Many organizations are implementing data encryption today because they have to, not because they want to. Compliance with legislative and industry mandates is forcing the issue. Unfortunately, these organizations may not be reaping the full benefit of encryption if they aren’t taking a strategic approach. The Vormetric Data Security solution offers a more intelligent approach to encryption that goes beyond simply encrypting a disk.
Even though the use of data encryption as a security tactic is on the rise, many organizations don’t turn to encryption because it is a great idea; they do so because they have to. Numerous laws, such as the HITECH Act, and an increasing number of industry regulations, such as PCI DSS, are forcing organizations to implement encryption. Many times they just do least amount possible so they can put a checkmark in the “encryption” box on the compliance list and move on to the next issue.
When the purpose of using this technology is to appease the auditor, you fail to capture the full range of benefits from encryption. Opportunities are also lost when a non-intelligent solution such as switch or disk encryption is chosen.
In such cases, companies miss the opportunity to secure data against insider threats. For instance, imagine the minimal impact the recent WikiLeaks situation might have had if the sensitive information stolen from the State Department had been encrypted intelligently.
Another result of the failure to thoroughly develop a meaningful encryption strategy is complexity. Companies fear the complexity of implementing point solutions and having to manage many keys for both databases and multiple file shares. There’s also the potential of not being able to access their data if keys are lost.
More importantly, some companies fear that business processes and application performance might be impacted if encryption has to be integrated into critical databases and applications. Such fears are often predicated on past experience, or from reading about experiences with PKI encryption and native database encryption solutions where databases and their supporting applications are impacted with increased response times, database indexing being impaired, or a DBA not being able to access the data when needed to perform maintenance. Furthermore, there are no controls for “separation of duties” with native encryption, so an additional layer of controls must be implemented, thereby increasing the cost and complexity to the overall solution.
Clearly, what’s needed is a comprehensive encryption strategy that includes the ability to protect both structured and unstructured data stores including databases, file shares, storage systems, and system logs across the infrastructure. The strategy also requires specific focus on performance, extensibility, key management and low administrative overhead.
This is the challenge that Vormetric, Inc. addresses with Vormetric Data Security, a comprehensive solution for centrally managed key management, encryption and access control for data at rest across distributed heterogeneous Linux, UNIX, Windows and virtual machine environments.
The Vormetric Data Security solution consists of two major components: the Vormetric Data Security Manager and the Vormetric Encryption Expert Agents.
The Data Security Manager provides centralized administration of encryption keys, data security policies, and event log collection within a centralized hardened appliance that is physically separate from the Encryption Expert Agents. Data Security Manager functions as the central point for creating, distributing and managing data encryption keys, policies, and host data security configurations.
The Encryption Expert Agents are software agents that provide protection to structured and unstructured data stores that can include database and file server files, folders, documents, image scans, voice recordings, logs and more. These agents, which are unique to the operating systems they operate on, enforce established security policies to either grant or deny access to the targeted data. They also enable strong separation of duties on the server by encrypting files while leaving their metadata in the clear so that IT administrators can perform their jobs without directly accessing the information.
The agents perform the encryption, decryption and access control tasks locally on the system that is accessing the data at rest in storage. This enables encryption to be distributed within the data center and out to remote sites, while being centrally managed via the Data Security Manager cluster.
This segmented approach enables administrators to manage standards-based encryption across Linux, UNIX, Windows and virtual machine operating systems in both centralized and geographically distributed environments. This approach also allows security teams to enforce strong separation of duties over management of the Vormetric system by requiring the assignment of key and policy management to more than one data security administrator so that no one person has complete control over the security of data.
Vormetric enables transparent implementation and operation with minimal overhead. The solution can be implemented quickly without the need to re-architect databases, applications, files or storage networks and without degrading the performance of existing systems. The agents are inserted above the file system and/or volume manager and are transparent to users, applications, databases and storage systems. There are no modifications to applications or databases required, and according to Vormetric, deployment can be completed in days to weeks depending on the size of the organization.
Encryption scares a lot of people, but encryption of data is the easy part; transparently controlling the decryption of the data so protected data can not be compromised is the complex part. Vormetric helps simplify and minimize the problems and fears associated with encryption so that organizations obtain the full benefits and not just a mark on a checklist.
Brian Musthaler is a Principal Consultant with Essential Solutions Corporation. You can write to him at Bmusthaler@essential-iws.com.
______________________________________________________________Essential Solutions researches the practical value of information technology, and how it can make individual workers and entire organizations more productive. Essential Solutions offers consulting services to computer industry and corporate clients to help define and fulfill the potential of IT.
About Essential Solutions Corp:
