In October 2013, Adobe was breached. It was bad — really bad. Adobe lost control of an estimated 38 million customer records, including debit and credit cards. Later, the breach was described to include 150 million usernames and passwords. I blogged about the situation and talked about the fact that there was a redeeming aspect of this data breach:

The fallout could have been much worse for Adobe if the PINs for the stolen debit cards weren’t encrypted.

It was only a few months later that Target was attacked and suffered a major data breach that was even bigger and more impactful than Adobe’s. The data breach occurred between Black Friday and Dec. 15, 2013 — the height of holiday shopping — and resulted in the loss of more than 70 million debit and credit card numbers — and CVV codes. At the time, I also commented about the Target data breach in a blog post.

Because of the data breach, Target’s financial loss is estimated to be around $148 million (minus $38 million from an insurance receivable). Target missed its numbers for the second quarter in 2014, and ultimately, its chief executive officer resigned.

More recently, Home Depot, eBay and JPMorgan have been struck by data breaches. Breaches are becoming all too common and for no good reason.

How Does Encryption Help in the Case of a Data Breach?

Although the circumstances were different in each situation, the one thing we all need to observe is that any encrypted data that was stolen as part of a breach is of no value to thieves. Specifically, the debit card PINs were encrypted (as they should be). These PINs are necessary to leverage the associated information to extract funds from an ATM, although I am certain somebody is working on a way to get around that restriction. Because the PINs were encrypted, the ability to extract money was thwarted.

Also, in the case of the Adobe breach, passwords were hashed. Though hashing is different from encryption, from a thief’s perspective, the end result of properly hashing passwords is the same as if they were encrypted. The hashed passwords are not reversible and as a result are of little value to the thief.

Data Is Like Water

Data is like water — it leaks. It wants to go places and does not like being constrained or organized. It is also of no value to anybody unless it is moving and being used. We want — and need — to use our data while simultaneously preventing others from using it. To extend the analogy, the problem is no different than if you were to own a large lake in the middle of the city and you wanted to keep all other people and animals from using it unless you give them authorization. That would be challenging to say the least.

Encryption is a well-known technology that can restrict access, and its use has readily demonstrated its ability to render data useless to those who do not possess the key. This is exemplified by the uselessness of encrypted PINs and hashed passwords to cybercriminals. This is not new science or new technology; the power of cryptography to protect data is well-known and standardized.

So Why Not Encrypt Everything?

Historically, organizations offer the following excuses for why their data is not encrypted:

• “It is too hard.”
• “I don’t get it.”
• “It is not in my department.”
• “There is a hit to performance.”
• “There is no budget.”
• “I am too busy.”
• “Give me time, and I will think of a reason.”

I make light of these reasons, but frankly, none of them hold water (pardon the pun). When Willie Sutton stole from a bank, he did not take only a couple of bills; he took as much as he could. Data thieves work on no less of a motive. As such, the financial loss due to a data breach will never be small, so we need to stop thinking small.

He Who Controls the Keys Controls the Data

Data is the new gold, and this is data’s golden rule: He who controls the keys controls the data. Naturally, the corollary to this is that if you aren’t encrypting your data or do not control your data encryption keys, then you don’t have control over your data.

Or, in other words, a fool and his data will soon part.

Whenever data is encrypted, it reduces the potential value of the data. When the value is reduced, the likelihood of a thief taking the data is diminished; that is called risk mitigation. I know that encrypting data has potential challenges with implementation, but we must not let those challenges stop us from protecting our gold, data, earnings or careers.

$148 Million Is a Lot of Money

It would seem that $38 million is a reasonable insurance policy, but it was not sufficient to cover the losses incurred by Target after its data breach. Target could have potentially reduced its losses by 90 percent or more by spending 10 percent of the potential loss on mitigation strategies such as improved encryption of data in transition and data at rest with supporting encryption key management.

In the coming weeks and months, we will begin to learn about the losses incurred by JPMorgan as a result of its data breach. I will be curious to learn about how much they spent to migrate its losses as compared to the amount of money it lost.

How much is your data worth? Have you asked yourself how much you are spending to protect your data in comparison to the loss you could experience in the case of a data breach? You should.

Cryptography for business is about using well-known encryption technologies and applying them to real business problems. Staggering financial losses, chief executive officer resignations and repetitive data breaches are not technical anomalies; they are business problems that are the result of lackluster quality in operational and technical controls. Mitigating data breaches through the use of encryption and key management may not address all the issues and details of these breaches, but it is definitely a step in the right direction.