There are many conflicting ideas about how much key rotation is necessary, how far it should go, and how often it should be done. These issues cause trepidation and worry for many IT managers. But the good news is it's time to stop worrying about key rotation. It's easier than you think. Modern approaches to key rotation and a better understanding of security threat models make it easier to establish a good balance between practicalities while maintaining good security principles.

In the past, key rotation was largely perceived as a security measure to defend against potential brute force attacks on cipher text. Because computer power increases over time, even if an attacker doesn't have the means to brute force a key today, it could be possible to do so in the future, so organizations periodically re-encrypted data with stronger keys.

However, a modern take on risk management finds that re-encrypting archived data is often riskier than leaving it alone. A backup tape, the argument goes, is probably safer in a secured archived location with the original encryption, because the process of retrieving it for re-encryption introduces an opportunity for misplacement. Because of this, many IT managers are taking more of a risk-based approach to key rotation, instead of doing rotation purely for the theoretical additional levels of security it provides.

Key rotation is valuable but it should be done strategically so organizations apply efforts in the right areas instead of applying the same policies unilaterally. Done properly, key rotation can, after all, improve security.

Another benefit is risk mitigation. Periodically changing keys reduces the potential data loss if the key is lost or compromised. The frequency of key rotations varies considerably depending on a number of variables, such as the type of key, the operating environment, the amount of data encrypted, the classification of the data, and the application that uses the key.