Encryption isn't the Source of Evil, but it Does Distribute it

OK, let's talk about encryption for a minute, and why you should and shouldn't do it. Encryption is one of those buzz words that sounds really cool to implement, but so many people don't understand the effect it has on your environment. It's a lot like clustering. Too many people like the sound of that word and end up implementing a clustered solution when they didn't really define what their needs were to begin

OK, let's talk about encryption for a minute, and why you should and shouldn't do it.

Encryption is one of those buzz words that sounds really cool to implement, but so many people don't understand the effect it has on your environment. It's a lot like clustering. Too many people like the sound of that word and end up implementing a clustered solution when they didn't really define what their needs were to begin with.
Encryption suffers from this linguistic admiration as well.

Before you decide to encrypt data, you have to assess what you're going to encrypt and why. This sounds trivial, but you'd be surprised how many people miss this step, and how many just flat-out get it wrong.

For starters, if you're encrypting to fulfill an audit, then DON'T. There are none of the mainstream audits that require you to encrypt your data. They require you to protect your data, and a lot of IT guys mistake that for encryption, but the spirit of the control is to lock down access to your box. What they want to see is that people who can see the data are the ones who should be seeing it. That's about it. Don't read too much more into it. And by all means, don't encrypt your data just because you don't feel like locking down your server. Encryption is a big step to take and a project that limits user rights to the data will be much less invasive.

Basically, encryption hijacks your data and is pretty invasive. Usually what happens, is the encryption software steals your table and replaces it with a view that you use to access the data instead. That view points to the original (and renamed) table with encrypt/decrypt functions. In software solutions like DBEncrypt from AppSec Inc, the functions also check your permissions and will either present the data to you or not based on your rights. Other solutions like Ingrian (hardware-based) do basically the same thing, only they ship the data back to the appliance first usually. I think you can set it up to check it locally, but I may be confusing it with something else right now... anyway though... that part doesn't really matter. What does matter though is how invasive those solutions are. In fact, with the hardware solutions, you're completely screwed if your appliance goes down because it stores all of your encryption keys and without it, your data is lost. Just think about that before you implement something like that.