As America’s oldest and largest healthcare services company, McKesson Corporation provides a broad range of pharmaceuticals, medical supplies and information technologies to customers in every segment of the industry. The publicly traded company achieved sales of $191 billion in 2016, making it the 5th largest company in the U.S. Business Challenge McKesson is subjected to an enormous number of regulatory standards for securing data found in every one of the segments in which it operates. Sabastian High, senior manager for Product Development Standards and Innovation at McKesson, commented, “We needed to identify an enterprise-wide solution for encryption and key management that could be easily deployed across our business units without impacting operations or security “An aspect that is of utmost importance to us is the responsiveness of a vendor’s tier-2 phone support and the resulting speed of escalation to engineering. Our requirements for resolving issues are pretty unique: If we’re doing encryption of data at rest for an application that is involved with supporting critical care activities, the notion of having a non- operational system is just unacceptable. It literally can be a life or death situation.” Technical Challenge McKesson has grown both organically and through acquisitions for 180 years. This very successful strategy has led to an accumulation of multiple disparate environments, technologies and data repositories spread through-out the company. High and his colleagues created a detailed set of criteria to identify and select the optimal solution for the McKesson environment. “We had a large number of technical specifications for our key management and encryption solution; the top factors were ease of deployment, the performance impact of doing encryption, the strength of key domain capabilities across disparate file systems and file system agnosticism.” Solution Following a multi-month research and evaluation period, High and his team selected Thales e-Security’s healthcare solutions. High noted, “Thales e-Security’s implementation – especially the total separation of roles within a domain model and the ability to consistently provide robust key management across disparate file systems – was the best we saw. “ “The Vormetric Data Security Platform also exceeded all of our acceptance criteria for problem identification and resolution responsiveness,” High continued. “Performance is a very critical factor for us. We conducted a proof of concept with several vendors’ solutions configured in parallel. We created a wide variety of scenarios, involving data warehousing, analytics, and informatics platforms: Vormetric consistently scored the highest marks. Every other encryption solution increased the file IO and data IO latency by a factor of 50 to 100. There was a really significant performance advantage using Vormetric when compared to the degradation we experienced with the other competitors. “I also appreciated Thales e-Security’s approach to encryption; I was never satisfied with the competitors’ strategies of encrypting individual tables or columns, both of which made no sense to us.” Technology solution provider, Williams & Garcia, was tasked to help refine the overall implementation and support models, as well as to coordinate the massive deployment across the McKesson environment. The Atlanta, Georgia-based company is responsible for actively managing key domain for each business unit and providing ongoing operational maintenance and support. Results Since beginning the enterprise-wide deployment, reliability of the Vormetric solutions has been impeccable. High described, “We’ve never had a Vormetric Data Security Manager appliance fail, or even falter. Agent reliability has been equally flawless.” He continued, “The separation of key operators, key creator, policy, administrator, access controls, and the separation of duties model are all truly military grade; and I have a lot of experience in this field!” The Vormetric solution provides full coverage of all regulated data throughout the McKesson infrastructure, including facilitating compliance with the HIPAA HITECH Act, PCI DSS, FDA and EPCS (Electronic Prescriptions for Controlled Substances) mandates. “The flexibility of our Vormetric solution gives us an enterprisewide capability that enables business units to implement a service and support model that exactly works for them. We’ve been able use the Vormetric platform as the vehicle to implement robust key management practices that support corporate policies across the company, no other vendor can compete with the Thales e-Security model; we love the technology,” concluded High. Business Need Identify enterprise-wide solution for encryption and key management Zero permissible impact on operations, security and service delivery Technology Need Nominal performance impact ofdoing encryption Industry-leading key domain capabilities File system agnosticism Solution Healthcare Solutions from Thales e-Security Vormetric Transparent Data Encryption Vormetric Key Management Vormetric Data Security Manager Result Impeccable reliability and performance Policy and regulatory mandates implemented across diverse infrastructure Military grade key management capabilities About Thales eSecurity Thales e-Security is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales e-Security is part of Thales Group

