Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Review: Enterprise Key Management Software: Page 2 of 9

As a rule, key management has been integrated as a part of each encryption platform, and in the absence of industrywide guidelines, each vendor has developed its own methodology for operation of its key systems. As of 2007, there are draft standards before the Internet Engineering Task Force and the National Institute of Standards and Technology designed to standardize protocols for key generation and transfer across multiple platforms, but until vendors come to an agreement, it will continue to be a challenge for companies to obtain a global key-management solution that encompasses all types of encryption systems.

The gold standard for high-security key management today comes directly from NIST. Federal Information Processing Standard (FIPS) 140-2 establishes specific rules for the generation, security, encryption, storage, recovery and auditing of passwords. It also proscribes four security levels for the physical protection of password control systems, with Level 3 being the highest level required for most corporate applications. FIPS 140-2 Level 3 includes requirements for identity-based authentication, internal encryption, physical separation of secure/nonsecure ports and strong protections against physical tampering. Although FIPS 140-2 clearly establishes the security requirements of key systems, it doesn't specifically dictate how those requirements are accomplished, leaving the details up to individual vendors. In response, several encryption companies have recognized the need for key-management systems that can provide:

» Automated and randomly generated encryption keys;

» Full encryption of stored and transmitted keys;

» Key usage policies, including destruction and media associations;