Archive for category Data Security

Upcoming Webinar: Focus on FTP Server Compliance

Posted by on Wednesday, 23 January, 2013

Don’t miss our upcoming live webinar led by Chief Architect Bob Luebbe!

Get Your FTP Server in Compliance

Thursday, January 31 at Noon Central

Secure FTP Server Compliance WebinarWith the recently added rules for the Healthcare Insurance Portability and Accountability Act (HIPAA) that now holds trading partners and business associates accountable if they also handle patient data, it’s a good time to review whether your FTP server is updated and ready to meet compliance requirements. Learn how to keep your data as well as trading partner files protected within your network and still allow external access without opening inbound network ports.  You can also see a demo of Linoma Software’s GoAnywhere™, a managed file transfer solution that includes a secure FTP server and a reverse proxy DMZ gateway with clustering and load balancing capabilities to ensure high availability.

Learn more


 

IBM i Encryption Made Easy with DB2 Field Procedures

Now Available On Demand

IBM i 7.1 DB2 Field Procedures, data encryptionDuring this recorded webinar, you can learn about how to make the DB2 Field Procedures Tool in IBM version 7.1 work even more efficiently as part of a more comprehensive solution, one that makes it easier to implement encryption, manage keys, and generate auditing reports so important for meeting compliance regulations like HIPAA and PCI DSS,.  You can also see a demo of Linoma’s popular encryption software Crypto Complete.

Learn more


All of our webinars are recorded, so if you register and are not able to attend live, you’ll be able to review the webinar at a more convenient time.

We look forward to having you join us and will be happy to answer any questions you have.

 

 

Susan Baird

Susan is the Marketing Manager at Linoma Software, helping promote our secure file transfer and encryption solutions. Her specialty is content creation and social media marketing, and you can find out more about her by viewing her LinkedIn profile.

More Posts - Website - Twitter - Facebook

What Can We Learn from the LinkedIn Breach?

Posted by on Thursday, 21 June, 2012

Today is another unfortunate reminder that no matter the size of a company or its industry, a data breach makes headlines.

Not only does it attract negative attention and erode customer confidence, an announcement that your company’s data has or may have been compromised can result in some steep financial penalties.  If fines associated with violating regulations like HIPAA or state privacy laws don’t get you, potential lawsuits might.

Take LinkedIn, for example.  Earlier this month, the social network of business professionals reported that nearly 6.5 million encrypted passwords had been leaked online.

Today, Mashable.com reports that LinkedIn is facing a $5 million civil lawsuit from a user claiming that LinkedIn’s security policy violated industry standards for database security.

There really are no lessons for the rest of us to learn from this latest breach, because most of us already know what we’re supposed to do.

  • Keep passwords secure, reasonably complex, and change them regularly.data breach
  • Ensure your company is using only the most secure encryption standards like AES or Open PGP.
  • Stay abreast of the latest news and techniques for keeping your company security policies and practices up to date and as impenetrable as possible.
  • Invest in solutions that streamline your data encryption processes, that include comprehensive auditing and reporting tools, and that ensure the security of your data at rest and in motion.

The question is how much longer can you postpone taking these steps to ensure that your company isn’t making news next week with an embarrassing and costly data breach?

Susan Baird

Susan is the Marketing Manager at Linoma Software, helping promote our secure file transfer and encryption solutions. Her specialty is content creation and social media marketing, and you can find out more about her by viewing her LinkedIn profile.

More Posts - Website - Twitter - Facebook

Is Disk Encryption Really the Silver Bullet?

Posted by on Thursday, 24 May, 2012

Disk encryption was introduced as a solution for simplifying the encryption requirements that most companies face for protecting sensitive data.  Now that the IT industry has gained a few years of experience, however, many have discovered that disk encryption is not an all-encompassing security solution.

disk encryption for laptop computersLaptops are one of the most popular targets for disk encryption.

[Download our white paper Defending Against Data Breach for details about the risks laptops and tablets present for IT staffs.]

However, companies have discovered that it requires a lot of planning and time to implement laptop encryption properly.

First of all, disk drives must be in good condition with no disk errors, and experts recommend that they be de-fragmented before installing the encryption software.