With an estimated 3.2 billion people using the Internet daily, the importance of cybersecurity and encryption of personal data has become increasingly critical, especially for any organization involved in the financial services sector. Monaco-based Planet of finance, an institution founded by a core group of highly credentialed banking executives, attaches extreme importance to all matters relating to security. Created in 2015, Planet of finance is the leading platform for investors. With a goal of digitizing the financial world, the company has established a dynamic platform focused on building long-lasting connections among both wealth management executives and individual high-net worth investors. Business Challenge With members in 81 countries, Planet of finance professional members collectively manage USD 15 trillion of assets. The platform delivers multiple benefits, including providing industry members with the ability to network, connect with investors and raise money. Private investors are empowered to locate and compare services that are exactly tailored to their own unique blend of requirements. One of the differentiators behind the success of Planet of finance is its unique philosophy around the ownership of personal data. Alain Broyon, partner of Planet of finance described, “A person’s information is clearly their own property but we strongly assert that this data has inherent value. If they elect to share this with, for example, a family office, then there should be appropriate compensation that recognizes the intrinsic value in the information they have provided. The family office benefits from the data, so why shouldn’t the owner!” He continued, “Our profession has always assigned the utmost importance to data security but for Planet of finance the concept of apportioning additional value to data shared with a thirdparty takes things to an even higher level. Our goal from the very beginning has been to secure our clients’ information while enabling them to remain in control of how they share it. To deliver on the trust that our customers place in us, our approach is to implement the strongest, most robust technologies available. Technical Challenge As with all companies in the financial services sector, Planet of finance is subjected to a wide range of industry, regional and global regulatory requirements, including the General Data Protection Regulation (GDPR), mandated by the European Union. Broyon explained the implications, “As ours is a global platform it was crucial to find a solution that automatically secured our data in a way that placed us in compliance with all prevailing laws and rulings but that didn’t need constant checking and adjustment.” With Planet of finance’s aggressive growth objectives, the company sought a security solution that would scale quickly, remain flexible, and provide impenetrable security to their clients. Xiaochen Guo, head of IT at Planet of finance, elaborated, “To give us the agility we need, our infrastructure is almost entirely cloud-based. This immediately eliminated many of the traditional methods used to protect information.” Solution “We did a lot of research and decided that encryption would be the optimal approach for us,” stated Guo. “We had indepth discussions with the local Thales team and they really understood what we wanted to achieve. They were very collaborative and we felt very comfortable that Thales could offer the right solution to meet all of our requirements.” The Planet of finance team selected Vormetric Application Encryption by Thales to protect the organization’s data. “The Thales solution is architected in a way that delivers the level of security sophistication we need, but without adding unnecessary complexity or overhead,” observed Guo. Vormetric Application Encryption is FIPS 140-2 Level-1 certified and includes a comprehensive software development kit for multiple languages and operating systems, as well as a collection of RESTful APIs for broad platform support. Vormetric Application Encryption was complemented by the addition of Vormetric Data Security Manager from Thales to facilitate the centralized management of data security policies and encryption keys. The flexibility of the solution enables not only Thales-generated keys to be managed, but keys from other devices that comply with the OASIS key management interoperability protocol (KMIP) standard and third-party vendors such as Microsoft, IBM and Oracle. Results The ability to expediently process transactions, irrespective of throughput volumes, was a key factor for Guo: “Vormetric Application Encryption streamlines the encryption process without sacrificing performance,” he explained. “When a user submits their information into our database, it is immediately encrypted and stored. Using Thales’s Vormetric Data Security Manager (DSM) to manage the security keys ensures that the person controlling access is the actual data owner. This means that – even in the very unlikely event of the data becoming accessible – it is totally unintelligible and therefore unusable to anyone else, including our own internal staff.” The Planet of finance technical team utilizes customized API calls to access the encryption and decryption functions residing in a Thales-provided library. “We do a lot of in-house application development and the Thales APIs gave us immediate access to an extensive range key management and encryption services,” commented Guo. He added, “If we do ever have a question about an unfamiliar area, the support we’ve received from Thales has been really great. Responses are always quick and I’m very happy with the communication we have between all the groups.” The Thales solutions make key contribution to the successful launch of innovative new offerings from Planet of finance. Broyon explained, “As we continue to add new services we have to work through a large number of legal and administrative considerations: Our use of Thales is significant in helping to overcome these challenges to be the leading platform for investors. Leaders Like to Work with Leaders Alain Broyon reflected, “Our entire business is built on a foundation of integrity and trust, and Thales enables us to grow in a way that safeguards the confidence our clients have in us. The world today is driven by data and it is therefore imperative to work with best-in-class partners. For me, Thales is the world leader in cyber security – it has world-class solutions backed by the people, services and creativity needed to stay ahead.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centres or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organisation needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenisation, and privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organisation’s digital transformation. Thales eSecurity is part of Thales Group.

