HIGH-ASSURANCE ENCRYPTION SOLUTIONS SECURING FINANCIAL SERVICES DATA IN TRANSIT SOLUTION PAPER

Transcription

1 HIGH-ASSURANCE ENCRYPTION SOLUTIONS SECURING FINANCIAL SERVICES DATA IN TRANSIT SOLUTION PAPER

2 COMPLIANCE & OBLIGATION Financial Services is one of the most tightly regulated business sectors. The FSA, the Data Protection Act, GDPR, PCI/DSS and Euro SOX all have implications for securing financial data in transit. Personal data is a valuable commodity. Most financial institutions will hold extensive personal and financial data on their customers, including names, addresses, dates of birth, NI numbers, bank account details, PINs and passwords. Ironically, a lot of this data is held to ensure secure identification of customers in the first place. Financial organisations often have a robust business continuity plan that involves secure off-site backup and disaster recovery. However, it is during this process that data becomes most vulnerable. Whilst individuals personal or financial data may be secure, other information that forms a part of the backup and recovery process, such as internal , often aren t. UNDERSTANDING FINANCIAL SERVICES Financial services is one of the most tightly regulated sectors in business. The FSA, the GDPR, PCI DSS and Euro Sox all have implications for the security of information in transit. Senetas has been working with our European resellers and OEM partners to deliver encryption solutions to the financial services sector for more than a decade. During this time we have helped secure WAN and data centre infrastructures for a variety of banks, trading houses and asset management companies. A financial institutions responsibility to data security doesn t end at the front door. They are also responsible for the data when it is shared with a third party. No matter how secure your internal policies and practices, once your data is traversing the public network, it s vulnerable. SENETAS SENETA SENETAS Senetas

3 WHY ENCRYPT? The rapid growth of virtualisation, data centre and Cloud computing technologies means we are becoming increasingly reliant on our high-speed/high-availability data networks to deliver information when and where we need it. Cyber-crime in the form of hacking, corporate espionage and even cyber terrorism, is on the rise. Information security threats remain commonplace and there is an increasing emphasis on organisations of all types to ensure the integrity and security of their data, both at rest and in motion. We cannot rely on the assumption that our data remains secure within the perimeter of the office environment. All organisations share systems and information that rely upon common network access and most modern businesses comprise multiple offices, some separated by a few yards, others by thousands of miles. High-speed access is also an essential part of business continuity as it enables a robust backup and disaster recovery strategy. Gemalto s breach level index is an online record of data breach incidents and reveals over 3.7 billion records have been lost since Whilst lost data accounts for almost one quarter of all breaches, more than half (56%) are the result of malicious activity by an individual or group originating outside your organisation. Financial data is a prime target for theft, with retail and financial institutions being hit hardest of all. High profile breaches targeting financial data at JP Morgan Chase, Home Depot, Target, Adobe, HSBC, Carphone Warehouse and others have hit the headlines over the past couple of years. Banking and financial services are amongst the most tightly regulated industries. The sensitive nature of the data held at rest and transmitted across their networks places an emphasis on IT security. However, the time-sensitive nature of transactional data means that any stringent data security policies, procedures or technologies cannot come with an additional network overhead. When dealing with large scale transactions, every nanosecond counts. These exacting standards require highperformance, low-latency solutions to ensure security, availability and profitability. NETWORK VULNERABILITY Fibre-optic cables are used to transport Petabytes of data across private and public networks every day. Although still considered the fastest and most reliable method of moving data, Fibre networks have become increasingly vulnerable as hacking technologies become less expensive and more readily available. There is a common misconception within many organisations that a robust firewall is enough to prevent unwanted access to their network; unfortunately this is not the case. Whilst the firewall can detect and eliminate a variety of penetration or denial of service attacks, it is no protection against a physical tap either inside or outside the firewall. HIGH-PERFORMANCE, LOW-LATENCY SOLUTIONS Senetas has a legacy of designing and developing solutions tailored to the specific requirements of the global banking and financial services industry. Our state-of-theart high-assurance encryption solutions allow organisations to remotely provision and manage global WAN security as easily as they would their LAN or data centre connections. Our solutions are amongst the most rigorously tested and certified in the world, meeting the internationally recognised standards of FIPS, Common Criteria, CAPS and NATO; ensuring both physical security and best-practice encryption key management. Provisioning and management of encryption devices, either locally or remotely, is quick and easy. Set and forget functionality means minimal ongoing maintenance and advanced monitoring tools allow for real-time alerts or reporting for audits, compliance and forensics. It is alarming that there appear to be many organisations out there who are not aware of, and do not agree on, the ever increasing ease at which fibre optic cables can be attacked. - SANS INSTITUTE

