What Marketers Need to Know About Encryption

Marketing managers are being forced to consider new ways to protect marketing information. Today, the manager faces internal and external compliance regulations in addition to balancing a budget, making the numbers and managing workloads with less people. If that wasn’t enough, most now are the “owners” of customer databases and e-commerce data they are to protect against criminal assaults.The increasing number of criminal attacks on consumer and employee databases have wrought a high price and much mistrust with regard to individual privacy and trust. One only has to open the papers today to see yet another consumer database has been compromised. Security experts indicate the growing amount of personal data, including credit card numbers, stored by large companies’ databases continues to make corporations a target of ever-more advanced and increasingly quiet attackers. Databases are a critical component of today’s business systems, and data integrity and security are paramount concerns for managers responsible for those databases. The task of safeguarding data assets is multifaceted, but two central aspects are ensuring that: data is changed only in intended ways, and only the proper parties view the data.Implementing suitable privacy, security policies and encryption is an important step, but it does not address three important realities:1. Authorized users will sometimes access data inappropriately, whether deliberately or accidentally.2. Policy flaws and implementation can introduce vulnerability, enabling unintended data access or database changes.3. Uncontrolled passwords that are carelessly managed, stored or casually given to colleagues, vendors and even customers can ultimately compromise security.Enter EncryptionTo combat the threat from fraud and hackers, most major organizations use some form of digital encryption to protect sensitive data during transmission and in storage. If you don’t understand encryption, it is the process of transforming a message into ciphertext, a character string that appears random and meaningless. You can read an encrypted message only if you can unscramble, or decrypt, the ciphertext to expose the original message. Math is the key to a good cryptographic system; mathematical algorithms that perform encryption are called ciphers and have keys to unlock or decrypt the message.To implement encryption in most organizations, the corporate IT department is enlisted. But too often, security is viewed as the sole domain of some really smart IT guys in the back room. In reality, it is the responsibility of the entire organization. Getting a handle on the various needs, priorities and technical requirements must involve more than the IT experts and security specialists. Marketing managers must provide input on a continuing basis. Elaborate security tools, encryption and well-conceived business processes are only parts of the equation and must be understood by the marketing manager.Understanding EncryptionWhat does the marketing manager need to know about encryption so he can communicate with the IT department? It is important to understand what encryption does to protect the data. Encryption is the process of converting a plaintext message into a secure-coded form of ciphertext. There are two types of encryption: 1) non-shared on the individual’s desktop and available only to that user and 2) shared data with others.In the “shared data with other” category, there are two keys (PKI framework) necessary to encrypt and decrypt the message. These keys are shared among the sender and the receiver. There must be a mediator who validates and ensures confidentiality, assuring that both the sender and receiver are authorized. Not all encryption formats can be used universally; that is, shared with all the contacts the marketing department has. The IT department will be able to offer some encryption tools compatible with the enterprise legacy systems. The marketing manager will need to find out if vendors or partners have the same encryption platforms.For smaller companies without a standard platform, there are some alternatives for the organization. The following are just some of the companies that provide secure portals and encryption: PGP (www.pgp.com), CipherPass (www.cipherpass.com) and Verisign (www.versign.com).When encryption is used, industry standard-approved algorithms and customary implementations can be used. Encryption strength should always be commensurate with the sensitivity of the data it is protecting because encryption takes added room for storage. The owners of data protected by encryption will assign responsibility for the encryption key management to be used to protect this data to a trusted internal source. Encryption keys are proprietary information, and access to such keys should be strictly limited to those who have a need to know.It Takes a VillageData protection has moved up the list of critical concerns for marketing managers, leaving many businesses struggling to balance their requirements to keep business-critical information safe with the cost and complexity of deploying and running many existing encryption solutions. Encryption takes many people to help manage and protect the valuable data—thus, a community or village effort. The IT staff cannot do it alone.Robert McKim, CISA, CIPP, is managing partner of MRE Enterprises in Los Angeles, Calif. He can be reached at rmckim@mre-ent.com.

General

What Marketers Need to Know About Encryption

Bob Mckim

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Bob Mckim