Solutions
Data-centric security
Protection that stays with the data – not at the perimeter.
Conventional security protects the path to the data – network, access points, perimeter.
Data-centric security protects the data itself. Sensitive values are encrypted in such a way that they remain useful to your applications but cannot be used by unauthorised parties.
Format stays
Encrypted values keep their structure and format. Databases, fields and interfaces keep running – usually without modification. Fields with check digits or strict validation rules can be exceptions.
Key sovereignty
With an installation on your premises, the keys remain in your own hardware security modules or, encrypted, in the SecureData Appliance in your protected zone. If we operate SecureData for you, the environment is located in Switzerland.
Role, not account
The role decides who sees what in plaintext – not technical access to the system.
‘For SIX, it was important that the systems managing the key material are secured to the maximum.’
Christian Stork
project manager in charge at SIX · Netzwoche 09/2021 (translated from German)
Who sees the plaintext while the system is running?
Disk and database encryption protect against theft of the disk, not against access during operation. As soon as the application is running, the data is available in plaintext – to the system, its operators and anyone who gains access at that point.
Full Disk Encryption · Self-Encrypting Drives · dm-crypt/LUKS · Transparent Data Encryption
The solution.
Data-centric security starts with the values themselves – not with the shell around them. Which route is the right one depends on one question: can the application be modified?
01
Application
If the application can be extended, it encrypts and decrypts values directly via an interface (Web Service / SecureData Simple API). The most direct route.
02
Proxy
If the application cannot be changed, an upstream service handles encryption and decryption in the data stream (ICAP) – without touching the code, provided an ICAP-capable proxy is in place.
03
Gateway
For API-based services, a gateway (Sentry API Protection Gateway) protects the sensitive fields in transit – for defined interfaces, not for arbitrary HTTPS traffic.
Data with the provider, keys in Swiss hands.
Use cloud and SaaS without giving up control. Key sovereignty stays in-house – with an installation on your premises. If we operate SecureData for you, the keys are held by Prewen, a Swiss-owned company headquartered in Switzerland. The provider processes the data but only sees it encrypted – plaintext only with key and authorisation.
Where protection applies.
Try it yourself.
See in a live example how a record is encrypted and still remains usable.
Why Prewen.
Partner of OpenText and Entrust
The solution is based on OpenText SecureData – format-preserving encryption and tokenisation.
Operation on your premises or ours
We operate SecureData on your premises or for you in our environment in Switzerland.
SIX Group and Swisscom
SIX Group and Swisscom rely on data-centric security from Prewen.
Common questions.
Does format-preserving encryption change our database structure?
Do we have to rebuild our applications?
Who sees the data in plaintext?
Does this work with cloud and SaaS?
Where are the keys held?
Is this Swiss technology?
Technology & partners
Prewen is a partner of OpenText and of Entrust. The solution is based on OpenText SecureData – format-preserving encryption and tokenisation.
Compliance
Data-centric encryption supports compliance with regulatory requirements such as FINMA (Swiss Financial Market Supervisory Authority), PCI DSS, the revised Swiss Federal Act on Data Protection (FADP) and the GDPR – as one building block, not as a guarantee of compliance.
Prewention