Applicability of Encryption

 

Data at rest. This includes any data located on company-owned or company-provided systems, devices, media, etc. Examples of encryption options for data at rest include:

• Whole disk encryption

• Encryption of partitions/files

• Encryption of disk drives

• Encryption of personal storage media/USB drives

• Encryption of backups

• Encryption of data generated by applications

 

Data in transit. This includes any data sent across the company network, or any data sent to or from a company-owned or company-provided system. Types of transmitted data that can be encrypted include:

• VPN traffic

• Remote access sessions

• Web applications

• Email and email attachments

• Remote desktop access

• Communications with applications/databases

​

Examples of encryption for data in transit include:

• VPN tunnels

• Industry standard protocols such as TLS and SSL

 

Encryption Key Management

Encryption key management is critical to the success of an implementation of encryption technology. An encryption key is a digital password or certificate used to encrypt and decrypt data.

 

The following guidelines apply to the company's encryption keys and key management:

• Keys are confidential data

• Management of keys must ensure that data is available for decryption when needed

• Keys must be securely documented

• Keys must never be transmitted in clear text

• Keys must never be shared

• Keys must not be stored on the same media as the encrypted information

• Physical key generation materials must be destroyed immediately upon generation

• Keys must be used and changed in accordance with the password policy

• When user encryption is employed, minimum key length is 10 characters

• The company must perform background checks on the persons in charge of encryption keys

• For more secure storage the company should consider keys known in half by two people

 

Acceptable Encryption Algorithms

Only the strongest types of generally-accepted, non-proprietary encryption algorithms are allowed, such as AES or 3DES. Acceptable algorithms should be reevaluated as encryption technology changes.

​

Use of proprietary encryption is specifically forbidden since it has not been subjected to public inspection and its security cannot be assured.

 

Legal Use

Some governments have regulations applying to the use and import/export of encryption technology. The company must conform with encryption regulations of the local or applicable government.

​

The company specifically forbids the use of encryption to hide illegal, immoral, or unethical acts. Anyone doing so is in violation of this policy and will face immediate consequences per the Enforcement section of this document.

 

Applicability of Other Policies

This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.