Encryption may be good for securing data, but it blinds network-based IDSes. While there aren't any surefire fixes, these techniques will steer you in the right direction.

Encryption used to be unequivocally good for security. After all, it kept the bad guys from getting at our private information, right? Who could argue with that? Many of us became crypto-evangelists, demanding encryption everywhere.

Then we realized that we were blocking our view with all this encryption.

Administrators need to be able to look at the entire network to properly defend it. IDSes, IPSes, sniffer tools and network analyzers provide a clear view of network activity. But, the more prevalent encryption becomes, the more we lose that view.

So is encryption bad for security...

The pressure is on for enterprises to implement encryp- tion as a standard of due care--HIPAA mandates privacy for health care transactions, and California's SB 1386 requires the disclosure of security breaches of unencrypted personal information. In the private sector, the Payment Card Industry (PCI) security standard includes rules regarding data encryption for credit card transactions.

How can an enterprise protect itself from the bad guys, meet regulatory requirements and have an effective IDS/ IPS solution? While there are no clear-cut answers, we'll explore some of the ways you can keep a clear look out for hazards on the horizon.

< PREV PAGE   |   1  |   2  |   3  |   4  |   NEXT PAGE  >