WinZip Blog

In today’s increasingly distributed workplaces, the need for data protection is at an all-time high. As of February 2022, 42% of remote-capable employees have a hybrid schedule that combines working from home and being in the office. An additional 39% work exclusively off-site.

This shift to remote and hybrid work environments increases the risk of vulnerable data exposure. The use of multiple devices and unsecured networks to access and share data creates new avenues for cyberattacks via unauthorized access.

There are a number of processes available to protect and secure your data. Two of the most common techniques are data masking and data encryption. In this article, we will explore what data masking is, how it differs from encryption, and how they work together for improved cybersecurity.

What is Data Masking?

Making something appear different than its actual form is known as obfuscation. Data obfuscation or data masking protects sensitive elements in a database or across multiple databases, such as:

• Personally identifiable information (PII)
• Payment card and other financial information
• Intellectual property
• Protected heath information (PHI)
• Commercially sensitive information

To ensure data privacy, data masking replaces real data with modified values, such as characters or numbers. For example, replacing customer names with a standard value (e.g., ‘John Doe,’ ‘Jane Doe’) preserves the original data format while protecting the real names from unauthorized identification.

By masking sensitive information, you are able to retain and share the data across systems and databases while minimizing security risks. There are two main forms of data masking: static and dynamic.

Static data masking protects sensitive data when it is moved from the production environment for the purpose of research, troubleshooting, analytics, and reporting. The masked data is duplicated into a separate database, or external environment, where it can be shared with both internal and external stakeholders. This is a one-way, irreversible process that enables testing, training, and development without compromising the original data.

Dynamic data masking, by comparison, masks data in real-time production environments. It does not require a secondary database to hold the masked data. Instead, dynamic masking occurs in real-time in response to user requests. Authorized users are able to view the original, unaltered data, and unauthorized users see masked data values.

How is Data Masking Different Than Data Encryption?

Data encryption and data masking are distinct methods of data protection. They are designed to solve different problems related to data security.

Encryption uses sophisticated algorithms to encode the original data into an unreadable ciphertext. It is widely used to protect sensitive data against external threats, such as hackers and other cybercriminals. Data encryption is most useful when you do not require real-time data usability, making it well-suited to protect data at rest or in transit.

Data masking is especially useful for data in use, which is data that is being directly accessed by one or more users. For example, teams often need to access data for work in non-production environments, such as quality assurance, development, and testing. Masking renders realistic values that maintain the data integrity needed for such processes without exposing sensitive information. This safeguards data from internal threats, including both malicious and unintentional errors.

Unlike encryption, data masking is irreversible. Once sensitive data is masked, there is no way to transform it back to its original state. As long as you have the correct decryption key, encryption is reversible and the ciphertext can be restored back to its original state. However, data encryption also introduces risk in the event that the encryption key is lost, deleted, or compromised by unauthorized users.

How Data Masking and Data Encryption Work Together

Encryption and masking are effective methods of guarding against unauthorized access and improper use of sensitive data. Encryption is commonly employed to protect data at rest and in transit. If the network or system is compromised or data transfer is intercepted, encryption renders the data useless to the unauthorized user.

Data masking is more appropriate for data in use. This is because masking hides data from unauthorized users without impacting its usability. As data circulates or is accessed in non-production environments, it is desensitized and protected against internal and external threats.

Highly regulated industries often use a combination of masking and encryption to comply with various data privacy laws. Health Insurance Portability and Accountability Act (HIPAA).

Any organization that handles or processes protected health information (PHI) is subject to HIPAA rules. Data at rest or in transit is addressed in the HIPAA Security Rule, which identifies safeguards for data protection.

According to the Department of Health and Human Services (HHS), encryption reduces the risk of unauthorized exposure or theft of PHI. Title 45 of the Code of Federal Regulations (CFR), Section 164.312, states that covered entities and business associates must “implement a mechanism to encrypt and decrypt electronic protected health information.”

HIPAA rules also seek to preserve the privacy of individually identifiable health information (IIHI). This is information that can be linked to a specific person, so the use and disclosure of IIHI has restrictions to protect the individual’s privacy.

