In Depth

Encryption: Achy, Breaky Code

What every CSO needs to know about encryption

By Simson Garfinkel

The primary reason you want to use encryption is to protect valuable information from being eavesdropped on over a network. The first thing to protect is passwordsyou should use encryption for your POP (point of presence) mail server, and you should replace Telnet with SSH. Intranets that require passwords should eschew "http" and instead use "https" for all URLs. Follow those basic rules, and anybody using a packet sniffer won't be able to find passwords when he examines your networksage advice for both wireless networks and wired LANs. Once you've got that working, take a look at cryptographic file systems, which let you set up a specially secured space on your hard drive. You can't stop people from stealing laptops, but you can protect the confidential information contained on them.

The most important thing to realize about encryption is that it's virtually free. Today, support for unbreakable encryption is built into practically every piece of communications software and operating system. If you are not using it, you are making a big mistake.

Other stories by Simson Garfinkel

• Email
• Print
• Comments
• Digg This
• SlashDot

• A Field Guide to Spotting Bad Cryptography
• Quantum Cryptography to the Rescue
• Bruce Schneier: The Evolution of a Cryptographer