4 CHOOSING THE OPTIMAL ENCRYPTION SOLUTION Due to a lack of vendor compatibility in network encryption, organisations need to find a vendor that offers a complete range of products; one that is able to cover all their Layer 2 network encryption needs and provide 100% compatibility for all protocols and topologies. Despite the obvious variation in customer requirements, one thing is certain today - if you are serious about protecting data networks; any encryption solution less than high-assurance is a wasted investment. There are many encryption solutions on offer; but only a very small number that offer highassurance considerations, such as: PERFORMANCE Adding a network encryption interface card to an existing switch will appear attractive, however there will be a higher latency and lower throughput performance than a dedicated Layer 2 encryption device. This is especially relevant in high-speed data centre and disaster recovery links running at gigabit speeds over fibre, transmitting small packets such as voice and video. CERTIFICATION Many switch and encryption vendors are not approved to encryption standards such as Common Criteria, NATO or FIPS. Senetas encryptors are independently tested and accredited by the world s leading testing authorities and offer the only multi-certified encryption solution. WHY HIGH-ASSURANCE? To be considered a highassurance encryptor, it must: be a secure dedicated hardware device; enable end-to-end encryption; use state-of-the-art Encryption Key Management and hold international certification. LIFESPAN If a network encryption interface card (NIC) is used, the lifespan of the encryptor will be tied to the host network device and will need to be replaced when the switch is changed. MANAGEMENT In some instances, using an NIC will mean the same switch vendor is needed through the network route and will result in the data being decrypted and re-encrypted at each of the hops. This is a potential security risk and will be a major key management issue. Dedicated appliances will enable the data to be encrypted the whole route, irrespective of switch vendor.

5 LAYER 2 VS. LAYER 3 The 7-layer network model defines the stages of the process involved in transmitting data across a network. If your data is traversing a geographically diverse public or private network it is inherently insecure this is as true for optical fibre networks as it is for other types of wired or wireless network. Given this, the question isn t whether or not encryption should be used, rather which approach to encryption offers the most secure and efficient solution. When it comes to encryption of data traversing your network, there are a number of options available. Including: > End-to-end encryption within applications > SSL, Layer 4 encryption > IPSec Standard, Layer 3 encryption > Layer 2 encryption BENEFITS OF LAYER 2 ENCRYPTION Layer 2 encryption is often referred to as bump in the wire technology. The phrase conveys the simplicity, ease of maintenance and performance benefits of Layer 2 solutions that are designed to be transparent to end users with little or no impact on network performance. In a recent study by the Rochester Institute of Technology (RIT), it was determined that Layer 2 encryption technologies provide superior throughput and far lower latency than IPSec VPNs, which operate at Layer 3. The study concludes: The challenge lies in maintaining the performance and simplicity of a high-speed network whilst assuring the security and privacy of network traffic, whether voice, data or video. It is generally accepted that the lower the layer, the more comprehensive the encryption and the more efficient the process. Layer 2 and Layer 3 encryption work in different ways. Layer 3 encryption devices are designed for IPSec encryption and to encrypt IP payload. IPSec tunnels the original IP packet in order to encrypt the IP header. Tunnels can result in an increase in overhead, complexity and, subsequently, processing time. If you want to encrypt an Ethernet frame, the encryptor has to first do some heavy lifting to bring the frame up to layer 3. By comparison Layer 2 encryptors are optimised for Ethernet and MPLS and don t need to tunnel the original IP packets in order to encrypt, resulting in a more efficient process.

