Do You Need Encryption?

There are certain costs involved in implementing and using encryption—in terms of development time, the degree to which data throughput is affected, increased complexity for users, and so on. Therefore, the decision of whether or not to use encryption isn’t necessarily a “no-brainer.”

Here are some pertinent questions you may wish to use as starting points in evaluating whether to use encryption:

Is this data really worth encrypting?
How many people need to have access to this information?
How quickly will the information become outdated (and therefore less sensitive)?
What do you consider an acceptable level of risk (of information compromise)?
If the data needs to be exchanged across a network, how secure is the network itself?
What are the possible repercussions of your secured data falling into the wrong hands (what’s the worst that could happen)?
How valuable (in terms of time, money, or other values) is this information to you?
How valuable could this information be to someone else?
What costs are involved, both in implementing and in using the desired encryption technology?

These are your considerations for the present. As software development tools progress, encryption objects will make built-in support for encryption become almost trivial. End users will find encryption becoming easier to use and more integrated into their software.

Remaining issues regarding encryption costs will probably center more around the degree to which encryption impairs data throughput over networks. With current technology, the degree to which throughput is affected varies from little or negligible impact to extremely significant (factors of a thousand or more times slower than without in some cases!), with the primary determinant being the complexity (and presumably the effectiveness) of the algorithm being used. It will be interesting to see whether using faster computers solves this problem or just elevates it to another level. (I would bet on the latter, since faster computers means faster ways to attack the algorithms as well.)