Dear Dr. Isaac Obiri,

As a cryptographer, you know that encryption itself may be vulnerable, provided key management system isn't strong enough, or a computing system used by intruders may be powerful enough to decipher the code. Yet, irrespective to a cryptographic strength of encrypted documents, they ought to be protected by a robust authorization system. Only that complex of protective measures could provide a comprehensive data security strategy to reliably protect sensitive information.

Pay attention to what you need to decrypt your data. If I do exactly the same, I will have exactly the same access to the data. We have many data encryption solutions, access to which is not secured in any way. Even the password. In many cases, we make our lives easier by automating the login process. Some encryption systems are compromised. Note that you often don't need to know the encryption key if you can force its use. In many cases, the weak point is the storage of the encryption key. Once you access and use the system, you are vulnerable as if the system were not encrypted. Including theft, modification or destruction of data. Encryption does not protect you from hardware failures in any way.

Your data can also be physically seen as you work with it. This can be done by a person nearby, but technical resources, such as cameras, can be used for this purpose.

Len Leonid Mizrah's and Pawel Kaczmazyk's answer cover most of the issues of why encryption systems alone are not enough to protect sensitive data. I would add that another way that aspect in protecting data is maintaining the proper authorizations as the roles of those accessing that data change. This is not a technical issue. For example, if someone with access to encrypted sensitive data leaves the company or changes roles within the company to a job where they no longer need access to that data, their access needs to be removed. Otherwise, a solid encryption system with good key management and robust authentication and authorization would not be enough to protect that. The main preventative measure in this case is due diligence on maintenance of roles.

Another way that data could still leak despite solid encryption, good key management, robust and well maintained authentication and authorization, is through phishing based attacks or watering hole attacks. A system administrator or other personnel with valid access might be persuade to run some malware through these techniques. In this case, all of the authorizations and encryption could be up to date, but data could still leak. This shows the need for data loss prevention as an additional control for protecting sensitive data.

Encryption is a countermeasure that addresses the confidentiality assertion of the CIA triad. Logical access to safeguard data at-rest, and in-transit, is a function of authentication and authorization controls. Organizations must adopt a defense-in-depth (DID) approach through which protection is layered-in. In the absence of a DID architecture, security posture is at risk.

Current, globally deployed cryptographic algorithms, ciphers and associated cryptographic key management systems (CKMS) are subject to compromise with the advent of quantum cryptography. Post-Quantum Cryptography (PQC) must replace old, outdated encryption technologies; otherwise, QC techniques will be used to defeat current encryption algorithms.

Encryption is a widely used technique for protecting sensitive data from unauthorized access, use, and disclosure. It works by converting the data into a coded format that is unreadable without the proper decryption key. However, it is important to understand that encryption alone is not a complete solution for data security.

First and foremost, encryption does not protect data from physical theft or loss. If a device containing encrypted data is stolen or lost, the data can still be accessed by an unauthorized person if they have the decryption key. This highlights the importance of protecting physical access to devices containing sensitive data.

Furthermore, encryption does not protect against insider threats. These are individuals who have authorized access to the data but misuse it. For example, if an employee or contractor uses their access to steal or sell confidential information, encryption will not prevent this. This highlights the importance of monitoring, user training and having a strict access control policy.

Another important point to consider is that encryption does not protect against malware or other cyber attacks that target the encryption key or the decryption process. This highlights the importance of having robust endpoint security and incident response in place to detect and respond to such attacks.

Lastly, it is important to note that encryption alone does not address compliance requirements such as data retention, archiving, and e-discovery that are required by some regulations. Therefore, encryption should be used in conjunction with other security measures such as access controls, monitoring, and incident response to provide a comprehensive security solution.

In conclusion, encryption is an important tool for protecting sensitive data, but it should not be relied on as the sole means of protection. It is essential to implement a layered security approach that includes encryption, access controls, monitoring, and incident response to ensure the integrity and confidentiality of sensitive data.

Isaac Obiri If a device with encrypted data is stolen, most likely the encryption key will be stored on that device. At this point, unauthorized access to data depends solely on how difficult it is to force the use of this key. The basic protection here is the password/code/pin used by the user. Many of these security features are vulnerable to dictionary or brute-force attacks. This does not attack the encryption key directly, but the protection of access to the key. In some cases, the encryption key is traceable in storage or intercepted on the communication bus. So encryption is an undoubted obstacle to unauthorized access to data, but we should never assume that it is perfect security.

Hello Dr Isaac Obiri

I return to you question with a very simplistic question. My employer has stated that I should use the "encrypt" function in Outlook for emails with so-called "confidential" information. Is that enough?

If the attacker has physical access to the key storage such as a smartcard or HSM, extra attention to physical protection must be given, for example tamper-resistant and/or tamper responsive techniques.

Side channel protection is also an issue, in some cases the attacker can recover the key from the power consumption or electromagnetic emanations.

Third: resistance against fault injection. By introduction of faults in the device, the attacker can retrieve the key or bypass authorization. One infamous example is RSA with CRT where one good- and one ciphertext with a fault reveals the private key.

Fourth: pay attention to the random- and prime number generation if you generate your own keys.

Encryption, while a critical component in securing sensitive data, is not a complete solution on its own for several reasons:

In summary, while encryption is a powerful tool for protecting sensitive data, it must be part of a comprehensive data security strategy that includes robust access controls, network security, physical security measures, user training, and policies to address a wide range of potential threats and vulnerabilities.