Protecting Enterprise Data at Rest: Vormetric Encryption Architecture Overview Whitepaper

1
Vormetric Encryption Architecture Overview

• Protecting Enterprise Data at Rest with
• Encryption, Access Controls, and Auditing

2
Data is Your Business
!
Data security breaches are harmful to any
organization of any size.
3
People
Devices
Servers
Servers
People
34
35
94
2012 DATA BREACH INVESTIGATION REPORTA study
conducted by the Verizon RISK Team with
cooperation from global policing agencies.
4
Protect private and confidential info.
Global Compliance

• PCI DSS
• HITECH Act
• UK Data Protection Act
• South Koreas PIPA
• And more

Server Defense-in-Depth Controls
5
Data is Everywhere
Business Application Systems (SAP, PeopleSoft,
Oracle Financials, In-house, CRM, eComm/eBiz,
etc.) Application Server
Unstructured data File SystemsOffice
documents, PDF, Vision, Audio other Fax/Print
Servers File Servers
Security Other Systems (Event logs, Error
logs Cache, Encryption keys, other
secrets) Security Systems
Remote locations systems
Structured data Database Systems (SQL, Oracle,
DB2, Informix, MySQL) Database Server
Storage Backup Systems SAN/NASBackup Systems
Data Communications VoIP SystemsFTP/Dropbox
ServerEmail Servers
6
Data Security Simplified

• Transparent

• Strong

• Must be transparent to business processes, end
  users, and applications

• Privileged users should not have access to
  sensitive data

• Firewall your data approved users and
  applications allowed, deny all others.

• Data type neutral any data, anywhere

• Efficient

• Easy

• SLA, User, and Application performance must
  remain acceptable

• Easy to Understand

• Easy to Implement

• Easy to Manage

• Encryption overhead can approach zero

7
Vormetric Data Security
Vormetric Encryption
Vormetric Key Management
Encryption Agent
Key Agent
Data Security Manager
Oracle 11gR2 TDE
Unstructured
Encryption Agent
Key Agent
Vormetric Key Vault
SQL Server 2008 / 2012 TDE
Database
8
Vormetric Encryption Architecture
Users
Application
Policy is used to restrict access to sensitive
data by user and process information provided
by the OS.
Database
OS
FS Agent
SSL/TLS
File System
SAN, NAS, DAS Storage
9
Protect Server Data
Log Files Password files Config files Archive
Payment
Custom Apps
ERP
CRM
CMS
Log Files Password files Config Files Archive
WebLogic
IIS
APACHE
Data Files Transaction Logs Exports Backup

SQL
Sybase
MySQL
DB2
Oracle
File Share Archive Content Multi Needs
File Servers
FTP Servers
Email Servers
Others
VM
SAN
NAS
DAS
CLOUD
10

• We Secure The Data That Runs Your Business

11
Vormetric Encryption Architecture Overview

• Protecting Enterprise Data at Rest with
• Encryption, Access Controls, and Auditing