Safeguarding the Data that Powers the Business
By Derek Tumulak

Successful enterprises have become adept at storing and managing corporate data and utilizing that information to effectively serve customers, better manage operations, and improve efficiencies. However, given the ongoing incidence of high-profile security breaches, which according to a 2007 Ponemon Institute study, has occurred within 85% of corporations, and the increased disclosure and security mechanisms being mandated by privacy legislation, the degree to which an enterprise protects its data assets is as critical as how that data gets used.

For most organizations, corporate databases house the most valuable assets: customer information, transaction histories, and intellectual property. It is this information that must be shared and employed effectively to best run a business. However, it is also the same information that legislation is placing a premium on organizations protecting as well as the most valuable to hackers and internal staff looking to exploit sensitive information.

Consequently, these critical assets of corporate intelligence can become liabilities if they are not adequately safeguarded. In a recent U.S survey of both commercial and government computer security practitioners, data protection was named the number one critical issue to confront in next two years. So how can IT teams meet these seemingly contradictory challenges of better information utilization and protection?

Encrypting data stored inside the corporate database is critical to achieving data privacy and can be employed to effectively protect sensitive data, so that in the case of a database breach, any encrypted data will be unusable. However, encrypting data in a database can create a great deal of complexity—and if implemented incorrectly, it will not adequately address fundamental security gaps. Deploying a data privacy solution requires advance planning to ensure that all issues are addressed prior to implementation.

Database Vulnerabilities
The effects of a security breach on a database that compromises sensitive enterprise data can be devastating. Recent research from Forrester has found that breaches can cost a company between $90 and $305 per lost record and with the broadening number of internal breaches and increasingly sophisticated attacks from outside the network, ensuring data privacy is vital. To achieve data privacy, it is important to first understand the points of vulnerability within a database:

Servers compromised by untrustworthy database administrators Authentication credentials are not properly managed (i.e. all applications use the same database username and password) Authorization policies within a database are not properly defined (i.e. database users often have access to sensitive information they do not require) Database security is a moving target with no real standard

Implementation at the Database-level
A data privacy solution can be implemented at multiple places within the enterprise—including the network perimeter, application level, database level, and storage level. Choosing the point of implementation not only dictates the work that needs to be done from an integration standpoint but also significantly affects the overall security model. The earlier the encryption of data occurs, the more secure the environment—however, due to distributed business logic in application and database environments, it is not always practical to encrypt data as soon as it enters the network.

Database-level encryption allows enterprises to secure data as it is written to, and read from, a database. This type of deployment is typically done at the column level within a database table and, if coupled with database security and access controls, can prevent theft of critical data. Database-level encryption protects the data within the DBMS and also protects against a wide range of threats, including storage media theft, well known storage attacks, database-level attacks, and malicious DBAs. Database-level encryption eliminates all application changes required in the application-level model, and also addresses a growing trend towards embedding business logic within a DBMS through the use of stored procedures and triggers.

Since the encryption/decryption only occurs at the database tier, this solution does not require an enterprise to determine the access characteristics of applications that connect to the data that is encrypted. While this type of solution can certainly secure data, it does require integration work at the database level, including modifications of existing database schemas and the use of triggers and stored procedures to undertake encrypt and decrypt functions. Most database encryption solutions provide some automation of this initial integration work.

Careful consideration must be given to the performance impact of implementing a database encryption solution. First, enterprises must adopt an approach to encrypting only sensitive fields. Second, this level of encryption must leverage hardware to increase the level of security and to offload the cryptographic process in order to minimize any performance impact. Finally, attention must be given to how encrypted fields are used—for example, performing a search within a range of values on an encrypted column would have an adverse affect on performance. The primary vulnerability of this type of encryption is that it does not protect against application-level attacks as the encryption function is strictly implemented within the DBMS.

