Story image

Micro Focus: How to reduce the cost of data security

10 May 2019

No information technology process is free.

There is always a cost; if not to the service consumer, then most definitely to the service provider. Data protection in the form of either encryption or tokenisation is no exception.

When these technologies are added to an existing IT process, costs go up, according to Micro Focus.

These can be direct costs, in the form of acquiring more equipment or software licences or spending more on operational costs, such as power and staff.

Or the costs can be indirect, for example, taking more time to complete an IT process as data protection is CPU-intensive.

While each data protection operation takes microseconds, in a large organisation protecting petabytes of data, these all add up.

Micro Focus Australia and New Zealand enterprise security platforms director George Atrash says,  “The question then becomes how organisations can mitigate these direct and indirect costs. The answer is by reducing the number of times a data protection IT process needs to run.

“This can be done by protecting data at the application level, avoiding decryption when possible, and reducing the life cycle key management cost.”

One of the benefits of protecting data at the application level is protection can be applied only once. Persistent and pervasive data benefits most from application-level protection as the data need not be protected and re-identified when it moves throughout the enterprise.

This avoids security gaps, as well as the cost of repeated protect/unprotect cycles.

So, while application-level data protection may cost more during deployment, this method has lower operational cost.

Atrash says, “This means that one method of reducing cost and increasing overall system performance is avoiding unnecessary protection.

“The second method is to avoid unnecessary re-identification, decryption, or de-tokenisation whenever possible.”

Data protection is a function with an inverse: protect something and get exactly one unique output. Re-identify that output and always receive the original input.

The relational integrity is maintained and relational algebra on the protected data can be performed without spending the cost or time to first re-identify that data.

The ability to avoid re-identification can be taken further via the concept of partial protection.

Partial protection avoids the cost and increases performance beyond that of full protection by removing data sensitivity while still allowing more types of authorised use. 

The third method that can be used to reduce cost and increase performance is employing stateless key management.

Encryption requires the use of a security key for every different access policy.

And, there are often thousands of granular access policies running within an enterprise.

Stateless key managers generate encryption keys for authenticated users on demand.

If a user needs a key that protected data 10 years ago, a stateless key manager has no trouble delivering that key today.

And, stateless key managers do not have an upper limit on the number of keys that may be in use at any point in time.

If an enterprise needs 10 million keys to protect its Internet of Things, a stateless key manager can handle the load.

And a stateless key manager integrates with existing directory authentication services, avoiding the need for dedicated staff.

Atrash adds, “Organisations should keep in mind that judicious use of data security does reduce its cost and increase its performance.

"Avoiding re-identification, employing partial protection, and focusing on key management cost of ownership are long-term methods for efficient implementation of a data security practice.”

Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
NZ businesses are leaving themselves vulnerable to cyber threats
Barely six per cent of business and companies in New Zealand have adequate cyber protection.
InPhySec forges partnership to tackle NZ cybersecurity market
The Kiwi managed security services provider is partnering with CrowdStrike to bring its endpoint protection solution to its customers.
Infoblox appoints channels head for A/NZ
Kenneth Cartwright’s appointment extends Infoblox’s position in secure cloud-managed network services throughout the region.
Chch crypto exchange Cryptopia facing liquidation
It seems that Christchurch-based cryptocurrency exchange Cryptopia has been unable to recover after malicious cyber attackers stole around $20 million worth of cryptocurrency.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.