Encryption in databases is nothing new, but its becoming a more prominent topic every day. One of my first experiences with it was in dealing with a database that had extremely confidential data, and it was a known target to foreign countries who were actively attempting to access the network to get to the database. Not to be overly dramatic, but if this data was compromised, people would be killed. I wasn't working for a Gov't agency at the time...so don't read too much into all I just said. The point is, every company stores data that needs to be secured, and the reality of it is, security is an illusion we can tell ourselves we have until we're proven wrong. So from that you have two choices:
1. Give up, its inevitable our data will be breached.
2. Make it as difficult as possible for our data to be breached, and if it is, encrypt everything valuable to make it more difficult at that point.
I choose 2. :) In the scenario I mentioned, we had security layer on security layer..and I don't mean to say this is the complete solution to make your data secured. Given the data in your database will eventually be in the hands of people who took it, what can you do? Oracle sells TDE, which does a lot of the work for you, but its a licensed feature. It used to include transparent data encryption at rest and data in flight. Thanks to a security issue a few years ago that exposed encrypted network traffic, encryption of network traffic in flight is now part of your normal db license (aka no additional cost.)
Strongauthentication services (Kerberos, PKI, and RADIUS) and network encryption (native network encryption and SSL/TLS) are no longer part of Oracle Advanced Security andare available in all licensed editions of all supported releases of the Oracle database.
What about data at rest and backups? Every company keeps PII (personal identifiable information) on their employees...Name, SSN, Address, Phone number, etc. What about your company's customers? If your unencrypted data is breached, your company is required by law to notify the people who may have had PII stolen. Would your company lose future business if this happened? I've been told the FCC requires databases storing network endpoint addresses to be 256-bit encrypted. For almost all dba's, encryption isn't really optional anymore.
So...We talked about TDE...there's also something Oracle refers to as SDE (selective data encryption) ...and this is free (1930738.1). This is really easy to implement...its not perfect, but its better than nothing. I'll show you how in the next post.
YOU ARE HERE>> SDE Part 1
SDE Part 2
SDE Part 3
1. Give up, its inevitable our data will be breached.
2. Make it as difficult as possible for our data to be breached, and if it is, encrypt everything valuable to make it more difficult at that point.
I choose 2. :) In the scenario I mentioned, we had security layer on security layer..and I don't mean to say this is the complete solution to make your data secured. Given the data in your database will eventually be in the hands of people who took it, what can you do? Oracle sells TDE, which does a lot of the work for you, but its a licensed feature. It used to include transparent data encryption at rest and data in flight. Thanks to a security issue a few years ago that exposed encrypted network traffic, encryption of network traffic in flight is now part of your normal db license (aka no additional cost.)
Strongauthentication services (Kerberos, PKI, and RADIUS) and network encryption (native network encryption and SSL/TLS) are no longer part of Oracle Advanced Security andare available in all licensed editions of all supported releases of the Oracle database.
What about data at rest and backups? Every company keeps PII (personal identifiable information) on their employees...Name, SSN, Address, Phone number, etc. What about your company's customers? If your unencrypted data is breached, your company is required by law to notify the people who may have had PII stolen. Would your company lose future business if this happened? I've been told the FCC requires databases storing network endpoint addresses to be 256-bit encrypted. For almost all dba's, encryption isn't really optional anymore.
So...We talked about TDE...there's also something Oracle refers to as SDE (selective data encryption) ...and this is free (1930738.1). This is really easy to implement...its not perfect, but its better than nothing. I'll show you how in the next post.
YOU ARE HERE>> SDE Part 1
SDE Part 2
SDE Part 3
No comments:
Post a Comment