6 AN INCREASE IN HIGH-PROFILE DATA BREACHES HIGHLIGHTS THE NEED FOR HIGH-ASSURANCE ENCRYPTION SOLUTIONS. When it comes to network encryption security, there are two basic grades - high-assurance and low-assurance. High-assurance solutions are those typically demanded by government agencies and corporations transmitting sensitive or confidential date. Robust network encryption solutions have been available for a number of decades and governments around the world have been their largest single beneficiary. The level of data sensitivity usually mandates that any solution is required to have certified encryption components. High-assurance solutions are commonly known as robust encryption. To be truly robust or high-assurance, an encryption security product requires five key features: > Secure, dedicated encryption hardware > Certification as being suitable for government and defence use by a recognised authority (e.g Common Criteria, FIPS, NATO or CESG). > Standards-based encryption algorithm (e.g AES256). > Client-side encryption key management, where encrypted keys are encrypted and securely stored and only accessible by the client. > True end-to-end encryption, where there is no point in the network, or link, where un-encrypted data is accessible. There are numerous encryption solutions available today; both hardware and softwarebased. Some are designed specifically to protect static data at rest. Others are designed to protect data in motion as it travels across high-speed local and wide area networks. In fact, it was governments demand for robust encryption that triggered many vendors to invest in developing encryption technology in the first place. An essential component of so-called unbreakable encryption is that the encryption keys themselves should not be accessible to anyone but the owners of the encrypted data. If the encrypted encryption keys are securely stored client-side, no matter what type of breach occurs, unauthorised parties can only access the data in its encrypted form. DON T LEAVE THE KEYS UNDER THE MAT True to the saying: Never leave the keys under the mat, the same advice applies to network data encryption. When encryption keys are exposed to access by unauthorised parties, the solution is greatly weakened. It is no longer a robust (high-assurance) security solution. As the robust encryption solutions is also providing true end-to-end encryption security, there is no weak point. Even if a router or switch (as is frequently the case) is found to have weak-points or vulnerabilities to attacks, highassurance encryption ensures the data passing through those vulnerable devices is safe.

7 QUANTUM KEY DISTRIBUTION Quantum Key Distribution (QKD) is a technology that relies upon two fundamental principles of quantum physics to generate encryption keys. Firstly, that the generation of the quantum key is truly random and secondly, that any attempt to interrupt or eavesdrop on the encrypted data will disturb the system and be detected. Unlike classical encryption key generation, which is based on mathematical algorithms, QKD will not become compromised as computing power increases. More importantly, it is not vulnerable to passive attacks, where data is captured for subsequent decryption. Passive attacks are potentially the most dangerous for financial services organisations as they often go un-detected until the data has been decrypted and the consequences felt by the business. In a passive attack, data is typically copied or captured and stored offline for future decryption either through brute force attacks or when current PKS algorithms are broken. Data such as customers financial, credit card or personal details have long-term relevance for identity theft or fraud, so longer-term protection is essential. The Senetas and QKD integrated solution has been successfully deployed in a number of major European financial institutions, providing forward-secrecy for the most sensitive longterm data. Whilst the current state of the technology is limited in terms of distance, banks and asset management companies are utilising QKD to secure 10GB Ethernet connections, as a part of their back-up and business continuity strategies, to disaster recovery sites up to 100km away. Outside of real-life applications, QKD has been successfully demonstrated in laboratory conditions over distances as great as 300km. However, the future of long-distance QKD is likely to come in the form of satellite-based key exchange, with low-orbit communications satellites transmitting keys securely to a network of terrestrial base-stations. Why Quantum Key Distribution? QKD solutions provide the ultimate in quantum-safe security for long-term data protection. By harnessing the power of quantum mechanics, QKD ensures a provably secure key exchange, alerting to any potential eavesdropping, as well as providing forward secrecy of the encryption keys.

8 SENETAS LAYER 2 ENCRYPTORS The Senetas CN range of encryptors provide government and enterprise organisations with simple to deploy, low maintenance solutions to secure data traversing both public and private networks. The latest CN6000 series encryptors support both AC and DC hot-swappable PSUs and provide full line rate transparent encryption of either Ethernet networks in point-point, hub & spoke or meshed environments OR point-to-point Fibre Channel networks at up to 10Gbps. Senetas Layer 2 carrier ethernet WAN and MAN encryptors support all protocols and topologies.