Providing informed medical opinions is what physicians are paid to do: Each diagnosis and recommendation can trigger multiple outcomes, including prescriptions for drugs, insurance payment authorizations and formal completion of treatments. If a judgement is ever questioned or needs further validation a highly specialized category of company, known as an independent review organization (IRO), is called in to provide an expert review of the facts. Headquartered in Portland, Oregon, AllMed Healthcare Management offers comprehensive physician peer review solutions to leading payer and provider organizations. The company utilizes a panel of hundreds of licensed, board-certified and actively practicing physicians to conduct its assessments. Their clients include medical management and managed care organizations (MMO, MCO), third party administrators (TPA) disability carriers and other providers. Given the wide variety of highly confidential data that it handles, AllMed falls at the intersection of numerous federal, regional, industry and general regulatory mandates associated with personally identifiable information (PII), protected health information (PHI) and other sensitive data categories. As a demonstration of its commitment to adhere to the highest levels of data integrity, AllMed is one of just a handful of independent review organizations to have earned the stringent Health Information Trust Alliance (HITRUST) certification for information technology security. Business Need Joel Campbell, Information Security Officer at AllMed, commented, “In the healthcare industry the number of regulations relating to data protection can be totally overwhelming, even for security professionals. For AllMed, being HITRUST certified is tangible proof to our stakeholders that we uphold the highest standards of security and privacy: They don’t need to know what the ‘HIPAA’ or ‘HITECH’ acronyms stand for, they just need to know that we’ve met or exceeded industry-defined requirements relating to protecting patient data.” Technical Need HITRUST certification utilizes a comprehensive security framework that integrates requirements from many authoritative sources – such as ISO, NIST, PCI, HIPAA and others – and tailors them specifically to healthcare organizations. “HITRUST touches all aspects of an organization, so it is imperative to architect a solid foundation on which to build security policies, controls and procedures,” reflected Campbell. “A key step was to ensure that our data is continually secure, and for me this means encryption.” He continued, “I’ve been in the security industry a long time and the number one name for encryption technologies has always been Thales. There are obviously competing products but Thales is always the name that jumps to the top.” Solution AllMed deployed Vormetric Transparent Encryption from Thales in conjunction with the Vormetric Data Security Manager (DSM) to manage access policies and encryption keys across physical data centers, cloud environments and hybrid deployments. Vormetric Transparent Encryption provides the necessary access controls and data access logging functions needed by almost all compliance and data privacy standards and mandates, including PCI DSS, HIPAA/HITECH, GDPR and many others. AllMed is able to secure information with file and volume-level encryption for both data at rest and in motion. Agents installed above the file system on servers or virtual machines enforce data security and compliance policies; making deployment simple and fast. “Everything gets encrypted,” described Campbell. “HIPAA doesn’t explicitly distinguish between different data states but by using Thales we immediately remove any concerns or issues about how we secure information.” Result “We use a lot of different applications and were able to implement the Thales solutions without having to modify any code, databases or infrastructure components,” recalled Campbell. “We have a modestly sized security team and despite serving such a critical role, the administrative overhead of the Thales solution has been phenomenally low, truly ‘set and forget’ once configured.” Providing its panel members with the information needed to review medical cases involves sending numerous files, some of significant size. This transfer process has several areas of potential vulnerability, especially because AllMed panelists are spread around the country, outside of the company’s headquarters infrastructure. Campbell remarked, “With Thales we can prove that all data being transmitted is both unchanged and unseen, from its origin through to the receiving physician. Given its sensitivity, being able to guarantee that only the intended recipient can view the information is critical.” Serious Security Campbell added, “AllMed is always looking for new business opportunities and we are growing quickly, making it essential that our IT infrastructure can support the company’s business objectives. Thales has engineered its solutions to scale and adapt to accommodate exactly this type of dynamic situation.” The widespread, positive reputation of Thales continues to bring benefits, Campbell summarized, “Without data integrity we wouldn’t have a business. When prospects, or even existing clients, learn that we use Thales to perform all our encryption duties, that’s typically all they need to hear. They know we’re serious.