| |
Author Archive
Now that corporate applications are easier to access via remote and mobile channels, it’s even more important to determine which sensitive data is accessible and where possible breaches may occur. Unfortunately, legions of hackers with Wi-Fi and mobile hacking tools make it imperative that organizations prepare for and defend against potential attacks with even more pervasive security procedures.
One step in creating a stronger defense is to employ field or column-level encryption to protect sensitive data at rest.
Implementing a custom field encryption project on IBM i used to be a notoriously long and painful process. Programming code changes for field level encryption required a steep learning curve, costly programming resources, and even more time in testing, validating and updating the changed application source code. Most companies simply could not justify the additional strain on their budgets for this level of project development requirements.
In response to this challenge, IBM released its OS version 7.1 with DB2 field procedure (FieldProcs) in April of 2010 that greatly simplified the field encryption process. With the new FieldProcs technology, encryption projects can be streamlined because the field procedures are invoked at the database level, making it transparent to the applications. The FieldProcs can be coded to automatically encrypt the field on Inserts and Updates, and subsequently decrypt the field only for authorized users on Read operations. Subsequently, FieldProcs have become very important to those businesses that have legacy applications and limited budgets.
FieldProcs are a great step for improving the viability of field level encryption projects. But even with this, many companies don’t have the resources to integrate and manage the FieldProcs which is why third-party software solutions, like Linoma Software’s Crypto Complete, are valuable. Crypto Complete will generate and manage the FieldProcs on the fields within the files.
Crypto Complete also includes the key management, audit logs and access controls needed for PCI DSS and data privacy compliance. The value of using Crypto Complete for field encryption cannot be understated as it can greatly minimize the learning curve and reduce the implementation resource requirements from weeks to hours.
Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a freelance writer for various technical and social media projects. More Posts - Website
Disk encryption was introduced as a solution for simplifying the encryption requirements that most companies face for protecting sensitive data. Now that the IT industry has gained a few years of experience, however, many have discovered that disk encryption is not an all-encompassing security solution.
 Laptops are one of the most popular targets for disk encryption.
[Download our white paper Defending Against Data Breach for details about the risks laptops and tablets present for IT staffs.]
However, companies have discovered that it requires a lot of planning and time to implement laptop encryption properly.
First of all, disk drives must be in good condition with no disk errors, and experts recommend that they be de-fragmented before installing the encryption software.
Once the time-consuming de-fragmentation task is completed, encrypting the drive will take an additional 2- 4 hours depending on the size of the drive. Employing disk encryption for a large number of laptops in the organization will therefore result in some significant downtime for their users.
Some companies are touting disk encryption as their “end all” for meeting compliance requirements. But it is not a silver bullet. For instance, once a laptop is placed on the network, the data on the encrypted disks could potentially be accessed by savvy online hackers. Once access is gained, all information on the compromised laptop could then be easily downloaded from the laptop by the hacker.
For those companies that deal with credit cards, PCI DSS compliance standards involve a complex series of requirements that disk encryption cannot solve on its own. Here are just two items from the PCI checklist:
- A user’s access to protected data must be managed separately from his or her access to the operating system that the data resides on. Therefore, if the secure data is stored on an MS Windows server, access control to the sensitive data must be managed by an application other than in Active Directory.
- Cryptographic keys and cardholder data must be encrypted wherever it may be stored, including removable media such as USB drives, CDs, DVDs, or tape backups. However, disk encryption does not encrypt data if it’s moved to other devices.
IT professionals are discovering that the best way to meet PCI DSS and other similar regulations is to keep sensitive data off of laptops whenever possible. Sensitive data can be more easily secured and controlled by IT professionals within centralized corporate database systems. The data can then be encrypted at the field level within these database systems. Along with effective key management and audit trails, an effective database encryption solution will provide a much higher level of protection for this sensitive data.
To maximize their time and resources, many companies are turning to third party vendors, such as Linoma Software’s Crypto Complete, which provide an effective solution for field encryption without the need to make programming or database changes.
Keeping data secure is a constant battle, and given the high cost of data breach, it could be one of the most critical tasks a company tackles. As hackers get more creative, relying on encryption best practices may be the best defense IT has.
Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a freelance writer for various technical and social media projects. More Posts - Website
Tokenization in the data security world is the process of moving sensitive data from a company network to a separate location or sever, and replacing and referencing that data on the company server with a unique token.
