There are many conflicting ideas about how much key rotation is necessary, how far it should go, and how often it should be done. These issues cause trepidation and worry for many IT managers. But the good news is it's time to stop worrying about key rotation. It's easier than you think. Modern approaches to key rotation and a better understanding of security threat models make it easier to establish a good balance between practicalities while maintaining good security principles.
In the past, key rotation was largely perceived as a security measure to defend against potential brute force attacks on cipher text. Because computer power increases over time, even if an attacker doesn't have the means to brute force a key today, it could be possible to do so in the future, so organizations periodically re-encrypted data with stronger keys.
However, a modern take on risk management finds that re-encrypting archived data is often riskier than leaving it alone. A backup tape, the argument goes, is probably safer in a secured archived location with the original encryption, because the process of retrieving it for re-encryption introduces an opportunity for misplacement. Because of this, many IT managers are taking more of a risk-based approach to key rotation, instead of doing rotation purely for the theoretical additional levels of security it provides.
Key rotation is valuable but it should be done strategically so organizations apply efforts in the right areas instead of applying the same policies unilaterally. Done properly, key rotation can, after all, improve security.
Another benefit is risk mitigation. Periodically changing keys reduces the potential data loss if the key is lost or compromised. The frequency of key rotations varies considerably depending on a number of variables, such as the type of key, the operating environment, the amount of data encrypted, the classification of the data, and the application that uses the key.
Compliance laws are also driving companies to reevaluate their key rotation policies because encryption is a focal point for industry and privacy mandates. But it is critical to outline a strategic approach to key rotation issues and tools ahead of time. The National Institute of Standards and Technology provides definitions of appropriate key lengths and provides guidelines for how long keys should be used. And the PCI Data Security Standard is one example of a compliance initiative with requirements for encryption key rotations. In fact, for some companies there are multiple compliance initiatives that need to be supported simultaneously, which adds to the complexity and frequency of key changes.
The real source of pain for IT managers is the considerable time and effort that each key rotation takes, especially when dealing with poorly designed key management tools or even home-grown systems. Multiply the number of policies that need to be enforced and it becomes a harrowing exercise with considerable cost and resource utilization.
Many companies find that encrypting data is easy. Maintaining the keys is the hard part and is often the area overlooked when encryption projects start. What's worse, the pain associated with key rotation often grows over time because there may be multiple key repositories, too many keys to manage, and too few resources to handle the rotation manually.
The amount of manual effort involved in handling keys is attributed to the quality of the management tools and how they deal with basic services such as provisioning, key storage and workflow. In the end, homegrown efforts to satisfy these requirements tend to be inflexible, operationally costly and brittle, and cannot address the changing encryption landscape as new needs emerge.
The way to address these issues, both for existing key rotation problems and to prevent new ones from occurring, is to establish a solid enterprise key management infrastructure.
Enterprise key management provides three primary ways to address key rotation challenges. First, it provides visibility into the state of encryption keys across multiple key repositories. This is important because it eliminates the problem of having too many encryption key silos with no top level view of which keys need to be rotated. Taking measure of the problem is the first step towards finding a resolution to the pain.
Second, enterprise key management provides the tools to automate the process for key rotation, so whether performing one key rotation or a hundred, it is the same relative amount of effort. With automation, security-conscious industries such as financial services can rotate keys daily for sensitive systems that support things such as electronic payments and point-of-sale devices. Automation tools should also include workflow to ensure that internal procedures and processes are honored along the way.
Third, enterprise key management ensures that all key material throughout the IT environment stays safe and within the expected operating parameters. This includes enforcement of security policy, which ensures keys meet corporate guidelines for the key properties (length, type, time to live and so on) as well as for related services (how long to archive the key, recovery policies and so on).
It's time for CISOs and risk managers to put aside the philosophical debates about key rotation and get back to their pleasant dinner conversations.
Tokuyoshi is product marketing manager at PGP Corp.