I feel that no one in the group I work in, myself included, really groks encryption and security, or the reasons behind making certain decisions. For example, we recently had a conversation regarding encryption of data that we handle for another group that we work with - the data ends up in a database that is on our secure corporate network (I work in a small group in a large software company, so the integrity of the corporate network is very high), along with everything else we handle. Of course, standard guidelines call for "encryption" of this data.
Obviously, that could mean many things - IPSec/encrypted connections, encrypted fileshares, encryption implemented in the DB (whole-DB or column), encryption of the actual bits in the file, etc. - and some people in the group are under the impression that the only kind of encryption that really counts is directly encrypting the bits that are stored, the argument being that everything else is too easy to circumvent - "if the DB is encrypted, I could still log into it and see the data there; if the file share is encrypted, as long as I have permissions to the folder I can just grab the file; but if the bits are directly encrypted, I won't be able to read it". My instinct says that that statement is based on limited understanding: they can see themselves logging into SQL Server Management Studio to see the data, but since they wouldn't know how to take a stream or array of encrypted data and use a certificate that they probably have access to to decrypt it, it's probably safe. Are they right? Am I right? No one seems to really know, so decisions get based on the opinion of the loudest or highest-paid person.
Anyway, that's just kind of an extended example of what I'm talking about. I feel like it's the blind leading the blind here, with decisions based on limited understanding, and it's frustrating. I'm no expert on the technical bits of encryption, but I know how to use standard libraries to encrypt streams and arrays and the like - where I really need more knowledge is about architecting data security and information on which I can base decisions like the above. Where can I read about this kind of stuff?