In Part 1 of this blog, I described Trends 1 – 5 in encryption, certificates and key management. Trends 6 – 10 are listed below:
6. User Transparency – organizations are recognizing that expecting users to enter complex passwords and go through multiple stages of authentication can be counter-productive. There is a trend towards making the use of certificates and keys transparent to the user. An example of this approach is Microsoft DirectAccess which automatically connects a Windows 7 laptop to a central infrastructure using IPSec with both machine and user certificate authentication
7. File and Folder Encryption – there is an increasing interest in encrypting files and folders at the application layer instead of, or as well as, at the network layer or on a drive volume basis. This can extend to Digital Rights Management solutions in which only certain individuals are authorized to view a file
8. Self Encrypting Drives – laptop hard drives can be ordered with a self encrypting option, so that there is no requirement for software based encryption such as Microsoft Bitlocker. This is inherently a robust approach as the encryption key is stored within hardware, all data is encrypted, and decryption takes place on the drive, without using laptop processor or memory, resulting in high performance
9. Certificate and Key Management – SSL server certificates are increasingly used not only for applications such as Internet banking and credit card payments, but also for a wide range of back end server to server communications. All certificates have an expiry date, and when a certificate expires, the service fails. There are now tools available to introduce workflow and automate the process of certificate renewal. Similar tools can be used for management of SSH keys
10. Hardware Security Modules (HSMs) for Certificate Authority servers – most new implementations of Certificate Authority servers now use virtual machines, however it is important to protect the private keys of the Certificate Authority itself as this is a fundamental point of trust. This can be done by means of a network based HSM to which the virtual certificate authority servers communicate
