NIST 140-2 Encryption Integration Service

ENCRYPTION INTEGRATION OBJECTIVES

One of the initial steps one should pursue is to determine whether it is better to integrate an encryption process directly within the application system, or to implement encryption as an add-on tool.

The overall objective in implementing encryption is to of course assure that sensitive data is not accessible to those that are not authorized to access it, while making its use as transparent as possible to system users. Encryption Integration directly within the applications can provide not only a common look and feel but improve usability by providing consolidated sign-on and other specifically managed application processes.   This method will almost always be more costly than implementing encryption as an add-on tool.  There may however be sufficient ROI to justify inclusion. Some factors to consider:

• Maturity of your systems development processes
• Maturity of the security practices within you organization
• Ease of use and consequent retraining issues.  How readily is new curriculum distributed with your organization?
• Is this new systems development or are you retrofitting encryption within and existing application?
• How well versed are your Quality assurance processes with security issues.  Will they be able to assess vulnerabilities in a integrated solution?
• Degree of isolation and "need to know" may be more readily enforced with customized application managed rules.

.These and other questions should be evaluated in to determine which is the most effective course for your organization.