9 What makes Senetas encryptors stand out from the crowd? Security without compromise! Senetas encryptors leading performance is not limited to their maximum data protection without loss of network performance. Best Performance HIGH-SPEED The designed-in, market-leading performance capabilities of Senetas encryptors are what make them stand out from the crowd. Whether operating at full line-rate 10Mbps, 100Mbps, 1Gbps or 10Gbps; time after time, they consistently win competitive performance tests. Their encryption speeds, near-zero data overhead and near-zero latency make Senetas encryptors ideally suited to the most demanding network environments. NEAR-ZERO LATENCY Senetas high-speed encryptors operate in full-duplex mode at full line speed without loss of packets. Latency is not affected by packet size (<3 microseconds per unit at 10Gbps), meaning maximum throughput with zero protocol overhead. Importantly, by using Field Programmable Gate Array (FPGA) technology, this outstanding performance is predictable and dependable. High-Assurance > Secure, tamper-proof hardware; dedicated to network data encryption > State-of-the-art, embedded, automatic zero-touch key management > End-to-end, authenticated encryption > Standards-based encryption algorithms BEST ENCRYPTION KEY MANAGEMENT All Senetas products adopt zero-touch, stateof-the-art encryption key management. Your encryption keys are only ever held by and accessible to you, on your premises; securely stored and encrypted. SOLUTION INTEGRITY Senetas encryptors provide maximum solution integrity; unlike low assurance solutions, such as router-based network data encryption or so called hybrid encryptors with embedded encryption. ZERO IMPACT The zero impact of Senetas encryptors is not limited to network bandwidth and latency; it extends to network operations and management. They simply fit in within the user network. They don t require changes to other devices or network reorganisation; making them a favourite among network engineers.

10 Versatile & Simple SUPPORT FOR ALL PROTOCOLS The Senetas CN range of encryptors provides the widest feature-set. Able to operate at 10Mbps to 10Gbps plus, they are designed for Layer 2 Carrier Ethernet WAN and MAN networks and support all Layer 2 protocols: Ethernet, Fibre Channel; SONET/SDH and LINK. SUPPORT FOR ALL TOPOLOGIES Senetas CN encryptors operate in multi-point to multi-point, meshed, single-point to multipoint and single-point to single-point network topologies. Whether the network topology is simple or complex, the same high-assurance benefits apply. EASY TO INSTALL The bump in the Wire design of Senetas CN encryptors makes them easy to install. Simply place the encryptor at the access point to the Layer 2 network and all data passing through the unit is encrypted. EASE OF USE Set and forget simplicity and transparency are underlying Senetas design themes. They ensure ease of implementation, operation and management. Crypto-Agility Cryptographic protocols and algorithms evolve over time to counter new security threats that s why Senetas encryptors are designed to be crypto-agile out of the box. They provide extra assurance that your investment keeps pace with cryptographic advances. CUSTOM ENCRYPTION In addition to the standards-based AES256 bit algorithm, Senetas CN encryptors may be implemented with customized, customer requested algorithms. Designed-in encryption agility enables the use of custom curves (BYOC) and entropy (BYOE). QUANTUM-READY Selected Senetas encryptors also support Quantum Key Distribution (quantum cryptography) and quantum random number generation, making them quantum safe Cryptographic protocols and algorithms evolve over time to counter new security threats that s why Senetas encryptors are designed to be crypto-agile out of the box. They provide extra assurance that your investment keeps pace with cryptographic advances. That simplicity continues with an intuitive user interface, providing meaningful diagnostics, such as early warnings and simple fault-finding. INTEROPERABILITY Senetas encryptors supporting the same Layer 2 network protocol are fully interoperable. All Senetas CN models are backward compatible. They may be relocated to other duties and newer models added over time to suit your changing needs; without becoming technically redundant. LOCAL OR CENTRALISED MANAGEMENT Configuration may be performed locally or remotely through the intuitive Senetas CM7 management software; which acts as the Certificate Authority in a network of encryptors by signing and distributing X.509 certificates.

