Project Quant: Database Security - Encryption

There are several forms of encryption that can encrypt the contents of the database. Each is unique in its level of security, ease of deployment, cost, and performance impact on transaction processing -- making the selection process difficult. Further, security and compliance requirements pertaining to encryption are often murky. They key to this process is understanding the requirements and mapping them to the available technologies. The Evaluate phase is commonly the most time consuming if you are working with compliance requirements.

Pay close attention to operations and integration efforts to ensure no hidden are obstacles discovered after deployment. For example, such as finding that tape archiving no longer works, or that user account recovery fails to recover encrypted data. This type of thing is common, so we've included it in the process.

Evaluate

• Time to confirm data security & compliance requirements. Gather requirements and have a complete understanding of why you are encrypting the database, and the objectives to be met.
• Time to identify encryption method/tools. Select encryption method (database internal, file/OS, disk, etc.) that fully addresses requirements. Identify the tools or products required.
• Time to identify integration requirements. Understand key management, archiving, and password and disaster recovery requirements; determine what integration work is needed.

Acquire

• Variable: time to evaluate encryption tools/products. Select vendors, bring in products, and evaluate in terms of requirements.
• Optional: cost to acquire encryption. If the selected encryption solution is not already available, factor in its additional cost.
• Optional: cost to acquire key management. If key management is external to the database and not already purchased, factor in the additional cost of the product.
• Variable: costs for maintenance, licensing, or support services.

Test & Approve

• Time to establish test environment. Verify product in pre-deployment environment.
• Optional: time to archive database and verify. Create system backups and verify.
• Time to install and configure the encryption tool, including (if needed) any key management integration and user accounts for testing.
• Time to test. Time to complete functional testing and operations assurance.
• Optional: time to establish disaster recovery procedures. Encryption based on external key services, or external to the database, requires additional disaster recovery preparation. Verify your disaster recovery process is updated and required resources are allocated.
• Time to collect sign-offs and approval.

Deploy & Integrate

• Time to install encryption engine in production.
• Time to install key management server (if used) and generate keys. Generate master key pairs and database encryption keys, and distribute.
• Time to deploy, encrypt data, and set up user authorization.
• Time to integrate with applications, backups, and authentication. Verify that operational processes are still viable. Perform required application functional tests.

Document

• Time to document. Record requirements and changes to operational policies.

—Adrian Lane