Automatic Encryption System Debuts

The problem with file encryption is that users forget to use it. A new server-based system from Applied Security claims to remove that obstacle by handing the decision to encrypt data back to anxious administrators.

The company's newly-launched fideAS file enterprise software can be used to encrypt data in files or folders on PCs, laptops, or even servers. Integrating with a Microsoft Active Directory for easy management, the innovation is that none of this involves the user of that device making any decision for or against using such a security system. It is done transparently according to policies on which data needs to be secured.

The key distribution element -- always a tricky issue -- can be given to users on smartcards or as tokens on plain USB drives. For added security, the role of the system admin and the security admin is separated, ensuring that no one individual has total access to the keys in a way that could be used to undermine the system.

The software has a few other tricks up its sleeve that might prove useful. It can enforce a degree of endpoint control, for instance, stopping unauthorized hard disks or USB sticks from being plugged in to remove unencrypted data, and the automatic encryption of email attachments.

A separate free add-on tool for PCs, fideAS file safe, can be used for straight desktop encryption up to AES-256 level, including that of outgoing email attachments.

The company's pitch to potential customers will be the same as every other company trying to scramble on the back of new interest in encryption as a primary security defense.

"Recent high profile date loss incidents from the HMRC and Royal Navy to TKMaxx, and Marks and Spencer, could all have been avoided if files had been encrypted," claimed Applied Security's CEO, Frank Schlottke.

"fideAS file enterprise has been designed to combine a high level of cryptographic security with maximum user friendliness, so that encryption does not slow down or get in the way of day-to-day work activity," he said.

Equally, saying that encryption could have stemmed the flow of recent security incompetence, and actually putting it into practice are two different things. Encryption has been around since the beginning of the computer age and the fact it hasn't taken off only is only partly to do with complacency. Management can turn into a chore -- an expensive one.

One potential benefit of Applied Security's approach to encryption is that it can secure 'feral' clients such as laptops, which are typically away from the safety of the network most of the time, without having to get into the major headaches associated with full disk encryption (FDE) systems.