Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analysis: Enterprise Key Management: Page 5 of 16

Key-handling requirements in PCI DSS are extensive as well: Key custodians and locations must be limited. All key-management processes must be documented and include generating strong keys as well as securely storing, transmitting, destroying, aging and revoking keys.

Why is it, then, that most stats we've seen on encryption don't seem to mesh with the number of organizations that handle credit-card transactions? Is the amount of encryption being under-reported? Our guess: Security pros are running into the biggest problem with the encryption market: too many solutions, too few standards.

Showstoppers

At this year's RSA conference, it was obvious that encryption is a growth industry. Of the 381 vendors exhibiting, one in five focused on data encryption or key management. That's a high percentage given the sheer number of categories represented. We saw companies exhibiting encryption for data at rest on tapes and hard drives, for data in motion with all flavors of VPNs, and for automatic transparent encryption as data travels through the network. Even the keynote from Microsoft's Bill Gates and Craig Mundie highlighted how IPsec can encrypt data automatically as it travels among network devices.

Let's look for a moment at how all these solutions work together--or don't, as the case may be.