If hackers attempt to access sensitive information like credit card numbers from a server, they’ll instead encounter the token which prevents them from finding the original data without a specific encryption key or knowledge of the tokenization system.
 For example, say a merchant acquires a credit card number by swiping a customer’s card with a card reader. If the merchant has implemented tokenization, this card number information is immediately replaced in the merchant’s database by a token number while the actual card number is sent and stored (in encrypted form) at a different location, along with the reference from the token.
Because the actual card number is never stored in the merchant’s front-end system, hackers have a much more difficult time stealing it. Customers can therefore be assured that it is safe to let that merchant use their card information because the actual credit card numbers are not stored in an easily accessible location.
All organizations that capture credit card data are required by the PCI DSS government regulations to secure and protect this data. Originally, this presented a challenge to the payment industry until Shift4 Corporation presented tokenization solutions at an industry Security Summit in 1995. The adoption of tokenization became a popular solution to meet the PCI DSS compliance regulations.
Other industries are beginning to adopt tokenization to protect confidential information such as banking transactions, medical records, criminal records, vehicle driver information, loan applications, stock trading and voter registration.
Finding the most efficient way to implement tokenization is challenging, but the growing threat of cyber attack and the expense of data breach have motivated IT shops to research options in earnest.
A variety of third-party software solutions, such as Linoma Software’s Crypto Complete, deliver tokenization tools as well as additional options for managing encryption keys, audit logs, message alerts; storing tokenized data; automatically assigning token identifiers; and providing a central management platform for the entire tokenization process.
When a greedy hacker in anticipation of scoring a cache of customer credit card data finds instead a series of tokens, companies win another battle in the war against cyber thieves.
Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a freelance writer for various technical and social media projects. More Posts - Website
In addition to being one of Linoma Software’s expert bloggers, Daniel Cheney is also in the IT trenches, and it was here that he first discovered the impact the switch to a managed file transfer solution had on his daily work life.
_ _ _ _ _ _ _ _ _ _
As a technology administrator at a major healthcare administration company, sending and receiving sensitive files between various systems used to be a daily grind and a consistent source of stress. We were using PC-based freeware FTP tools and the built in FTP functions on the IBM iSeries. The best we could do with scripting was to use CL command scripts to call the FTP function and hard code the login information. RPG programs would then call the CL scripts and retrieve and send the needed files, but there were insufficient logs and alerts for such automated activities.
 The biggest headache for me was that these scripts, and the resultant sending of files, had to be error-free and reliable! Add to that the pressure of knowing how critical exchanging files is to the operation of the business and the challenge of having a single person responsible for its success — it all became an unrealistic expectation. On top of this, because most of these files are sent over the Internet, and because of the inadequate tools we had at hand, the security of our FTP processes was insufficient.
I knew it was time to find a better solution and after doing some evaluation of available managed file transfer products for IBM iSeries, I selected GoAnywhere™ Director from Linoma Software.
Our installation of GoAnywhere Director made a huge difference almost immediately.
First, Director provides me with all the possible security protocols available, including SFTP, FTPS, and standard FTP with PGP encryption. It also has powerful scripting functions to login to HTTP and HTTPS sessions in order to automate logins to partner sites for file transfers.
Director makes it possible to automate all of the company’s file transfers with a schedule and log so we know the path and time of every transaction. Alerts are automatically sent to us if there are any problems, or if we wish, every time it succeeds. Responsibility can be distributed to various departments as needed to receive these alerts and/or to begin the execution of the transfers when ready.
The simple-to-navigate web interface makes it easy for any user to view, verify, change and execute these file transfers. The scripting is easy for the average user to setup. If there are any challenges that we come up against with our file transfer processes, Linoma support has always been extremely effective at showing me how to do a successful execution.
I know how frustrating it can be to initiate, monitor, and track the ever increasing number of file transfers my company requires, especially without an all-in-one tool like managed file transfer. It amazes me how many IT people still don’t realize there’s a better way to do things — a way that gives them more control, and more time to devote to all the other projects demanding their attention. I know managed file transfer — and specifically GoAnywhere Director — changed my life at work. I hope more of my IT colleagues discover the advantages soon.
Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a freelance writer for various technical and social media projects. More Posts - Website
|
|