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Flash sales, Cyber Monday, e-commerce, and many similar phrases have become common terms in our everyday online experience. Millions of people shop online, participate in cybermarketplaces, and multiple other forms of Internet-based retail. It’s safe to say that online commerce has become a vital element of Western culture. However, countries that are newly entering this space, like Morocco, are learning about the complex issues that come hand-in-hand with online trading. Matters like cyber security and legacy banking regulations can threaten the proliferation of e-commerce throughput the country, and ignoring these puts its citizens in a vulnerable situation. A trusted partner of Moroccan financial traders, CMI, was founded by nine of the country’s banks to provide innovative, local technology-based solutions and expertise to businesses of all sizes and industries. BUSINESS CHALLENGE Morocco, one of the most economically powerful countries in Northern and Sub-Saharan Africa, prides itself on its agricultural and artisanal sectors, as well as its strong history of exporting a wide range of goods and services. However, until 2001, the country’s outdated banking regulations hindered the development of e-commerce. Mr. Abderrahim Massaoudi, chief technology officer for CMI, explained, “In 1976, electronic banking was born in Morocco by accepting French foreign payment cards as well as Visa, Mastercard, and American Express. In 2001, CMI was formed to improve electronic banking within the country, linking Moroccan banks together to promote exchanges with merchants.” Intrinsically international, e-commerce triggers complex considerations such as examination of banking regulations, cyber-security, and payment service provisions. “Data integrity is vital in this space,” noted Massaoudi. “Any security breach that affects CMI could greatly impact the Moroccan economy and the region’s economic standing.” Consequently, CMI mandated the identification and deployment of a local solution that would help fight against the risks of fraud related to the use of bank cards. A core criterion was a solution to manage digital keys for strong authentication and provide crypto-processing. TECHNICAL CHALLENGE “CMI secures and processes over 250,000 transactions each day, which makes us one of the largest acquirers in all Africa,” said Massaoudi. “Use of e-commerce is exploding in our region, so we needed a solution that could keep pace with the volumes to keep each user’s information secure and accurate.” To protect end-users from inherent e-commerce security risks, CMI required a solution with the flexibility to provide streamlined security and end-to-end integrity. CMI sought the guidance of Thales local partner, PCard, to assist in the search for the optimal approach. SOLUTION PCard and CMI quickly determined that the capabilities of the Thales payShield 9000 hardware security module (HSM) would be the ideal match for the extensive architectural requirements. “In addition to the features and functionality, Thales was the only provider able to deliver local support and expertise,” commented Massaoudi. “Its local presence and ability to deliver 24/7 assistance sealed the deal.” In addition to flexible licensing options, payShield 9000 provides a broad set of cost-effective capabilities, ranging from PIN validation to transaction processing, to key management and more. The payShield HSM offers an effective combination of strong security and operational ease, maintaining a tamperresistant security platform that protects cryptographic keys and other sensitive information including customer PINs and cardholder data. RESULTS Thales payShield 9000 delivers comprehensive, certified security designed to meet each of CMI’s business and technical requirements. “Thales is constantly evolving the HSM product-line but always ensuring that backward compatibility is maintained. This is a huge advantage for any long-time customer who wants to protect their original investment,” affirmed Massaoudi. “The way the Thales HSM is designed gives us the ability to meet the increasing demands from the payment transaction market without having to constantly swap our hardware.” He added, “The implementation of payShield 9000 took just five minutes. There were no problems because the HSM is explicitly designed to meet key requirement in the electronic payment space. Once you install it, you tend to forget about it because it works smoothly right from the start.” The partnership with PCard also has lived up to expectations: “Not only do we get support from Thales, but we also get assistance from PCard on licensing, product implementation, and we really appreciate having local expertise and resources,” stated Massaoudi. MISSION CRITICAL The Thales HSM enables CMI to support the commercial success of its customers by delivering simplified electronic payment in a secure and efficient manner. Massaoudi concluded, “The Thales payShield 9000 is a strong and reliable product. If the HSM failed, our entire system would fail. E-commerce volumes are rapidly expanding across the region and it is critical to us that we offer consistent services to support our customers. The security and flexibility provided by the Thales HSM gives us the confidence to deliver on our commitments.” ABOUT THALES eSECURITY Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Founded in the wake of the September 11th, 2001 attacks on the