The Case for a Cryptographic Centre of Excellence in Every Enterprise

Over the past year, companies around the world moved quickly to digitalise and shifted to the cloud faster than planned so that staff could work remotely and without contact. More than a year into the pandemic and the switch to remote work, Kieran Hernon, Vice President for Digital Identity at Entrust for APAC and EMEA, argues that organisations now need to refine their digital security to close the gaps that the new technology has opened up.

Encryption adoption lags in Southeast Asia

Hernon sees cryptography as a central pillar of that effort. As data spreads across devices and systems, it helps organisations protect customers and employees, financial records and intellectual property. Enterprise-wide encryption strategies have become more common over the past decade, yet global adoption stands at only 50%, according to Entrust's Global Encryption Trends Study. The same report puts Southeast Asia (SEA) at 36%, below the global figure, which Hernon reads as a chance for organisations in the region to overtake the global index by adopting advanced cryptography practices.

A breach in SEA costs an organisation US$2.71 million on average, according to IBM, which in his view shows plainly what the lack of crypto-grade encryption exposes companies to. Bringing new technology into an enterprise has always taken nerve, especially when it could fundamentally change how the organisation delivers its services. Even so, Hernon counts encryption and cryptography among the most important tools businesses in the region can adopt to protect valuable data.

What a CryptoCoE does

New technology often struggles to take hold when teams do not see clearly how it delivers immediate strategic value to the business. For encryption, Hernon says, a well-defined cryptographic centre of excellence (CryptoCoE) can close that gap. He describes it as a capability centre that strengthens operational cryptography with proven tools and expertise, offering useful insight and best practice while the organisation adopts cryptography.

Gartner holds that centres of excellence help businesses focus their existing resources and expertise on a particular capability so that they reach and maintain world-class performance and value. For companies starting out with encryption, Hernon says, bringing experts and resources together in a CryptoCoE helps keep every cryptographic deployment matched to current threats and in line with the latest standards and regulations.

From reacting to crypto agility

Technology keeps changing and attackers change with it, so Hernon warns that no organisation can afford to be complacent about protecting its data. However secure data may be now, it will eventually be breached unless the enterprise treats security strategy as an iterative process that develops along with its environment and its business needs.

As threats become more sophisticated, organisations need mature cryptography management, including an agile response plan that can adapt to new regulations, new threats and internal change. According to Hernon, a CryptoCoE moves a company from reacting to events towards crypto agility, by setting up and running a comprehensive crypto management strategy and by providing training and resources across the company for teams less familiar with the technology.

The result, he says, is that crypto tactics can be adjusted quickly without major changes to the underlying crypto infrastructure. That helps during threats and breaches, and equally when compliance or internal governance requirements shift. With a CryptoCoE, moving to the latest encryption requirements can happen smoothly and fast, with no sensitive information exposed anywhere along the chain of trust.

Weighing cost against unknown risk

Hernon acknowledges that a CryptoCoE can look like one more project and one more expense, and that proving a return on investment (ROI) for such a team is difficult. It can be almost impossible to put a figure on unknown risks and the role security plays in containing them. Beyond revenue lost to a breach or to downtime, organisations can only guess at the harm to their reputation. And since breaches now happen almost daily, companies can no longer live by the rule of not fixing what is not broken. In his view, those that do are the ones left behind when disruptions such as COVID-19 or other major breaches hit.

Making crypto strategy a priority, he concludes, lets businesses mitigate threats and keep running with little interruption. Done well, a CryptoCoE justifies its effort and cost by protecting business continuity, improving data security and, above all, reinforcing consumer trust.