Once the time-consuming de-fragmentation task is completed, encrypting the drive will take an additional 2- 4 hours depending on the size of the drive.  Employing disk encryption for a large number of laptops in the organization will therefore result in some significant downtime for their users.

Some companies are touting disk encryption as their “end all” for meeting compliance requirements.  But it is not a silver bullet.  For instance, once a laptop is placed on the network, the data on the encrypted disks could potentially be accessed by savvy online hackers.  Once access is gained, all information on the compromised laptop could then be easily downloaded from the laptop by the hacker.

For those companies that deal with credit cards, PCI DSS compliance standards involve a complex series of requirements that disk encryption cannot solve on its own. Here are just two items from the PCI checklist:

  • A user’s access to protected data must be managed separately from his or her access to the operating system that the data resides on.  Therefore, if the secure data is stored on an MS Windows server, access control to the sensitive data must be managed by an application other than in Active Directory.
  • Cryptographic keys and cardholder data must be encrypted wherever it may be stored, including removable media such as USB drives, CDs, DVDs, or tape backups.  However, disk encryption does not encrypt data if it’s moved to other devices.

IT professionals are discovering that the best way to meet PCI DSS and other similar regulations is to keep sensitive data off of laptops whenever possible. Sensitive data can be more easily secured and controlled by IT professionals within centralized corporate database systems. The data can then be encrypted at the field level within these database systems.  Along with effective key management and audit trails, an effective database encryption solution will provide a much higher level of protection for this sensitive data.

To maximize their time and resources, many companies are turning to third party vendors, such as Linoma Software’s Crypto Complete, which provide an effective solution for field encryption without the need to make programming or database changes.

Keeping data secure is a constant battle, and given the high cost of data breach, it could be one of the most critical tasks a company tackles.  As hackers get more creative, relying on encryption best practices may be the best defense IT has.

Daniel Cheney

Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a freelance writer for various technical and social media projects.

More Posts - Website

Tokenization: A Powerful Weapon Against Cyber Attack

Posted by on Thursday, 19 April, 2012

Tokenization in the data security world is the process of moving sensitive data from a company network to a separate location or sever, and replacing and referencing that data on the company server with a unique token.

If hackers attempt to access sensitive information like credit card numbers from a server, they’ll instead encounter the token which prevents them from finding the original data without a specific encryption key or knowledge of the tokenization system.

Linoma Software GoAnywhere Managed File Transfer SolutionFor example, say a merchant acquires a credit card number by swiping a customer’s card with a card reader.  If the merchant has implemented tokenization, this card number information is immediately replaced in the merchant’s database by a token number while the actual card number is sent and stored (in encrypted form) at a different location, along with the reference from the token.

Because the actual card number is never stored in the merchant’s front-end system, hackers have a much more difficult time stealing it. Customers can therefore be assured that it is safe to let that merchant use their card information because the actual credit card numbers are not stored in an easily accessible location.

All organizations that capture credit card data are required by the PCI DSS government regulations to secure and protect this data.  Originally, this presented a challenge to the payment industry until Shift4 Corporation presented tokenization solutions at an industry Security Summit in 1995.  The adoption of tokenization became a popular solution to meet the PCI DSS compliance regulations.

>>Check out these white papers discussing PCI DSS compliance issues, and data breach threats

Other industries are beginning to adopt tokenization to protect confidential information such as banking transactions, medical records, criminal records, vehicle driver information, loan applications, stock trading and voter registration.

Finding the most efficient way to implement tokenization is challenging, but the growing threat of cyber attack and the expense of data breach have motivated IT shops to research options in earnest.

A variety of third-party software solutions, such as Linoma Software’s Crypto Complete, deliver tokenization tools as well as additional options for managing encryption keys, audit logs, message alerts; storing tokenized data; automatically assigning token identifiers; and providing a central management platform for the entire tokenization process.

When a greedy hacker in anticipation of scoring a cache of customer credit card data finds instead a series of tokens, companies win another battle in the war against cyber thieves.

Daniel Cheney

Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a freelance writer for various technical and social media projects.

More Posts - Website

1.800.949.4696  |  sales@linomasoftware.com  |  privacy policy
Copyright ©1994 - 2012 Linoma Software  |  All rights reserved