U.S., TRAPWIRE puts data analysis to work to keep the country safe. Paul Chadha, director of products and technology, explained, “We build and deploy software systems and provide associated services to protect critical infrastructure and personnel. Our platform provides a comprehensive threat detection capability enabling a network of otherwise disparate organizations to identify and share threat information in real-time. Within our system, we enable the user base to have access into a security grid where everyone is working together in a fully encrypted, secure manner, while retaining complete control over their own data. We’ve modernized, streamlined and exponentially enhanced threat detection, analysis and information sharing.” The TRAPWIRE system provides tools that enable users to make sense of the amassed security-related information that organizations collect. It aggregates the data in a standardized format to reveal patterns and threat indicators that help clients to prevent terrorist attacks and other criminal activity. Chadha noted, “TRAPWIRE is an agile, software-as-a-service, in-the-cloud security solution. “We have subject matter experts in the areas of surveillance, surveillance detection and attack planning who have defined the activity and patterns that typically occur prior to a criminal act. We use their knowledge to develop our algorithms and systematically analyze the activities and events our customers are reporting. We’re able to tell them, for example, which events are indicative of a surveillance cell planning a malicious activity. The TRAPWIRE system continuously analyzes reporting from all of our clients to help identify correlations between seemingly unrelated events. With each report containing many hundred individual elements, it generates a significant amount of data.” Business Challenge “The protection and security of our customer data is top priority,” Chadha stated. “Our customer base is extremely diverse and includes federal, state and local law enforcement, Department of Defense, as well as private-sector clients. The nature of the information with which we are entrusted makes it imperative that we have the highest possible standards of security across all data states.” Stephen Coffman, chief software architect explained, “TRAPWIRE grew by two orders of magnitude from when we first designed and implemented the original encryption application. In order to continue our trajectory, it became critical for us to transition to a best-in-class commercial solution that could scale and provide us with the necessary levels of protection.” Technical Challenge One of TRAPWIRE’s key differentiators is the speed of its pattern analysis and correlation: To be deemed a viable contender for consideration it was critical that an encryption solution did not impede data manipulation. Coffman elaborated, “We use a service-oriented architecture that makes it pretty straight-forward to add a new API or a new application for any customer. Anything we create just talks to the back-end services that perform all the business logic, so it’s important to have an efficient interface between layers and not have to worry about encrypting and decrypting data at each boundary ourselves.” Solution Chadha noted, “Because of the number of recommendations we received, Vormetric was our favored solution. We performed a detailed analysis of the capabilities and functionality of Vormetric Transparent Encryption and made the decision to invest and deploy it. “We implemented key manager capabilities and encryption across the entire environment simultaneously without having to go through any extensive training. We especially liked Vormetric’s ‘learn mode’: The application familiarized itself with our environment and asked us to approve or deny the individual service and process combinations that it encountered. When we were ready to go live it was as simple as just flipping the switch.” To guarantee a smooth launch, the company enlisted the help of Vormetric Professional Services for the initial configuration. “The process was extremely positive – the team was always accommodating and very flexible,” recalled Coffman. Results In addition to its capabilities to secure data at rest and ease of implementing role separation, Vormetric impressed the TRAPWIRE team in other ways: “With most other encryption platforms an authenticated user always has access to data in clear text.” Chadha stated. “A big differentiator with Vormetric is that we can restrict access to specific processes and even the context under which they are running. If a system administrator can’t access data in an understandable format, neither can a threat actor.” Coffman commented, “Our agile architecture gives us the ability to build applications on the fly and get them quickly integrated into the overall solution. Vormetric Transparent Encryption perfectly accommodates this approach. It also enables us to analyze large volumes of data in real-time and can easily scale to support the company’s dramatic growth.” “Our mission is to enhance the security posture of our clients by integrating the most advanced capabilities into our platform,” Chadha concluded. “Vormetric’s flexibility enables us to implement the best-in-class technologies we need to achieve this, and gives us the confidence that the data is always secure. TRAPWIRE’s goal is to make the world a safer place, and Vormetric is helping us get there.”

