cpl.thalesgroup.

com

CipherTrust Live Data Transformation

Zero-Downtime Encryption and
Key Rotation

Apply encryption and access Users

controls to files, volumes and
Hadoop environments without
taking applications offline
• Meet compliance requirements for encryption and access
control without taking applications offline
• Expand encryption implementations with minimal impact on
application operations and users
• Reduce the impact and cost of implementing encryption by <Encrypted>
eliminating encryption and rekeying downtime
• Accelerate recovery of data encrypted with older keys
<Encrypted>
The challenge: implementing and <Unencrypted>
maintaining encryption with minimal
application impact <Unencrypted>
In the face of escalating threats and compliance mandates, data CipherTrust Live
encryption has become a best practice component integral to Data Transformation
layered IT security strategies. For many, two critical barriers to the
adoption of encryption with existing databases, files, and big data Database Server
implementations have been:
A database protected with CipherTrust Transparent Encryption and
Live Data Transformation enables non-disruptive initial encryption
and simplified, more-compliant encryption key rotations. Users
continue to work as usual while encryption is in process.
• Initial encryption time. With a large dataset, the process of Key features
initially converting from clear-data text to ciphertext has typically
meant that applications using the data must be taken off-line CipherTrust Transparent Encryption agents operate on Windows
during the initial conversion process. Even when state-of-the- and Linux servers that store or access any data that needs to be
art cloning and synchronization techniques are used, there is secured and controlled. CipherTrust Live Data Transformation
substantial downtime. For mission critical applications required is enabled in the CipherTrust Manager by applying a license
to run with “five nines” of uptime, this can result in failure to meet for each agent on which it will operate. CipherTrust Live Data
SLAs, operational disruptions, and loss of revenue. Transformation licenses can be enabled at any time, at which point
users can secure their mission-critical data without any disruption or
• Downtime caused by re-keying of data sets. Best practices
and compliance regimes frequently require encrypted data maintenance windows.
be re-keyed with a new encryption key at specified intervals. Live Data Transformation includes features to assure that its
This operation typically requires a large maintenance window, operation is transparent to users and applications independent of
and results in the same disruption level as initially encrypting the the size and scale of the deployment:
data. The result is IT, compliance, and security teams face tough
decisions about the balance between security, availability, • CPU resource management. Encrypting large data sets can
uptime, and levels of compliance. require significant CPU resources for an extended time. Live
Data Transformation provides sophisticated CPU management
The solution: CipherTrust Live rules to enable administrators to balance resources between
encryption and other CPU operations upon which users
Data Transformation extension for depend. For example, a resource management rule can define
CipherTrust Transparent Encryption that, during business hours, encryption can consume up to 10%
of system CPU, reserving the balance of 90% for users. Then,
Customers have relied on CipherTrust Transparent Encryption for
the rule can define that on nights and weekends, encryption can
over a decade. It eliminates many of the challenges associated with
consume 70%, when there are lower user demands on CPU
implementing encryption in an enterprise. CipherTrust Transparent
resources. And encryption and re-keying processes can be
Encryption breaks down data security silos, encrypts both structured
manually paused and resumed as desired.
databases and unstructured files, centralizes key management
across the enterprise, and provides privileged user access controls • Versioned backups and archives. With key versioning
and detailed data access audit logs that integrate with major management, CipherTrust Live Data Transformation ensures
Security Information and Event Management (SIEM) systems. efficient backup and archive recovery to enable more
immediate access. In a data recovery operation, archived
CipherTrust Transparent Encryption operates with minimal encryption keys, recovered from the CipherTrust Manager, are
disruption, effort, and cost. Its transparent architecture enables automatically applied to an older data set. Restored data is
security organizations to implement encryption without changing encrypted with the current cryptographic keys.
application, networking, or storage architectures. • Resiliency. By storing encryption metadata with the target files
or database volumes, CipherTrust Live Data Transformation is
CipherTrust Live Data Transformation builds on these advantages, resilient in the face of storage failures, system issues, or network
offering patented capabilities that deliver breakthroughs in downtime. Any interrupted encryption process will seamlessly
availability, resilience, and efficiency. recover without having to have the entire process restarted. This
architecture ensures that data is never corrupted, no matter how,
Delivering patented capabilities for when, or where a failure occurs, and, scales with the size of the
file system, rather than being limited by design.
deploying and maintaining encryption
without downtime About Thales
The people you rely on to protect your privacy rely on Thales to
• Zero-downtime encryption deployments. CipherTrust Live protect their data. When it comes to data security, organizations are
Data Transformation enables administrators to encrypt data
faced with an increasing number of decisive moments. Whether the
without downtime or any disruption to users, applications, or
moment is building an encryption strategy, moving to the cloud, or
workflows. A database or file system can be used normally,
meeting compliance mandates, you can rely on Thales to secure
including powerful access controls and logging capabilities,
your digital transformation.
while it is undergoing encryption.
• Seamless, non-disruptive key rotation. To address Decisive technology for decisive moments.
© Thales - August 2020• LB. v4

compliance requirements and best practices, Live Data

Transformation enables organizations to perform key
rotation without having to duplicate data or take associated
applications offline.

> cpl.thalesgroup.com <

Contact us – For all office locations and contact information, please visit cpl.thalesgroup.com/contact-us