Abstract

http://ssrn.com/abstract=940287
 


 



Continuous Protection of Enterprise Data - A Comprehensive Approach


Ulf T. Mattsson


Protegrity Corp.

October 10, 2006


Abstract:     
Many consider the insider threat to represent the greatest vulnerability and exposure to enterprise resources. Database attacks are on the rise even as the risks of data breaches are increasing. Several industries must deal with legislation and regulation on data privacy. This paper will review how to protect sensitive data wherever the data resides: at application-level; within databases, files and operating systems; and in storage. We will address the management of associated encryption keys, access control and reporting - helping organizations mitigate risk and reduce costs, while protecting consumer, employee and partner information. The approach safeguards information by cryptographic protection from point-of-creation to point-of-deletion, to keep sensitive data locked down across applications, databases, and files - including ETL data loading tools, FTP processes and EDI data transfers. This design principle optimizes placement of functions for encryption and security enforcement among the modules of a distributed computer system. The guiding concept, continuous protection of data, suggests that encryption functions placed at low levels, and typically implemented with native platform-based toolkits, may be redundant and of little value when compared with the cost of supporting them at that low level. The principle suggests that Enterprise levels of Data Protection and Key Management may be cost effective in many configurations. We also include a set of best practices that ensure not only a successful PCI audit, but a sustained improvement in the security and protection of sensitive data, and the limiting of theft and its costly aftermath. We introduce a system-solution example that complies with these requirements and provides a cost-effective implementation.

Number of Pages in PDF File: 18

Keywords: Performance, Database Security, Encryption, Privacy, VISA CISP, GLBA, HIPAA, PCI

JEL Classification: O31

working papers series


Download This Paper

Date posted: October 26, 2006  

Suggested Citation

Mattsson, Ulf T., Continuous Protection of Enterprise Data - A Comprehensive Approach (October 10, 2006). Available at SSRN: http://ssrn.com/abstract=940287 or http://dx.doi.org/10.2139/ssrn.940287

Contact Information

Ulf T. Mattsson (Contact Author)
Protegrity Corp. ( email )
One Cantebury Green
Stamford, CT 06901
United States
HOME PAGE: http://www.ulfmattsson.com
Feedback to SSRN


Paper statistics
Abstract Views: 1,337
Downloads: 274
Download Rank: 63,374

© 2014 Social Science Electronic Publishing, Inc. All Rights Reserved.  FAQ   Terms of Use   Privacy Policy   Copyright   Contact Us
This page was processed by apollo7 in 0.218 seconds