Data masking enables HIPAA covered entities to use and share health data without violating privacy rules. According to 45 CFR Section 164.514, there are 18 identifiers that must be masked within a data set before it can be shared. Under HIPAA, these identifiers include but are not limited to the following:

• Names
• Social Security numbers
• Telephone numbers
• Medical record numbers
• Biometric identifiers (e.g., fingerprints, voice)
• Full-face photos
• Certificate or license numbers
• Device identifiers and serial numbers

Once PHI is masked, it can be freely shared for uses such as medical studies and assessments.

Payment Card Industry Data Security Standard (PCI DSS)

The storage, processing, and transmitting of cardholder data is regulated by PCI DSS security standards. While these standards are not set forth by governmental legislative bodies, compliance violations can result in financial penalties based on the discretion of the Payment Card Industry Security Standards Council (PCI SSC).

PCI DSS Requirement 3 provides guidance on protecting cardholder data. Cardholder data consists of the following:

• The cardholder’s name, card expiration date, and card service code.

• The Primary Account Number (PAN), which is the card number displayed on the front of the card.

• Sensitive Authentication Data (SAD), including the magnetic track data, PIN or PIN block, and card verification value (CVV).

If the data is encrypted, you are allowed to store a cardholder’s name, the PAN, and the card’s expiration date and service code. However, you are not permitted to store SAD information, even if that data is encrypted.

Encryption protects PCI DSS data when it is stored or in transit, while masking preserves confidentiality when sharing or displaying data. This is especially important when it comes to PAN data, which is often targeted because malicious actors can use it to impersonate or steal the cardholder’s identity. Masking requirements for PAN display applies to all display mediums, including computer screens, receipts, reports, and faxes.

General Data Protection Regulation (GDPR)

Organizations subject to the GDPR must meet two comprehensive compliance categories: data protection and data privacy. Data protection safeguards against unauthorized access, while data privacy addresses how data is used and for what purposes.

According to GDPR, a crucial aspect of data privacy is the use of data encryption. To protect consumer data and reduce the risks associated with storage and transfer, the GDPR’s Recital 83 specifically recommends “using techniques such as encryption.”

Data masking can be used to satisfy the GDPR’s mandate that organizations implement data minimization. By removing any real identifiers, organizations can use customer data for analytics, testing, and other support processes while preserving the anonymity of personal information.

The GDPR refers to the data masking process as pseudonymization, which is referenced throughout its Articles and Recitals:

• Article 6(4) identifies pseudonymization and encryption as appropriate safeguards for processing data for a purpose other than for which it was collected.

• Article 25 cites pseudonymization as an appropriate technical and organizational measure to meet GDPR requirements.

• Article 32 requires secure processing techniques, including the pseudonymization and encryption of personal data.

• Article 89 lists data minimization and pseudonymization as appropriate protections for processing data for archiving purposes.

Protect Sensitive Data with Masking and Encryption

Whenever you collect, store, or transfer sensitive data, you must take appropriate steps to keep it secure. Using a combination of data masking and encryption ensures that you have end-to-end protection to secure data at rest, in transit, and in use.

To protect crucial data with simplified file encryption, organizations look to solutions such as WinZip® Enterprise. With powerful AES encryption that complies with Federal Information Processing Standards (FIPS), your sensitive information is protected at rest and in transit.

Pairing WinZip Enterprise with leading data masking tools makes for comprehensive data security. WinZip Enterprise is fully customizable, giving IT administrators granular control over encryption standards, password policies, backup schedules, and more.

Discover how WinZip Enterprise’s data encryption can work within your organization’s overall cybersecurity framework.

Cybersecurity threats are on the rise. According to a March 2021 Security Signals study, 83% of enterprises have experienced at least one firmware attack since 2019. Moreover, a Check Point cybersecurity report finds that ransomware attacks almost doubled in 2021 compared to 2020, largely due to the increase in remote work environments.

The size of your organization can also increase your risk. While organizations of any size are at risk, the more employees you have, the more chances there are for human error to occur.