11 Low cost, high efficiency TCO and ROI are proven financial decisionmaking aids for investments and expenditure. In data security and network data protection, specific financial measures vary in use-case examples and are dependent upon many factors, including: organisations cost structures, preferences and investment decisions. Because all Senetas CN encryptors operate at full line speed; enable maximum network performance and deliver set and forget management simplicity; they provide low-cost and high efficiency. The business investment case out-performs even cheap and cheerful low-assurance solutions. It is not necessary, nor beneficial, to opt for low-cost, low-assurance solutions to meet the toughest business case requirements. Globally Certified Senetas high-assurance network data encryptors provide state-of-the-art cryptography - meeting the broadest range of international encryption certification standards. Because Senetas encryptors include the only multi-certified products of their types, they are trusted by governments and defence forces around the world. Rigorous testing is carried out over many years and provides our government and commercial customers with maximum assurance. Senetas encryptors are certified by: FIPS, Common Criteria and NATO. COST-EFFICIENCY Senetas encryptors provide excellent total cost of ownership through a mix of network bandwidth savings, ease of network management and reliability. Longevity, interoperability, backward compatibility, minimal installation and management costs and solution flexibility all contribute to a rapid return on investment. Other cost benefits include, low power consumption minimal rack space use and combined rack space/power utilisation efficiency. RELIABILITY Senetas CN encryptors provide reliable % up-time and conform to international requirements for safety and environment. All carrier-grade, rack mounted Senetas encryptors are hot-swappable and provide further network operations up-time benefits thanks to dual redundancy of encryptor consumables. FLEXIBILITY Senetas encryptors use of FPGA technology enables maximum operational flexibility. They are better able to meet customers specific requirements and provide an optimised highspeed data encryption solution. This flexibility enables ongoing operational simplicity, such as infield upgradability, as customers requirements change; helping to protect their investment in technology. R&D COMMITMENT Senetas s market-leading high-assurance encryption results from our commitment to research and development; to independent international testing certifications and highspeed encryption advances, such as support for Quantum Key Distribution.

12 GLOBAL SUPPORT AND DISTRIBUTION Senetas high-assurance encryptors are supported and distributed globally (excl. AUS & NZ) by Gemalto the world s largest data security company - under its SafeNet Identity and Data Protection Solutions brand. Gemalto also provides pre-sales technical support to hundreds of accredited partners around the world; including systems integrators, data network providers, cloud and data centre service providers, telecommunications companies and network security specialists. TALK TO SENETAS OR OUR PARTNERS Senetas and Gemalto also work with customers own data network service providers, systems integrators and information security specialists to specify the optimal high-assurance encryption solution for their needs. Wherever you are, simply contact Senetas or Gemalto to discuss your needs. Or, if you prefer, your service provider may contact Senetas or Gemalto on your behalf. CERTIFIED HIGH- ASSURANCE NETWORK DATA ENCRYPTION SENETAS CORPORATION LIMITED E info@senetas.com Senetas manufactures high-assurance Layer 2 Metro Area and Carrier Ethernet network encryptors. They support all Layer 2 protocols and topologies. Our multi-certified encryptors are used by some of the world s most secure organisations; including governments and defence forces, commercial and industrial enterprises, Cloud, data centre and telecommunications service providers in more than 40 countries. Whatever your Layer 2 Ethernet network security needs, Senetas has a high-assurance solution to suit. They support data network links from modest 10Mbps and 100Mbps to high speed 1Gbps and 10Gbps as well as 10 x 10Gbps and ultra-fast 100Gbps bandwidth. Certified, scalable, agile and easy to use; Senetas high-assurance encryptors provide maximum data security without compromising network performance. SafeNet CN Series Ethernet encryptors GEMALTO DISTRIBUTION & SUPPORT Securing Financial Services CN Ethernet Data Encryptors. Senetas CN Series certified high-assurance network encryptors are distributed and supported internationally by Gemalto (North America, Europe, Asia, Middle East and Africa) as SafeNet FINNDS-SP0717