Because high-availability and fault-tolerant systems need strong security
Over the last several months, we’ve covered some very important concepts in our Top 10 countdown of NonStop security fundamentals— you can review items #4 to #10 on XYPRO’s website and LinkedIn page. Now, we’ve reached #3 on the list.
Throughout much of the first seven security fundamentals, the focus was on effectively managing access to the HP NonStop server and controlling and monitoring user access and activity. Obviously, those are absolutely must-have security requirements for mission-critical systems. Now, however, let’s consider the data that’s being processed or stored on NonStop systems.
Given the high-value business applications and processes that are often run on NonStop servers (such as those related to payments, financial services, telco, healthcare, energy, manufacturing, etc.), it’s likely that there is a significant amount of sensitive data that must be protected. And this data—whether it’s credit card information, payment transactions, health information, social security numbers, customer details or some other type of sensitive information—is the most high-value target for hackers and cyber-criminals.
Keeping sensitive data safe is the topic for NonStop Security Fundamental #3.
#3: Protect sensitive data
Two very effective approaches to protecting data-at-rest and in-transit are encryption and tokenization:
1. Encryption. Encryption is the process of using an algorithm to securely transform data into a meaningless form using a secret key. Data can only be accessed in live form by the trusted system that has the appropriate authority to use the private or secret key to decrypt it. Encryption of electronic data typically uses the Advanced Encryption Standard (AES). AES is an industry-proven standard that was announced in 2001, by the U.S. National Institute of Standards and Technology (NIST). Traditional modes of AES significantly alter the original format of the data and so have a big impact on data structures, schemas, and applications. For example, encrypting a standard credit card number with traditional AES-CBC mode will result in a string containing non-numeric data, which may also vary in length from the original card number. This obviously creates a major implementation problem for companies seeking to use AES. To address this issue, a new mode of AES, called “Format-Preserving Encryption” (FPE), or AES-FFX mode, has been introduced which strongly encrypts live data while retaining the original format of the data. This replaces the data in the live system with a functional equivalent field which cannot be reversed without the associated key. With the FPE mode of AES, data can be encrypted without having to then change database schemas and applications to accommodate the encrypted data. FPE is often used for “Personally Identifiable Information” in transit and storage as a standards-recognized protection and compliance control, or for credit card capture from POS ecosystems or e-commerce platforms.
2. Tokenization. Tokenization does not transform data but instead randomly maps a live data field to a functionally equivalent surrogate value (i.e., a “token”) which replaces the real data. Since tokens do not represent actual data, they can be shared and stored without risk of data loss. To convert a token back to real data, a system (or application) needs to use the tokenization server which hosts the random mapping table to return the token to its original value. First generation tokenization systems used a database for this mapping approach. Tokens can also retain the original format requirements so the impact on existing data structures and applications is mitigated and, since the token can only be reversed exclusively by the token server itself, systems using tokens may be taken out of scope for compliance purposes (e.g., PCI-DSS compliance). However, a major disadvantage of traditional tokenization has been the complexity of managing token databases (such as handling token “collisions”, backup and recovery, scalability and performance). Next generation tokenization solutions are available that address these issues. For example, XYPRO offers Voltage Security “Secure Stateless Tokenization” (SST) which removes the need for a token database and enables higher-performance, lower costs and simplified deployment. Also, by eliminating token databases, SST takes away high-value data targets for hackers and reduces the risk of data breach. Notably, Voltage SST runs natively on HP NonStop, IBM z/OS and Open systems.
For some companies, modifying their NonStop application (like BASE24 or Connex) to use encryption or tokenization is a major challenge and has prevented them from fully protecting their data. For these types of NonStop server users, XYPRO has developed XYGATE Data Protection (XDP) which enables NonStop applications to use Voltage encryption and tokenization without changes to the application.
So, that’s #3: Protect Sensitive Data. Data can be an organization’s most valuable treasure and it’s a major target for cyber-criminals. News headlines are full of stories about data breaches and stolen information—often from some of the world’s leading technology companies. Encryption and/or tokenization are critical solutions for protecting sensitive data, reducing the scope of regulatory compliance, and neutralizing the impact of a data breach.
Stay tuned to the XYPRO blog site—next up on our list is NonStop Security Fundamental #2. Also, get notified automatically when new XYPRO blogs come out by following XYPRO on LinkedIn or Twitter.
For more information or help: More in-depth information and guidance on these security subjects are available in XYPRO’s NonStop security handbooks: HP NonStop Server Security: A Practical Handbook and Securing HP NonStop Servers in an Open Systems World: TCP/IP, OSS and SQL.
You may also contact XYPRO for assistance. For over 30 years, XYPRO has provided NonStop security solutions and services that help companies protect their NonStop systems and comply with industry regulations (such as PCI DSS, HIPAA, and SOX).
Subscribe to:
Posts (Atom)
Posts