At the enterprise level, your company is also at an increased risk of cybersecurity threats due to complex internal processes, interconnected systems, and multiple office locations.

With the growing threat from ransomware and data breaches, security professionals need to evaluate protocols and ensure measures are in place to protect critical data. In this article, we’ll explain what enterprise file encryption is, what it’s used for, and how it can help protect companies like yours from cybersecurity threats.

What is enterprise-level file encryption?

As the term suggests, file-based encryption protects data in files by making it inaccessible without a unique key. This is a more granular layer of protection than full-disk encryption, which works at the device level to prevent unauthorized access.

An enterprise file encryption strategy protects data across its lifecycle. This includes the following data states:

• Data at rest. At-rest data is stored in a device or database and is not actively moving to other devices or networks.

• Data in transit. Also known as data in motion, in-transit data is being transported to another location, whether it moves between devices, across networks, or within a company’s on-premises or cloud-based storage.

• Data in use. Data that is in use is regularly accessed for operations such as processing, updating, and viewing the data.

Without encryption, each data state is vulnerable to theft and corruption due to unauthorized access.

Attackers often target data at rest because it’s easily accessible if proper protection controls are not in place. For example, an employee’s laptop can compromise your data integrity if they are not encrypting data stored on the device. If the laptop itself is stolen or lost, hard disk encryption will keep data inaccessible if a would-be attacker tries to mount the hard disk to another device.

Data in transit is susceptible to man-in-the-middle attacks, which intercept data on the way to its destination. For example, an attacker can access a network through an unsecure Wi-Fi router and capture or manipulate sensitive information.

Data in use is the most vulnerable state because it is directly accessed by one or more users. Without identity management tools, you are at an increased risk of an unauthorized individual trying to access the data.

Enterprise file encryption takes a comprehensive approach to data security, protecting all three states of your data, as well as data moving from one state to another.

The high costs of a data breach

Protecting sensitive data against cyber threats and data breaches is paramount. With today’s more distributed and remote workforces, enterprise organizations are frequently targeted in ransomware and firmware attacks.

Despite the risks, only 50% of organizations have a comprehensive encryption strategy in place. Another 37% have a limited encryption strategy, which means sensitive data could be at risk of unauthorized exposure.

Ransomware, data breaches, and other adverse cybersecurity events wreak havoc on an organization’s financial health. Research has found ransomware attacks average $4.62 million per event, and that doesn’t include the cost of the ransom itself. The other costs of ransomware are connected to the following:

• Operational disruption and downtime. The cost of downtime following a ransomware event can be 50 times greater than the ransom demand. In 2020, the average ransom demand was $5,600, but the average cost of downtime was $274,200.

• Recovery and rectification. Recovering from a ransomware attack cost organizations an average of $1.85 million in 2021, and it can take years to restore compromised data and systems.

• Data loss. Even if you pay the ransom, you might not recover your data. For example, stolen data might be auctioned on the dark web whether or not the ransom was paid. In other cases, faulty decryption tools impact data recovery, and cybercriminals might not return stolen data after receiving the ransom money.

Like ransomware events, data breaches invoke a number of business and non-business costs. For the average $4.24 million security breach, the cost breaks down as follows:

• Lost business revenue from system downtime, customer turnover, and reputational losses averages $1.59 million.

• Detection and identification of the breach costs an average of $1.24 million.

• Post-breach response efforts average $1.14 million.

• Notifying regulatory agencies, key stakeholders, customers, and the general public of the data breach costs and average of $0.27 million.

How file encryption benefits your organization

File encryption gives companies like yours the ability to control user access and review system activity. Increasing visibility and control over organizational data can help reduce the risk of third-party and insider threats.

Access controls ensure that users have access to only what they need to do their job. Regular review of your user access controls can help you pinpoint insider threats, such as an employee who attempts to access data that is not relevant to their job role.

System activity monitoring gives you greater insight into data usage and access patterns. It can also enhance your overall security by identifying suspicious behaviors. For example, should an employee inadvertently let an attack in through a phishing scam, reviewing system activity will help IT admins quickly respond to and contain the threat.