How Thales is Helping to Secure a BioPKI Solution that Facilitates electronic Signatures of Documents in the Banking Sector The Challenge: Securing a Ground-Breaking Authentication technology in a Highly Regulated Industry As a global leader in the development of technology for consumers, business and governments, Hitachi saw the opportunity for its Finger Vein biometric authentication system to revolutionize digital signatures in the banking sector. Using the blood vessel pattern inside the finger to authenticate a person’s identity, Finger Vein technology offers a precise, efficient and advanced form of biometric authentication. When applied to the banking industry, Hitachi’s technology would allow banks to authenticate users in less than one second by comparing a real-time scan of a finger with the customer’s Finger Vein profile stored in a database. Using Finger Vein technology would reduce a bank’s use of paper documents, minimizing costs related to printing, scanning, indexing, transport, archiving and shredding of paper documents. The key to the success of this authentication technology in the banking sector would be the security of its biometric digital signatures, or BioPKI, an alternative to the traditional model of digital signature. Finger Vein BioPKI is a mix of biometrics and PKI and requires the use of Finger Vein authentication to manage the access to the user’s private key which is stored securely in the bank’s back office system. Hitachi knew that for Finger Vein technology to gain wide acceptance within the banking community, it would need a highly secure solution to protect the authentication process and any associated stored data. Key Benefits of Using Thales HSMs Automate risk-prone administrative tasks, guarantee key recovery, and eliminate costly manually-intensive backup processes Enable secure execution of custom security-critical application code within the tamper-resistant hardware boundary Support high volume, enterprise transactions with accelerated transaction rates Simplify scaling as security needs expand with flexible architecture Reduce the cost of traveling to data centers with a Remote Administration feature Establish strong separation of duties through robust administration policies including role-based multifactor authentication and quorum-based authorization The Solution: Role of Thales HSMs Hitachi chose Thales nShield Connect Hardware Security Modules for use in its BioPKI deployment in the Central Eastern Europe (CEE) market. Access to private keys for the Finger Vein authentication is protected by a certified Thales HSM, a highly secure and tamper-resistant device located in the back office of the bank, where it is responsible for the creation of the digital signature and for protecting secret keys. Thales’ unique CodeSafe capability is used to execute custom signature creation code inside the certified security boundary of the HSM. The implementation of this innovative biometric solution for customer authentication in bank branches in Poland was the first in Europe, and based on experience gained during the practical implementation of projects in the financial sector in Poland, Hitachi now recommends its BioPKI customers to use Thales HSMs. The Thales hardware has been successfully used to implement biometric digital signatures in Banks such as BZ WBK (pilot project in branches) and Getin Noble Bank (branches and VTMs). Hitachi’s solution is well matched to the requirements of the applicable laws in Poland. Meeting the expectations of auditors and regulators was possible thanks to, among other things, the use of Thales HSMs for storing and protecting the private keys. About the Solution Thales HSMs Thales nShield HSMs provide a tamper-resistant environment for secure cryptographic processing and key management. nShield HSMs are certified and meet established and emerging security standards for cryptographic systems while staying highly efficient. nShield HSMs isolate and protect cryptographic operations and keys for organizations’ most critical applications. nShield HSMs perform encryption, digital signing, and key management for an extensive range of applications including public key infrastructures (PKIs), SSL/TLS, and code signing. nShield HSMs are high-assurance alternatives to software-based cryptography – supporting all leading algorithms and featuring world-class ECC performance. Thales CodeSafe CodeSafe is a unique capability of Thales HSMs which enables developers to execute applications within the certified security boundary of the HSM, protecting them from threats such as insider attacks, malware, and Trojans that they would be vulnerable to on typical server platforms.

