Encryption key management: Critically important, frighteningly immature

Large organizations are deploying more and more encryption technologies these days on laptops, tape backup systems, mobile devices--everywhere.

Yes, they are concerned about regulatory compliance, data breaches, and embarrassing front-page headlines, but there is something else going on as well. Technology suppliers are now baking encryption into technology components and systems. As encryption becomes cheap and ubiquitous, risk-averse users will likely deploy it everywhere.

Ironically, multilayer encryption may actually compromise data security. Why? If data is encrypted multiple times, someone better know about the chain of encryption events that took place. Each encryption activity relies on an encryption key to return digital gobbledygook into readable text (i.e. Cleartext). One lost encryption key and the data cannot be recovered. Avoiding this problem demands formalized processes and robust technologies for key management--creating, organizing, storing, and auditing encryption keys.