Research

What Security Professionals Think about Encryption

In this, our first report from Dr. Larry Ponemon and the Ponemon Institute, results from a study show security professionals know what's good for them but don't embrace it.

By Larry Ponemon

Types of data encrypted:

• The most important types of data that should be encrypted for storage and/or transmission are: business confidential documents (57 percent), records containing intellectual property (56 percent), only sensitive customer information (56 percent), accounting and financial information (41 percent) and employee information (35 percent). Interesting to note that customer and consumer information scored a low 8 percent and 6 percent, respectively.
• The top five types of personal information about a customer, consumer or employee that should be encrypted are health information (72 percent), sexual orientation (69 percent), Social Security number (67 percent), family members (66 percent) and work history (57 percent).
• The bottom five types of personal information about a customer, consumer or employee that should be encrypted are: e-mail addresses (10 percent), home location and telephone (6 percent), educational background (5 percent), interests and preferences (2 percent) and gender (1 percent).

Encryption Increases Confidence in Security

We found that information security and privacy professionals have the most confidence in their organization's security program when it uses encryption as part of an enterprisewide implementation plan.

To arrive at this finding, we asked respondents, "How confident are you that your organization's security program is sufficient to protect or safeguard sensitive and confidential information?" The item is scored using a numeric adjective scale where respondents placed an X mark on a line ranging from range: 0 = no confidence to 1 = significant confidence.

Figure 1 shows the subjects' overall percentage responses to this question.

As shown in Figure 1, the distribution peaks between .5 to .6 on the confidence scale. The grand mean for all 735 subjects is .561.

Table 1 provides the frequency of subjects according to how their organizations implement encryption technologies. As noted, only 31 respondents report that their companies have an encryption plan that is applied consistently across the enterprise. In contrast, 348 respondents state that their companies do not use encryption. According to 178 respondents, while they use encryption their companies do not have an implementation plan.

Table 1 also computes average confidence levels to each one of five encryption implementation categories. As shown, the highest confidence level (.82) is achieved for the group of respondents who report that their companies deploy encryption and have an enterprise implementation plan. The lowest confidence level (.51) occurs for respondents who report that their companies do not use encryption.

Figure 1 shows the distribution (percentage frequencies) of confidence ratings for two groups in Table 1—namely, subjects who deploy encryption and have an enterprise implementation plan (n=31) and subjects whose organizations do not use encryption (n=348). As suggested from individual responses, companies using encryption as part of an enterprise implementation plan appear to enjoy more confidence about their company's security program that those who do not use encryption.

• Email
• Print
• Comments
• Digg This
• SlashDot