In October 2013, Adobe was breached. It was bad — really bad. Adobe lost control of an estimated 38 million customer records, including debit and credit cards. Later, the breach was described to include 150 million usernames and passwords. I blogged about the situation and talked about the fact that there was a redeeming aspect of this data breach:

The fallout could have been much worse for Adobe if the PINs for the stolen debit cards weren’t encrypted.

It was only a few months later that Target was attacked and suffered a major data breach that was even bigger and more impactful than Adobe’s. The data breach occurred between Black Friday and Dec. 15, 2013 — the height of holiday shopping — and resulted in the loss of more than 70 million debit and credit card numbers — and CVV codes. At the time, I also commented about the Target data breach in a blog post.

Because of the data breach, Target’s financial loss is estimated to be around $148 million (minus $38 million from an insurance receivable). Target missed its numbers for the second quarter in 2014, and ultimately, its chief executive officer resigned.

More recently, Home Depot, eBay and JPMorgan have been struck by data breaches. Breaches are becoming all too common and for no good reason.

How Does Encryption Help in the Case of a Data Breach?

Although the circumstances were different in each situation, the one thing we all need to observe is that any encrypted data that was stolen as part of a breach is of no value to thieves. Specifically, the debit card PINs were encrypted (as they should be). These PINs are necessary to leverage the associated information to extract funds from an ATM, although I am certain somebody is working on a way to get around that restriction. Because the PINs were encrypted, the ability to extract money was thwarted.

Also, in the case of the Adobe breach, passwords were hashed. Though hashing is different from encryption, from a thief’s perspective, the end result of properly hashing passwords is the same as if they were encrypted. The hashed passwords are not reversible and as a result are of little value to the thief.

Data Is Like Water

Data is like water — it leaks. It wants to go places and does not like being constrained or organized. It is also of no value to anybody unless it is moving and being used. We want — and need — to use our data while simultaneously preventing others from using it. To extend the analogy, the problem is no different than if you were to own a large lake in the middle of the city and you wanted to keep all other people and animals from using it unless you give them authorization. That would be challenging to say the least.

Encryption is a well-known technology that can restrict access, and its use has readily demonstrated its ability to render data useless to those who do not possess the key. This is exemplified by the uselessness of encrypted PINs and hashed passwords to cybercriminals. This is not new science or new technology; the power of cryptography to protect data is well-known and standardized.

So Why Not Encrypt Everything?

Historically, organizations offer the following excuses for why their data is not encrypted:

  • “It is too hard.”
  • “I don’t get it.”
  • “It is not in my department.”
  • “There is a hit to performance.”
  • “There is no budget.”
  • “I am too busy.”
  • “Give me time, and I will think of a reason.”

I make light of these reasons, but frankly, none of them hold water (pardon the pun). When Willie Sutton stole from a bank, he did not take only a couple of bills; he took as much as he could. Data thieves work on no less of a motive. As such, the financial loss due to a data breach will never be small, so we need to stop thinking small.

He Who Controls the Keys Controls the Data

Data is the new gold, and this is data’s golden rule: He who controls the keys controls the data. Naturally, the corollary to this is that if you aren’t encrypting your data or do not control your data encryption keys, then you don’t have control over your data.

Or, in other words, a fool and his data will soon part.

Whenever data is encrypted, it reduces the potential value of the data. When the value is reduced, the likelihood of a thief taking the data is diminished; that is called risk mitigation. I know that encrypting data has potential challenges with implementation, but we must not let those challenges stop us from protecting our gold, data, earnings or careers.

$148 Million Is a Lot of Money

It would seem that $38 million is a reasonable insurance policy, but it was not sufficient to cover the losses incurred by Target after its data breach. Target could have potentially reduced its losses by 90 percent or more by spending 10 percent of the potential loss on mitigation strategies such as improved encryption of data in transition and data at rest with supporting encryption key management.

In the coming weeks and months, we will begin to learn about the losses incurred by JPMorgan as a result of its data breach. I will be curious to learn about how much they spent to migrate its losses as compared to the amount of money it lost.

How much is your data worth? Have you asked yourself how much you are spending to protect your data in comparison to the loss you could experience in the case of a data breach? You should.

Cryptography for business is about using well-known encryption technologies and applying them to real business problems. Staggering financial losses, chief executive officer resignations and repetitive data breaches are not technical anomalies; they are business problems that are the result of lackluster quality in operational and technical controls. Mitigating data breaches through the use of encryption and key management may not address all the issues and details of these breaches, but it is definitely a step in the right direction.

More from Banking & Finance

How to Spot a Nefarious Cryptocurrency Platform

Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…