Sending and receiving data is a fundamental part of daily business for nearly every organization. Companies need to share financial transaction details, customer information, employee data, intellectual property, and other forms of sensitive information with a wide range of external parties.
However, each time an organization sends sensitive data outside its own network, it exposes itself to risks. Data can be intercepted en route, stolen from recipients, or passed along to unauthorized parties. The financial and public relations consequences of these types of data breach grow more severe each year.
Four Obstacles to Secure Exchange
Strong encryption is the only reliable way to protect data while it moves between people or organizations, and a growing number of industry and government mandates now require it for particular types of information. Adoption has still been slow, for four reasons.
Incomplete coverage is the first. Most encryption tools address a handful of use cases and leave everything else in the clear, and those gaps are exactly what a capable attacker looks for. Passphrase exchange is the second. Symmetric encryption means the sender has to get the passphrase to the recipient somehow, which tends to end with it travelling through an insecure channel.
Uncontrolled encryption is the third. When people encrypt files with tools and passwords of their own choosing, the organization can lose access to its own data. Operational complexity is the fourth, and it is why public key infrastructure defeats so many projects. It demands training and support commitments that large organizations cannot sustain.
Together these leave a poor choice. Exchange less data, or accept that some of it will be compromised.
What Policy-Driven Exchange Changes
The alternative is to take the decision away from the individual. Sensitive data is detected and classified automatically, and persistent encryption is applied on every enterprise operating system without the user being asked to do anything.
Automated key management is what makes that hold up after the file leaves. Administrators keep control of access to protected data even once it has travelled outside the network, and regardless of how it was sent. A file stays protected however many times it is copied, moved, or shared onward.
Because the protection follows policy rather than the channel, the same rules apply whether data goes out by email, through the cloud, or over FTP. There are no gaps between mechanisms, and no workflow for employees to work around.
How the Keys Are Handled
Persistent encryption is applied to the data itself rather than to a storage location or a transmission system, so a protected file stays protected across its whole life, whether it sits on a server, an endpoint, removable storage, or in the cloud.
Smartkeys are the key management layer that makes this workable at organizational scale. They take the place of passphrases and public key infrastructure, and they control access at folder or individual file level, including after a file has left the organization. Access to a given Smartkey follows encryption policy and the user’s role. Depending on how the organization configures it, users may hold several and may be able to create and share new ones. Traditional passphrases, OpenPGP, and X.509 certificates are all still supported alongside them.
The exchange itself is straightforward. When someone creates or modifies a file containing sensitive information, the endpoint agent encrypts it according to policy. That encryption travels with the file through email, cloud, FTP, or removable media. When a recipient opens it, the agent decrypts it only if that person is authorized to use the Smartkey it was encrypted with.
The Workflow Behind It
Five steps run continuously rather than as a project. Administrators define policy and apply it to users, groups, or locations. Discovery runs as files are created or modified. Classification records what a file contains and how it should be handled. Encryption keeps it from unauthorized access. Reporting gives the organization what it needs to demonstrate compliance.
Learn how to easily incorporate secure data exchange, including:
- Common obstacles to secure data exchange
- Performing secure exchange via email, cloud, and FTP
- How to provide secure information exchange with external recipients