Cryptography: Understanding Its Not-So-Secret Importance to Your Business

If you're just asking yourself whether your organization needs to implement encryption to protect its data, the answer is straightforward: Yes.

Evil people will try to steal your data. And the only criteria that you need to meet for your data to be vulnerable to malicious attacks is, well, having a computer.

Actually, even just a smartphone or any other connected device is sufficient.

It's time to explore the fundamental reasons why cryptography is 100% essential for any organization out there.

What is Cryptography and How Does it Work?

Cryptography is a creative but scientific transformation of data into an unreadable (encrypted) format that can only be deciphered (decrypted) by the intended recipient so that no unauthorized party may otherwise access it.

Information in storage or transit is secured and made confidential using deterministic algorithms that generate cryptographic keys using various techniques. These digital keys used for encryption can be the same used for decryption (symmetric cryptography), or a new set of keys must be used by the end user so that even the sender cannot access this data anymore (asymmetrical cryptography).

Some of the most common techniques include merging words or plaintext with microdots, images, or symbols. This way, text is transformed into illegible gibberish and scrambled into ciphertext that could only be decoded by the intended recipient.

The fundamental principles of modern cryptography are:

Confidentiality

Privacy of individuals must be protected at all costs, so the message can only be understood by the intended recipient. For anyone else, encryption must ensure that the information is unreadable.

Integrity

The information transferred or stored must never be altered during the process of transmission. A cryptographic hash is utilized to guarantee that the information is always genuine, and that any alteration can be detected.

Authentication

Both the source of information and the receiver must be able to confirm each other's identity and identify the origin and destination of the data. This is done by exchanging a special key.

Non-repudiation

The sender or creator of the information cannot deny his or her intention to transmit or create the information that was transferred. Digital signatures are used to ensure non-repudiation.

You Need to Protect Your Data Now — With Cryptography — Like, Right Now!

It's understandably hard to believe that there are a million hackers, spies, and criminals out there waiting for the right occasion to steal your data. It may sound like an exaggeration, but the that's just the plain truth. Even if your business is a small, unimposing e-commerce or retail shop, if you're connected, you're in danger.

According to the Ponemon Institute-Keeper, 66% of small to medium-sized businesses (SMBs) have been attacked in the last 12 months. The cost of such incidents may reach up to $162,000 USD if it affects an IT infrastructure hosted by a third party — a damage from which an SMB may never recover.

But, cryptography may significantly reduce the severity of such accidents.

How? Well, simply put, if your encryption algorithms are robust enough, your data may hold no value to the evil forces that stole it in the first place. Yes, you can still salvage it. For example: back in 2013, Adobe suffered a massive data breach that involved the theft of 38 million user accounts. The consequences of the nightmarish accident were, however, somehow mitigated by the fact that passwords as well as debit and credit card numbers were encrypted.

That's a huge difference, as you can see.

Dealing with Compliance Requirements and Industry Regulations

Today, encryption is required if you handle any type of sensitive information. For example, any customer's financial information (bank accounts, credit cards, prepaid cards, etc.) must be protected during any and all transactions.

Several laws are in place to ensure that information such as financial info, military data, personal health information, electronic medical records, government data, and confidential information is protected by cryptographic keys during storage or transmission. These laws include the HIPAA, HITECH, SOX, GLBA, PCI DSS, and many others, and most organizations must be compliant with their requirements.

In June 2003, the U.S. government approved the Advanced Encryption Standard (AES) as a sufficiently secure encryption scheme to safeguard classified information up to the "supersecret" level.

It was established in 2001 by the National Institute of Standards and Technology as a Federal Information Processing Standard (FIPS 197) when its predecessor, the Data Encryption Standard (DES), started to become vulnerable to brute-force attacks.

The AES is a symmetric-key cryptography that handles 128 bit blocks, using longer key lengths sized at 128, 192, and 256 bits. Today, it is broadly accepted as the industry standard by most organizations both in the public and private sectors.

Final Thoughts

Modern cybercriminals are becoming more aggressive every day, but they're not the only prying eyes trying to spy on your data (*cough cough* governments using massive surveillance programs *cough*).

There are many ways to ensure that your data is safe and secure, and cryptography is probably the first one you should employ. You can always encrypt the data you're storing in your databases or moving across the internet or clouds on top of any other cybersecurity layer you already established.

So stop thinking about "why I should do it" and start thinking about "how I should do it".