Overview The connectivity and information technology subsidiary of a major pharmaceutical company was created to simplify how the business of healthcare is managed while making the delivery of care safer and more efficient. As more and more of the US’ healthcare system goes electronic, this organization meets challenges and opportunities through an open network that supports future growth via interoperability among organizations, systems, and solutions. The Challenge With regulations such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA), healthcare organizations are required to store healthcare data for extended periods of time. This health IT company instituted a policy of saving seven years’ historical claims and remit data, but its in-house database systems had trouble meeting the data retention requirement while processing millions of claims every day. A software engineer at the company explained, “All of our systems were maxed out. We were constantly having database issues. It was just too much data for what they were meant to handle. They were overworked and overloaded, and it started to cause problems with all of our real-time production processing.” Further, the organization sought a solution that would allow users to do more than just store data. The manager of software development at the company explained, “In today’s data driven world, data really is this huge asset. We wondered, ‘What framework, what platform will allow us to optimize the data that we have without compromising our stringent corpo - rate and regularity driven compliance guidelines?’” The team set out to find a new solution. “We could have gone the SAN route, but it’s expensive and cumbersome,” said the software engineer. They did some searching online and came across Apache Hadoop, MongoDB, and Cassandra. “We analyzed them and came up with a prototype for each one. In the end, we decided Hadoop was what we wanted.” Initially the organization downloaded Hadoop from Apache and configured it to run on ten Dell workstations that were already in house. Once the small Hadoop cluster showed its functionality and demonstrated value, the team decided to make a commitment to the platform, but would need support to do so. When evaluating various Hadoop distributions and management vendors, they recognized that Cloudera was different: its Hadoop distribu - tion—CDH—is 100% Apache open source. This allows Cloudera customers to benefit from rapid innovations in the open source community while also taking advantage of enterprise- grade support and management tools offered with the Cloudera Enterprise subscription. And with Cloudera Enterprise Data Hub Edition, the company could deploy a centralized big data platform supporting a variety of different users and workloads. But the risk and compliance team required encryption of regulated data for project approval. Homegrown and open source encryption solutions proved impractical to implement. Evalu - ation also showed them to be expensive, complex, and restrictive to deploy, configure, and maintain. Thales eSecurity, a certified Cloudera partner, was selected as the best solution. Critical considerations supporting the decision were Thales eSecurity's single, centrally managed encryp - tion and key management infrastructure, transparency to Cloudera's big data operations, and extensibility to support additional applications and future requirements. Solution When deciding to deploy CDH, the team set out to identify applications that were already seeing performance issues in production. “One of the big advantages of Hadoop has been its ability to segregate big data from transactional processing data and allow smoother processing of information. Basically, it allows us to offload a lot of stress from the database,” said the company’s manager of software development. They quickly identified two areas that were a strong fit for Cloudera and Thales eSecurity: Archiving seven years’ claims and remit data, which requires complex processing to get into a normalized format, and encrypting that data in a solution that meets future requirements to restrict privileged user access to data at the underlying file system and volume level Logging terabytes of data generated from transactional systems daily, and storing them in CDH for analytical purposes Today the health IT organization uses Flume to move data from its source systems into the Cloudera cluster on a 24x7 basis. The company loads data from CDH to an Oracle online transaction processing (OLTP) database for billing purposes. This load runs once or twice each day via Sqoop. The Thales eSecurity solution assures encryption and compliance of all regulated data through centrally managed policies. Impact: Helping Provides Collect Payment Faster Through Operational Efficiencies “If you look at the margin that the average hospital has, it’s between 2-3%,” stated the manager of software development. “So their cash flow is very tight. Anything you can do to reduce the time to get paid is very valuable to a healthcare provider.” Since deploying Cloudera Enterprise, the organization has reduced the time it takes for healthcare providers to get paid by streamlining their transfer of messages to payers. The ability to expedite this process is especially valuable when regulatory changes come into play, such as the recent conversion from HIPAA 4010 to HIPAA 5010. “We assist with the conversion and processing of these messages,” said the company’s manager of software development. “For example, 4010 messages came in and we’d convert them to 5010 to allow seamless processing. The providers didn’t have to upgrade any of their systems when the regulations went into effect. We gave them a bit of a buffer to implement changes. And since we do a lot of electronic processing, we can do basic sanity checks on the messages as they come in and let providers know what adjustments need to be made in order to get paid faster.” Impact: Low Cost + Greater