How SIX uses data-centric security to protect sensitive financial data against misuse – including in distributed standard platforms, with cloud providers (IaaS, PaaS) and in cloud applications (SaaS).
Protecting sensitive financial data and ensuring compliance
SIX operates the infrastructure for the Swiss and Spanish financial centres, thereby securing the flow of information and money. As SIX works with sensitive and regulatory-relevant financial data, data security in the IT architecture is the top priority.
New forms of networking, the use of cloud-based offerings and the integration of modern operating concepts require a rethink of IT security. Conventional security measures at infrastructure level fall short of meeting today's and future requirements. The reasons are many:
Today, data also moves outside shielded network zones
The risk of data loss is increasing, and with it the importance of data loss prevention (DLP)
Data must be protected ‘at-rest’, ‘in-use’ and ‘in-transit’
SIX was looking for a strong partner with a sustainably secure solution that would meet the data security requirements with a suitable security concept and could be integrated into the existing IT architecture. According to Christian Stork, the project manager in charge at SIX, the solution must be highly scalable and support a diverse system landscape.
How is the sensitive data secured?
SIX opted for data-centric security and thus for a future-proof solution for users and infrastructure. SIX commissioned Prewen to integrate an enterprise encryption platform into the existing IT architecture.
With the universal solution, the data itself is encrypted and can continue to be used in all applications and databases. Nor does the protected data have to be decrypted and re-encrypted on its way between the various solutions. More security and more flexibility in data processing at the same time – Prewen's security concept won them over.
Who holds the key?
Of course, database and SaaS providers also offer their own encryption solutions. But Prewen goes one step further for SIX. All keys remain with the data owner. The system provider that encrypts the data has no access to them. This makes it possible to ensure the separation of powers between encryption and key. Neither internal database admins, system admins at the service providers nor operating staff at the SaaS providers can decrypt the data. Only the respective authorised persons have access to the data and can work with it as usual.
How was the enterprise encryption platform implemented for SIX?
The encryption platform used is Micro Focus Voltage SecureData, which was set up on site at SIX. Encryption formats, automated key management and authorisation are implemented in all the desired applications and databases with the help of the following integration tools:
API connection: used by applications that provide an API interface used for encryption
Web services connection: used by applications that send data to the central encryption service via web services (SOAP/REST)
xDBC integration: alternatively, the encryption service can be integrated directly by the application via a JDBC or ODBC driver.
Proxy integration: in addition, an interface was integrated to connect web applications (SaaS) such as ServiceNow or Atlassian to the encryption service via the ICAP protocol. This option is used when the application offers no direct means of access (e.g. via database or API) and only a web-based interface is therefore available as an integration point.
Why Prewen and the data-centric approach?
In the evaluation process, SIX Group opted for the data-centric approach and implementation by Prewen. The convincing reasons were:
1 Efficient set-up
2 One enterprise encryption platform for all applications
3 Highest availability of 99.999 per cent with redundancy in two data centres is ensured
4 Secure management of keys using dedicated hardware security modules (HSMs)
New approaches require change
Like any paradigm shift, the transition from conventional security measures at infrastructure level to data-centric security requires new ways of thinking and new processes. At the same time, such projects also involve challenges and lessons learned, both technical and psychological. The obligatory search for the data to be encrypted is routine for Prewen and a challenge that can be mastered well. A natural scepticism about relevant topics such as data security calls for an open exchange with users. In this respect in particular, every data security project is individual. This is because, despite convincing results, the data-centric security solution is still a relatively new method that requires many companies to rethink how they handle their data.
Learn more about data-centric protection or Prewen's data security offering.
Questions on this topic? We look forward to talking with you.
Get in touch