Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

11/4/2010
01:59 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

RSA Unveils New Solution To Deliver End-To-End Data Security

RSA Data Protection Manager combines tokenization and application encryption

BEDFORD, Mass., Nov. 2, 2010 /PRNewswire/ -- To view the multimedia version of this release visit: http://www.rsa.com/go/press/RSATheSecurityDivisionofEMCNewsRelease_110210.html

RSA, The Security Division of EMC (NYSE: EMC), today announced its RSA Data Protection Manager product designed to give customers comprehensive application data protection capabilities. The product combines tokenization and application encryption, two popular application-based controls, with advanced token and key management to deliver end-to-end data security. This combination of data protection and key management technologies is engineered to make data more secure, while lowering operational costs of data protection by consolidating the management layer. By protecting data at the source, within the application that's creating or using it, RSA's product helps ensure seamless data protection throughout the information lifecycle.

"The majority of on-line data breaches happen within the server or application, so mitigating this risk is critical for overall data protection," said Jon Oltsik, principal analyst, Enterprise Strategy Group. "Application-based data security provides a high-level of protection because data is protected at the point of capture and then remains protected throughout its lifecycle. Application-based encryption and tokenization can be quite effective for this type of data security."

"Compliance and key management continue to burden our customers," said Dan Schiappa, senior vice president, Products, RSA, The Security Division of EMC. "They want to protect all of their sensitive data using a robust protection method like encryption, but also want to limit the impact on compliance and environment changes by using a cost-effective solution like tokenization. Combining encryption, tokenization, and key management in the same product provides flexibility and reduces management overhead."

RSA Data Protection Manager (formerly RSA Key Manager) secures data at the point of capture and provides the most granular level of control over sensitive information. The solution is engineered to include:

-- Tokenization: Replacing sensitive information with a substitute value, or token value to protect data such as credit card numbers, account numbers, Social Security numbers, and other personally identifiable information. -- Application Encryption: Enabling encryption and strong key management to secure data at the point of capture. -- Enterprise Key Management: Allowing for enterprise key management with integrations into a variety of data-at-rest encryption options (storage, tape, etc.).

Reduce Compliance Burden and Lower Complexity of Data Protection

RSA Data Protection Manager brings RSA's Tokenization technology together with Application Encryption to combine two commonly used features into the same product for customers. Encryption has traditionally been the preferred method of enforcing data protection in applications, but tokenization (also referred to as "aliasing" or "data masking") is one of the industry's best methods for reducing the cost of compliance.

RSA Data Protection Manager is engineered to broaden the scope of how organizations can use tokenization. RSA has combined its tokenization technology with services from partners like First Data Corporation and VeriFone to secure payment card data. Beyond payment processors, however, tokenization can also help provide protection for other industries such as financial services (personally identifiable information or PII, social security numbers) and healthcare (personal health information or PHI).

Tokenized values maintain their original format, which limits the deployment impact while still providing a high level of protection. In addition, tokens can maintain certain portions of the original data (i.e., the last four digits of a social security number) so other applications can potentially make business use of tokens without ever having access to the real information.

RSA's ability to implement this "hybrid" approach of encryption and tokenization helps customers to get the best of both worlds -- the performance benefits of encryption and the operational benefits of tokenization.

Gain Operational Efficiencies

RSA Data Protection Manager is a robust server side management tool that provides customers with a number of operational efficiencies upon deployment. The solution is engineered to provide not only industry leading client controls but also a simple and easy to use management interface to allow for setup and management of the application protection infrastructure. This helps customers increase security across their organization while making compliance audits easier and less costly.

New capabilities for handling the lifecycle management of keys and tokens, enforcing strong separation of duties, protecting the central object vault, and maintaining granular application permissions also help customers save on operational costs. For example, customers can set specific key rotation policies for different parts of their infrastructure (every month for a point-of-sale system and every year for a storage array) to help meet regulatory requirements without manual effort. In addition, the same server is used to manage the application environment as well as the back-end disk and storage encryption, so customers avoid the overhead of key management "silos."

RSA Data Protection Manager is generally available now.

About RSA

RSA, The Security Division of EMC, is the premier provider of security, risk and compliance management solutions for business acceleration. RSA helps the world's leading organizations succeed by solving their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and cloud environments.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27187
PUBLISHED: 2020-10-26
An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related command...
CVE-2020-7752
PUBLISHED: 2020-10-26
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
CVE-2020-7127
PUBLISHED: 2020-10-26
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVE-2020-7196
PUBLISHED: 2020-10-26
The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the ur...
CVE-2020-7197
PUBLISHED: 2020-10-26
SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* U...