Tokenization Vs. End-to-End Encryption: Experts Weigh in

Credit EligibleAs a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

Tokenization or end to end encryption - which solution will win the hearts of data protectors in the race to secure data?

A recent study conducted by PriceWaterhouseCoopers on behalf of the Payment Card Industry Security Standards Council shows that end to end encryption and tokenization are the top choices for companies seeking to employ new emerging technologies to protect payment card and other critical data. And both approaches have their public proponents, including Heartland Payment Systems (HPY) CEO Robert Carr, who's been encryption's most vocal supporter in the wake of his organization's historic breach.

But what are the pros and cons of each approach? We turned to a panel of information security experts for their analyses of tokenization vs. end to end encryption.

Defining the Solutions
A quick look at the essence of these two solutions:

Tokenization replaces sensitive card data information with unique id symbols that keep all the essential data, without compromising its security. This approach has become popular as a way to increase security of credit card and e-commerce transactions, while minimizing the cost and complexity of industry regulations and standards - especially the Payment Card Industry Data Security Standard (PCI).

End to end encryption, also defined by Visa as data field encryption, is continuous protection of the confidentiality and integrity of transmitted data by encrypting it at the origin, then decrypting at its destination. The encrypted data travels safely through vulnerable channels such as public networks to its recipient, where it can be decrypted. One example is a virtual private network (VPN) that uses end to end encryption.

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Healthcare Enews General Healthcare Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

The question for many organizations is not either/or, but rather which approach best fits into the organization's existing security architecture?

Pros and Cons
Size is a factor for organizations weighing tokenization and end to end encryption, says Dave Shackleford, former chief security strategist at EMC, and now principal at Blue Heron Group. "I would probably choose tokenization for smaller organizations, but larger ones will likely benefit more in the long run from looking to implement robust encryption practices and technologies," Shackleford says. Tokenization may not encompass all the data that needs to be protected by larger organizations, he adds.

Anton Chuvakin¸ author of the books "Security Warrior" and "PCI Compliance," says he would choose tokenization over end to end encryption any day. "I just don't believe that anybody can roll out end to end encryption and have it be usable and secure at the same time," Chuvakin says.

Chuvakin is concerned about recent breaches that indicate "in-application" sniffer malware might have been in use. Such malware will grab the data from memory after decryption, he says, completely defeating an end to end encryption solution such as Heartland's E3. "Admittedly, getting such malware on the processing server is very hard, but such a scenario still worries me," Chuvakin says.

Both end to end encryption and tokenization are about scope reduction, and will "most likely fall under the purview of the Payment Card Industry Security Standards Council Scoping Special Interest Group," says David Taylor, founder of PCI KnowledgeBase and a member of the group he referenced. "Both end to end encryption and tokenization are based on the whole idea that not actually having credit card data available on 'as many' or 'any' systems will move those systems out of scope," Taylor says. However, he notes, there are concerns on several fronts, which the Visa best practices thus far do not address.

Among the concerns that experts weigh:

Tokenization Pros:

Tokenization Cons:

End to end encryption Pros:

End to end encryption Cons: