Encryption pops up again

This article in Computerworld discusses some of the changes happening in the encryption environment and also addresses some possible options, such as selective encryption, or newer processes that perform encryption "on the fly", but again I'm not convinced that it isn't another case of someone trying to throw a "solution" at an under researched "problem".

I guess there's only so many topics to talk about, and every time there's another data loss publicized, this one comes up.  While there is  no doubt some information needs to be protected through the use of encryption based on its sensitivity, or the manner in which its used, it isn't a requirement for ALL information.  Even personally identifiable information (PII) only needs to be encrypted if it's  handled in a manner that could potentially expose it to others, while in transit, in storage by a third party, or on a system that could potentially be exposed to unauthorized sources.   It's important to do an assessment of the information you have and how it's managed to determine the need for encryption.

In some cases, business practices need to be closely examined to see if an unnecessary risk is being placed on information and if there is a potential that others could place you at greater risk for exposing data.  The problem is generally related to policies and business practices, and in many cases, organizations become too comfortable and fail to periodically re-evaluate how they do things.

How often does your organization evaluate their practices?  If you ask the question why do we do something in a specific way, and no one can remember why, there's a good chance it could stand a change.  How often are backups generated?  How are they stored? What information is on them?  Is there a way to isolate content that may need to be protected (such as PII) that represents a minor portion of the content on a backup?  What would the benefit/cost be of isolating that information and handling it in a different manner to minimize the volume of data requiring encryption?  What if you could demonstrate an overall savings to your organization by making a suggestion to perform such an evaluation?

Encryption is a tool and it has it's place in the data protection and information management world, but it's not necessarily the only answer. You can drive a screw with a hammer or a screwdriver, if you open your toolbox and have a choice... which one would you use?