and attacks on the corporate network but also to prevent data breaches caused by employees, either deliberately or due to negligence. This means the robust security of IT infrastructure must include anti-malware solutions, dedicated security policies and the means of encrypting data. And it is namely encryption technology that provides the last line of defence and ensures the integrity of corporate data.
Encryption is among the top five most popular security measures: according to B2B International, 44% of companies use it to secure critical data and 36% encrypt all their data.
Another critical area where encryption must be applied without fail is that of mobile devices and the data stored on them. IT-related news resources regularly carry stories about stolen laptops, lost flash cards and smartphones with confidential or personal data, and even classified data belonging to secret services.
According to research by the Poneymon Institute, over 12,000 laptops are stolen or lost every week in the US and only 34% of them contain data that has been encrypted. This poses the risk of potentially huge damages to both businesses and individuals.
Today’s enterprise data encryption
Encryption can play a decisive factor in combating one of the most serious threats of late – targeted attacks. Today’s hackers, who may well be working for a corporation or a government, use state-of-the-art technologies to penetrate a protected information environment for the purpose of industrial espionage.
This can involve breaking into servers and web applications, social engineering, evasion of intrusion prevention systems and other methods of gaining access to confidential data.
Lots of money can be invested in security systems to counter these threats, but something may well be missed that eventually leads to the theft of valuable information. However, no matter how skilled the hackers may be, if the data is encrypted, the stolen information is completely useless without the decryption key. And cracking modern key algorithms is impossible.
If data is not encrypted and an attacker gains access to the very heart of the corporate IT infrastructure and the data stored there, the consequences could be catastrophic. For an individual it could mean the theft of highly confidential data, photos, creative works, personal data, etc., the use or publication of which could cause serious moral or financial damages.
For businesses the theft of trade secrets, financial information or the personal data of employees could threaten the very existence of an enterprise and could result in the senior management being held accountable by state regulatory bodies.
Nowadays, some types of licensed activities are impossible without digital data encryption systems, for instance, activities related to electronic payment systems and online banking.
Implementing encryption technologies on an existing corporate system is a relatively simple process, as today’s solutions have minimal impact on resources.
This is primarily down to using data encryption software that is compatible with the traditional IT solutions used in corporate environments, from operating systems to back-up solutions. Without a doubt, data encryption is the most reliable way to secure confidential information.