When the environment cannot be controlled, encrypting the data is necessary to protect the data against unwarranted disclosure or unauthorized and undetected modification. Note that the Internet is considered a hostile environment, and data is not secure while being transmitted on the Internet. Email or data in transit on the Internet is readily accessible to:
- Anyone working for the sender’s Internet Service Provider (ISP)
- Anyone working for the recipient’s ISP
- Anyone who operates any of the Internet routers that the email or data packets pass through
Encryption of data is the transformation of the data by applying a formula or algorithm and storing it in its transformed state so that it is not readable unless the reader knows how to undo the transformation, i.e., decrypt the data. Computer processes may be set up to do the encryption on demand or automatically when the data is stored or transmitted through a network.
There are two general reasons for encrypting data:
- To protect data stored on a shared-use or non-secure computer
- To protect data while it is in transit through a hostile environment
Although a computer is shared or located in a non-secured area, a user may wish to store confidential data on the computer that should not be available to any other user of that computer. A shared-use computer may be located in an environment where personnel don’t have regular workstations or offices. Some may work from home, on the road or at another business location. Some examples of computers in non-secure areas include a teller’s terminal in an exposed area of a bank, a broker’s terminal with investment information, or a nursing station in a clinic or hospital. Encrypting the data before storing it on the exposed computer will provide the needed protection.
Data may be in transit through a hostile environment on portable media or through an unsecure network such as the Internet. Portable media include portable computing devices such as laptop computers, personal digital assistants (PDAs) or smart cellphones, memory keys, tapes, external hard drives, CD/DVDs or even diskettes. Data in transit on the Internet and needing protection may include email, email attachments, backup data for offsite storage, and data or messages transmitted using FTP or instant messaging programs such as Microsoft Live Messenger, AOL Instant Messenger, Yahoo! Messenger, ICQ and Google Talk. Encrypting the data before transmission will provide the needed protection, but it is necessary to provide decryption capability to the receiver of the data or message.
Specific data to be considered for encryption includes but is not limited to: customer confidential data, sensitive enterprise data such as business plans, research results, client contact and relationship information, data subject to privacy legislation, emails and email attachments. With all such data, it is important to note that protection is required against both disclosure and unauthorized undetectable modification of the data.
For example, payroll data may need to be transported to a third party for processing. An enterprising employee could bribe the truck driver to redirect the tape containing payroll data to him for slight modification before delivery. In this way, for example, the data could be altered to subtract $1.00 from every employee except one and adding the results of all subtractions to the one employee grossly inflating his salary. This scenario could be avoided by encrypting the data before storing it on the tape, making it impossible to read, modify and store the changes on the tape without detection if the encryption process was sufficiently restricted.
As another example, imagine the impact of an innocuous email that you send to your manager being altered after it leaves your computer. The changes made to the message complain about your manager’s treatment of your work and your work conditions using foul language. Further, the message is redirected to the president of your enterprise. This scenario may be avoided by implementing automatic encryption of email content and using digital signatures to guarantee that the email has not been tampered with. Digital signatures for email also authenticate the source of the email so an email cannot be forged (technically, “spoofed”) as coming from someone else.
Jeffrey is a popular presenter, and was an adjunct professor at York University for 15 years. He is a frequent course director and course author for many organizations, including provincial bodies of Chartered Professional Accountants across Canada.
He has written over 20 books including: Canadian Treasury Management, Canadian Risk Management, and Financial Instruments: A Guide for Financial Managers (all published by Thomson-Reuters/Carswell), as well as Finance and Accounting PolicyPro and Information Technology PolicyPro (guides to governance, procedures, and internal control), and Cash Management Toolkit for Small and Medium Businesses (all published by Chartered Professional Accountants of Canada [CPA Canada]).
- How does IT recovery planning differ from business continuity planning? - August 4, 2015
- How to manage bank accounts: the basics - July 6, 2015
- Refresher on financial statistics and metrics - April 6, 2015