Technological Considerations for Database Encryption
Deploying database encryption will span several technologies across the security framework. Consequently, it is important to leverage existing technology standards that will help ensure security, performance, scalability, interoperability, and supportability of the overall solution. Furthermore, by leveraging existing technology standards where appropriate, enterprises can more quickly and effectively deploy a complete data privacy solution. This should include:

Leveraging Secure Transport Standards—Existing standards such as SSL and IPSec are widely used for securing data transport. These standards are mature and can also be leveraged as a basis for deploying a data privacy solution. Deploying Authentication, Authorization, and Auditing (AAA) Technologies—It is important to understand all AAA technologies within an organization. This should include users and processes that have access to different resources as well as an audit trail that can provide detailed logs for each access. In some instances, it may be desirable to leverage existing AAA services within an organization to augment a data privacy solution. Utilizing Specialized Hardware—In recent years, significant progress has been made in developing dedicated hardware platforms that can perform cryptographic operations at a much faster rate than in a software-based solution running on standard hardware. Some hardware solutions even provide an additional level of security by never allowing private keys to leave the device and performing all cryptographic operations internally. One should consider a solution that involves the use of specialized hardware when deploying a data privacy solution to achieve the highest level of security and scalability. Using Cryptographic Algorithms—Usage of standard and proven cryptographic algorithms such as AES and RSA are critical in order to ensure a high level of security and to manage risk associated with evolving to future data privacy solutions. In addition, it will be easier to find people with expertise in these standard algorithms in the future as the IT staff changes. Working with Standard Software Interfaces—Usage of standard software interfaces is also important for managing the risk of making enhancements to data privacy solutions in the future. As with cryptographic algorithms, it will be easier to add staff with experience working with standard software interfaces.

Additional Considerations for Database Encryption
Undertaking database encryption in an enterprise requires some advance planning to ensure that all issues are addressed and understood prior to implementation. It is important to realize that while there are some commonalities across enterprises, each will have varying infrastructures and systems.

Understand and Minimize Performance Impact
As discussed earlier, encrypting data can have significant performance implications on existing systems within the enterprise. In order to adequately address performance concerns, an enterprise must understand what acceptable level of performance impact can be tolerated within their specific environment, if any. It is important to realize that there may be a trade-off between performance and data security. Additionally, an enterprise must understand how to best minimize any performance impact as a result of encryption. Review the infrastructure and systems in advance to see if there are points that can be optimized to offset performance impacts, offload encryption to specialized hardware where possible, and encrypt only the data that requires this level of security. If a data privacy solution is deployed correctly, performance impacts can be kept to a minimum, with actual latency of no more than a few milliseconds.

Anticipate and Plan for Necessary Changes
In today’s complex enterprise environments, it is important to anticipate and plan for the changes that will be required as a result of encryption of critical data. These changes will occur in business logic, databases, storage systems, and other components of the overall enterprise architecture and must be addressed and planned for in advance of deployment. Some of these changes include:

data size and type changes when converting clear text to cipher text; potential additional storage requirements as some encryption may result in larger data segments; and, changes to business logic to plan for the impact of encryption.

Ensure Involvement across All Core Technology Areas
Leveraging encryption as a means of securing data can affect technology groups across the enterprise. As a result, it is essential that this effort involve all core technology areas, including network, IT, security, development, database, and storage. Clearly, some groups will be affected more than others; however, the ability of an enterprise to successfully deploy a data privacy solution will hinge on their ability to work across a broad range of IT groups.

Leverage a Centralized Model to Increase ROI
The idea of centralizing processes and functions in a security framework has been utilized for quite some time and is often advantageous. However, when considering a data privacy solution, it is critical to consider the centralization of many of the fundamental building blocks highlighted above. Doing so will help deliver a scalable solution, reduce the cost of management, increase security (particularly key management security), and allow for faster responses to security attacks. Leveraging a centralized hardware platform will ensure that an enterprise maximizes the use of specialized hardware to offload encryption overhead on many platforms. Finally, a centralized model will significantly reduce the cost of ongoing management and maintenance by enabling a single management interface and centralized audit logs. In addition, doing so will help create a compelling ROI model that can make a strong case for deployment of a data privacy solution.

Conclusion
Encrypting data in databases is a cost-effective and reliable way to protect enterprises from an increasing number of attacks that are focused on extracting critical data. With a projected 52% growth rate within corporate use over the next 12 months according to the Aberdeen Group, encryption solutions will not only help protect sensitive information, but also help to ensure compliance with state, federal, and industry-specific legislative measures that require the use of encryption for sensitive data at rest. Enterprises that can effectively implement database encryption, will not only help ensure compliance, but, more importantly, will proactively guard against a devastating security breach and safeguard the trust of consumers.

About the Author:
Derek Tumulak is vice president of product management at Ingrian Networks and has over 12 years of product management and engineering experience in the technology industry. He has an extensive background in enterprise security, payment systems, and Internet messaging. He can be reached at derek@ingrian.com or by phone at 650.261.2438.