Application Security
4/13/2017
03:25 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

HPE Unveils FIPS-Validated Format-Preserving Encryption Tool

PALO ALTO, Calif., April 13, 2017 – Hewlett Packard Enterprise (HPE) today announced that HPE SecureData has achieved the industry’s first Federal Information Processing Standard (FIPS) 140-2 validation of Format-Preserving Encryption (FPE). HPE SecureData with Hyper FPE delivers a NIST-standardized method of protecting data at-rest, in-motion, and in-use, and maintains the format, meaning, value and logic in the data. Now, government agencies and private contractors serving government customers, can leverage the same powerful and proven technology that has transformed cybersecurity in the private sector.

A major challenge faced by federal agencies, including those attacked by nation state adversaries, is the dependency on legacy applications and platforms with limited native data security options. HPE SecureData helps build data security into both new and legacy applications, de-identifying high-value data classes; for example, protecting classified information, or eliminating reliance on using Social Security Numbers for business processes. Security assurance is increased, while unleashing the utility of data for secure adoption of big data analytics such as Hadoop and other new applications and solutions.

“Government agencies set the high bar for protecting both their sensitive data and citizen data across multiple platforms and applications, both legacy and modern,” said Albert Biketi, vice president and general manager, HPE Security – Data Security at Hewlett Packard Enterprise. “With the HPE SecureData FIPS validation, government agencies and contractors can now use a standardized data security product with extensive enterprise deployments, neutralizing data breaches while liberating analytics and innovation.”

HPE SecureData has the world’s first FIPS-validated AES-FF1 encryption configuration option to operate in strict FIPS mode. This enables public sector customers to take advantage of true FIPS-validated and approved cryptography when building compliance programs for regulations such as the Cybersecurity Act of 2015 data security requirements, DFARS CUI, and General Data Protection Regulations (GDPR).

HPE SecureData with Hyper FPE has the ability to “de-identify” virtually unlimited data types, from sensitive personally identifiable information (PII), to IDs, health information or classified data, rendering it useless to attackers in the event of a security breach. This allows government agencies to securely leverage the de-identified data for big-data analytics, and collaborate with shared data between other agencies or contractors. It also provides accelerated encryption speeds that enable government agencies to adopt new technologies, such as the cloud or Hadoop or invest in innovations such as IoT, all while lowering the risk of disclosing sensitive personal data or compromising high value data.

Full integration with HPE Atalla HSM

HPE SecureData is fully integrated with HPE Atalla HSM, a hardware appliance validated to FIPS 140-2 Level 3, offering organizations greater physical and logical data protection. HPE Atalla HSM stores and manages root keys, with centralized configuration and security policy enforcement, making it simple for customers to take a holistic approach to managing data protection.

Availability

HPE SecureData with FIPS validation is currently available globally, and delivers data security for governance, risk and compliance across public and private sector mission-critical systems for cloud, big data, IoT, payments, mobile data capture, and applications.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.