Enterprise cybersecurity issues are not limited just to its employees and internal systems, but also to its third-party vendors. On average, a typical enterprise organization has around 5,800 third-party vendors. Each vendor that does not employ basic security controls can weaken your overall cybersecurity.

More than half of enterprise organizations have experienced a third-party data breach. The average costs of third-party data breaches are higher, increasing from $4.24 million per breach to $4.33 million per breach event.

Industry requirements and standards for file encryption

While file-level encryption is a good practice for overall data security, it may also be a requirement for your organization’s compliance with certain regulatory provisions.

Multiple industry and governmental regulations exist that specify how your data—including personally identifiable information (PII), protected health information (PHI), financial records, and other critical information—must be managed and protected.

Financial services industry requirements

The financial services industry is heavily regulated because of the high volume of sensitive customer information it collects. In fact, the financial sector is second only to healthcare when it comes to being targeted by malicious cyberactivity.

Applicable regulations include the following:

• Gramm-Leach-Bliley Act (GLBA). The GLBA requires encryption of customer information both at rest and in transit on external networks. This applies to all financial institutions, which includes companies that provide financial products or services.

• Federal Financial Institutions Examination Council (FFIEC). FFIEC guidelines require encryption of data at rest when the company’s risk assessment indicates that encryption is necessary.

• Payment Card Industry Data Security Standard (PCI DSS). PCI DSS identifies compliance requirements for any organization that handles cardholder data, including data encryption.

Healthcare Industry Requirements

Healthcare is a heavily regulated industry to ensure the protection of patients’ health and safety. To safeguard protected health information (PHI) against unauthorized disclosure, the Health Insurance Portability and Accountability Act (HIPAA) contains the following provisions:

• Any company that transmits PHI is subject to HIPAA requirements. This includes, but is not limited to, health plans, healthcare clearing houses, healthcare providers, and their associated business entities.

• Document policies related to how you prevent HIPAA violations through the implementation of physical, technical, and administrative security measures.

• Conduct self-audits and risk assessments to identify potential data vulnerabilities.

• Encrypt PHI to NIST standards whether the data is at rest, in transit, or in use.

• Encrypt data that is transmitted over an external network or stored off-site.

• Implement access controls and user authentication when accessing, storing, and transmitting PHI using mobile devices.

Government Industry Requirements

Defense, military, and government industry regulations protect personal and sensitive information.

The US Federal Government requires non-miliary government agencies and government contractors to adhere to the Federal Information Processing Standards (FIPS):

• Anyone who handles sensitive but unclassified (SBU) information is subject to FIPS compliance requirements.

• FIPS security standards require rigorous testing to determine if a specific solution meets governmental regulatory requirements.

• FIPS 140-2 is used to validate that a chosen encryption method meets the requirements necessary to protect SBU data.

The Federal Information Security Modernization Act (FISMA) compels federal agencies to implement information security practices that reduce the risk of unauthorized access and use of sensitive information:

• Data systems must be encrypted to prevent the exploitation of potential vulnerabilities.

• Federal organizations and government contractors identify implemented security policies in a system security plan.

• Information systems and data are classified according to a range of risk levels.

• Password keys must be changed regularly for data security.

WinZip Enterprise enables enterprise file encryption

Enterprise-level organizations manage large data volumes across multiple storage repositories. WinZip® Enterprise is a powerful, customizable solution that helps you protect critical data against loss and compromise.

Offering a complete set of enterprise-grade tools, WinZip Enterprise is completely customizable. With centralized IT control, it’s easy to customize the user experience, remove unnecessary features, and set and enforce security policies across the organization.

WinZip Enterprise encrypts files using the Advanced Encryption Standard (AES) format, which is the standard used by governmental bodies to protect classified and sensitive information. In fact, it is the most commonly used encryption protocol for data protection. AES encryption is FIPS 140-2 compliant, making it a valuable tool for industries subject to data security regulations.

Learn how WinZip Enterprise simplifies file encryption for enterprise organizations.