Vormetric Application Crypto Suite

Businesses face mounting pressure from frequent cyberattacks and stricter regulations to protect sensitive data. Security controls span endpoints, network firewalls, IAM, CASBs, and encryption. Encryption itself appears in multiple layers: network encryption (SSL/TLS), disk and filesystem encryption, and targeted data encryption at the application or database-field level. Data encryption is positioned as crucial for protecting credit card data, healthcare information, passports, and other PII, supporting compliance with PCI DSS, HIPAA/HITECH, and GDPR, while also addressing protection needs for financial information and intellectual property.

Common strategies focus on data at rest and data in motion, with distinctions between end-to-end approaches (e.g., S/MIME) and link/transport protection (SSL/TLS). For data in use, emerging approaches like homomorphic encryption are noted as still scientific, while practical approaches include format-preserving encryption (FPE), data masking, and tokenization. Tokenization is described as a one-way technique producing tokens that can enable dynamic data masking based on role; FPE provides standards-based encryption that yields predictable-length outputs that can replace database entries without schema disruption.

Organizations struggle with encryption due to complexity, key management demands, and fragmentation into multiple point solutions with separate infrastructures and consoles. Thales eSecurity’s integrated Vormetric Data Security Platform aims to reduce this complexity. Its Vormetric Application Crypto Suite provides application-layer and database-field security through tokenization with dynamic masking, AES and FPE encryption, crypto functions, static masking, and key management. The suite includes Application Encryption, Tokenization Server, Batch Data Transformation, and Teradata-focused protection, all anchored by centralized key and policy services in the Vormetric Data Security Manager. Strengths include integrated APIs, scalable virtual appliance architecture, and strong separation of duties; challenges include required application/server integration and lack of out-of-the-box business app integration.

• SSL/TLS is described as ubiquitous for network encryption when using the Internet.
• PCI DSS requires specific protection of credit card information.
• HIPAA/HITECH requires specific protection of healthcare information.
• GDPR raises the bar for protecting personally identifiable information.
• Data masking can replace parts of data such as certain fields or characters.
• Tokenization uses one-way techniques to create a token that can be used without unveiling the original data.
• Format Preserving Encryption delivers predictable-length encrypted results so they can replace database entries without breaking database schema.
• The Vormetric Data Security Manager is available as both virtual and hardware appliances.
• The virtual appliance is available for VMware, AWS, and Microsoft Azure environments.
• The tokenization server is vaultless and can be configured for format-preserving random or crypto tokens, including support for the Luhn test.

• “Encryption can be implemented (and regularly is implemented) at various levels.”
• “Data encryption provides, for example, enhanced protection of sensitive data such as credit card numbers, patient data in healthcare, passports or other types of PII.”
• “Frequently, business end up with a variety of point solutions, building distinct infrastructures per use case, providing individual user interfaces such as management consoles, and requiring very specific expertise and training.”
• “This is complex, it is inefficient, and it is expensive.”
• “This integrated approach reduces cost and complexity of implementing encryption at scale in organizations.”
• “The suite consists of four different products that are all focused on streamlining the process of protecting data at the application and within databases.”
• “Integration is typically at the application via the REST APIs, with a focus on high performance at runtime for both read and write access.”
• “Application encryption is somewhat intrusive and requires careful planning as well as a well-thought-out software architecture and development approaches to avoid lock-in risks.”
• “However, there is no out-of-the-box integration into business applications.”
• “We strongly recommend evaluating the suite as a potential solution to increase the level of data protection.”