IDS Forum

Re: Encryption

Posted By: Fernando Nunes
Date: Thursday, 21 August 2014, at 1:30 p.m.

In Response To: Re: Encryption (MARK JALKIEWICZ)

Been there... usually in the end they give it up and use "risk mitigating
measures" as they are called in PCI and other regulations. Let's see...

Informix as you say can only encrypt data at column level and that has some
issues:
1- You need the application to handle the key (unless you do very weird
things like obtaining the key from a keystore using some Java inside a
sysdbopen() procedure that validates the origin etc.). But to be more
secure, the application would have to do that, and many times that "can't
be changed"
2- We have a terrible problem... because the encryption may (and will)
"enlarge" the data in a manner that isn't 100% known at definition time,
and because we INSERT anyway without error in non ANSI databases, we may
end up corrupting data... and being encrypted it becomes 100% useless...
There are feature request to allow this behavior change, but either our
customers don't care, or they don't shout loud enough... This should be a
trivial fix as we already do it for ANSI databases
3- The encrypted columns can't be indexed.... I've been told this doesn't
happen for example on DB2 on z/OS, because value X encrypted using key Y
will always give value Z. So if you just want to use equality matches you
can encrypt X and search for Z... this will use an index on Z. But in
Informix a value X encrypted with key Y will give value Z now, Z1 the next
time and so on...

IBM resells a wonderful product for transparent data encryption. We call it
Guardium Encryption Expert.... originally it's from a company called
Vormetric. It's not expensive and works at the OS level.... it works with
raw devices and cooked files. It has an option for integration with
database (db2 and Informix at least) backup utilities.

This will encrypt the datafiles in a transparent way for the (authorized)
layers. The authorization is provided to a process/user/timeframe mask...
"informix using oninit..."
It makes sure the data can only be accessd through the "natural" means. It
does not prevent against DBA abuse, but you have native audit (or Guardium
DAM) for that.

The product is very easy to use, and as far as I'm told, has very little
overhead in the latest versions (some is explected of course).
if you just want to encrypt a table put it on a specific dbspace and
encrypt just those datafiles. No changes in the database or application.

For informix encryption, if you want to do it transparently.... you need
the application to set the encryption password at the session level and
then mess around with views... and triggers. But you're going to meet the
issues above.

HTH
Regards

On Thu, Aug 21, 2014 at 4:51 PM, MARK JALKIEWICZ <
mark.jalkiewicz@verizon.net> wrote:

> it's a bank, a major one at that. Paranoia trumps all.
>
> Mark
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

--20cf303bf57636d42905012714cb

Messages In This Thread

• Encryption
  MARK JALKIEWICZ -- Thursday, 21 August 2014, at 11:41 a.m.
  • Re: Encryption
    Spokey Wheeler -- Thursday, 21 August 2014, at 11:45 a.m.
    • Re: Encryption
      MARK JALKIEWICZ -- Thursday, 21 August 2014, at 11:51 a.m.
      • Re: Encryption
        Spokey Wheeler -- Thursday, 21 August 2014, at 12:39 p.m.
      • Re: Encryption
        Fernando Nunes -- Thursday, 21 August 2014, at 1:30 p.m.
        • Re: Encryption
          MARK JALKIEWICZ -- Thursday, 21 August 2014, at 2:06 p.m.
          • Re: Encryption
            Fernando Nunes -- Thursday, 21 August 2014, at 3:12 p.m.
            • Re: Encryption
              MARK JALKIEWICZ -- Thursday, 21 August 2014, at 3:43 p.m.
          • Re: Encryption
            Mark Jamison -- Thursday, 21 August 2014, at 3:49 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.