Study: Encryption and key management increasingly viewed as strategic issues

Steady increase in the deployment of encryption solutions


IT security firm Thales has announced the publication of its latest Global Encryption Trends Study. The report, based on independent research by the Ponemon Institute and sponsored by Thales, reveals that encryption continues to be viewed as a strategic issue and that organizations are increasing their investment in encryption across the enterprise in response to compliance regulations and cyber-attacks.

More than 4,000 business and IT managers were surveyed in the US, UK, Germany, France, Australia, Japan and Brazil, examining global encryption trends and regional differences in encryption usage. The report is now in its eighth year since its launch in 2005.

The results of the study show there has been a steady increase in the deployment of encryption solutions used by organizations over the past eight years. The percentage of overall IT security spending dedicated to encryption has also increased, almost doubling from 10% to 18%, demonstrating that organizations are prioritizing encryption over other security technologies.

 Some of the bigger encryption trends over the past eight years include:

  • Increase in the use of encryption as an enterprise rather than a point solution.
  • More influence at the business unit level in choosing and deploying encryption technologies.
  • Decrease in the importance of compliance as a main driver to encryption adoption.
  • Increase in spending on encryption and key management as a percentage of the IT budget.

Encryption  is a Strategic Issue

Encryption continues to be viewed as a strategic issue with business leaders rather than IT or security professionals gaining greater influence over their organization’s encryption strategy. For the first time business managers in the United States became the more influential group in setting the encryption strategy, demonstrating that encryption is no longer seen as just an IT issue but one that affects an entire organization.

“Encryption usage has emerged as a clear indicator of a strong security posture with organizations that deploy encryption being more aware of threats to sensitive and confidential information and making a greater investment in IT security. Regardless of an organization’s situation, it is clear that encryption and key management are becoming more widely deployed,” said Dr Larry Ponemon, chairman and founder of The Ponemon Institute.  

Perceptions about the most significant threats to the exposure of sensitive or confidential data are employee mistakes, forced disclosures triggered by e-discovery requests and system or process malfunctions. Combined, these concerns over inadvertent exposure outweigh concerns over actual malicious attacks by more than two to one.

Top Data Protection Priorities

The top data protection priorities focus on identity and access management, data discovery, protecting data in use within business applications and protecting data in outsourced or cloud environments. The importance of protecting data in cloud environments rose significantly from last year’s survey ranking fourth in priority – up from 12th.

When it comes to buying criteria, performance is always the top concern. The next largest issue is key management with 38% of respondents saying they have a formal key management strategy. To support that strategy, the new Key Management Interoperability Protocol (KMIP) standard that allows organizations to deploy centralized key management systems that span multiple use cases and equipment vendors, has already established a relatively high level of awareness among IT and IT security practitioners. KMIP is perceived to be of increasing importance and is expected to contribute to encryption and key management strategies specifically around the cloud, storage and application-centric deployments.

Hardware security modules (HSMs) are increasingly considered a critical component of a key management strategy. These devices are used to protect critical data processing activities and can be used to strongly enforce security polices and access controls.

This content continues onto the next page...