Analytic Flexibility Because Hadoop uses industry standard hardware, the cost per terabyte of storage is, on average, 10x cheaper than a traditional relational data warehouse system. “One of my pet peeves is: you buy a machine, you buy SAN storage, and then you have to buy licensing for the storage in addition to the storage itself,” explained the manager of software develop - ment. “You have to buy licensing for the blades, and it just becomes an untenable situation. With Hadoop you buy commodity hardware and you’re good to go. In addition to the storage, you get a bigger bang for your buck because it gives you the ability to run analytics on the combined compute and storage. The solutions that we had in place previously really didn’t allow for that. Even if the costs were equivalent, the benefit you get from storing data on a Hadoop type solution is far greater than what you’d get from storing it in a database.” Impact: Simple Deployment & Administration After deciding on the Cloudera solution, “the deployment process into production with Ha - doop was actually quite easy,” said a software engineer at the company. “Cloudera Manager really helped us a lot. It’s as easy as just clicking a few buttons, and you’re up and running. It’s really simple. And the support staff at Cloudera have been great. They really helped us out with a couple of issues we had along the way.” Similarly, the security team was able to implement the Thales eSecurity solution without the ap - plications group making any changes. There were no process or experience changes required by users or administrators, nor was there any impact to service level agreements (SLAs). Further, the risk and compliance team signed off quickly on the new environment because it was easy to demonstrate the ease of encryption and access control. Several employees enrolled in Cloudera University training as well, which was “very beneficial” according to one software engineer. And with Cloudera Manager, the team spends very little time managing the cluster. Further, this health IT organization appreciates the proactive customer support offered by Cloudera Enterprise. “We ask questions and we get them answered very quickly,” com - mented their manager of software development. “Not only do the Cloudera Support folks answer the question, they come back and say, ‘Do you have any other questions? Is there anything else we can help you with?’ It’s very different. The people that are on Cloudera’s Support team — you can definitely tell they are Hadoop Committers. Not only will they find you the answer but they can tell you, ‘This may not be the best practice, you may want to change the way you’re doing your development to take advantage of other features.’ The Cloudera Support organization is world class.” About Cloudera Cloudera is revolutionizing enterprise data management by offering the first unified Platform for Big Data, an enterprise data hub built on Apache ® Hadoop ™ . Cloudera offers enterprises one place to store, process and analyze all their data, empowering them to extend the value of existing investments while enabling fundamental new ways to derive value from their data. Only Cloudera offers everything needed on a journey to an enterprise data hub, including software for business critical data challenges such as storage, access, management, analysis, security and search. As the leading educator of Hadoop profes - sionals, Cloudera has trained over 40,000 individuals worldwide. Over 800 partners and a seasoned professional services team help deliver greater time to value. Finally, only Cloudera provides proactive and predictive support to run an enterprise data hub with confidence. Leading organizations in every industry plus top public sector organizations globally run Cloudera in production. www.cloudera.com.

Founded in 1935, Fujitsu Limited is the fourth-largest IT services provider in the world, employing 162,000 staff across more than 100 countries. Ranked many times as one of FORTUNE’s “Most Admired Companies” and a longstanding member of the “FORTUNE Global 500”, it reported worldwide revenues of US$46 billion for the fiscal year ending on March 31, 2014. The Americas region of Fujitsu offers clients an extensive suite of business technology services, cloud services, computing platforms, and industry solutions to customers in the US, Canada, Caribbean, Central America, South America and Mexico. Approximately 7,000 employees are spread throughout the various countries in the Americas region, with R&D centers and data center facilities including locations in California, North Carolina, Texas, Saskatchewan and Québec. A highly-regarded component of the Fujitsu Americas services portfolio is a comprehensive set of service desk capabilities that provide compelling outsourcing options to companies from all industries and of all sizes. Albert Avila, business solutions specialist at Fujitsu America, Inc. , commented, “We are the preferred outsourcer for more than 2,000 customers worldwide and answer more than 1.5 million calls each month. Clients can sign up for a variety of services, including having us host their servers, perform network management, and run their in-house service desk. All of these activities get logged and tracked in our own ticketing system.” Challenge In addition to recording call-specific information, the ticketing system is frequently used as a repository for code and data elements that are pertinent to a client’s issue. Avila explained, “While we aren’t subject to the same mandates typically imposed on industries like healthcare or financial institutions, we are highly sensitive to our responsibilities to secure any personal information that may be inadvertently uploaded to our database during the execution of normal diagnostics and problem resolution activities.” “As such, Fujitsu took a proactive approach with regard to security and confidentiality and began looking for an encryption solution to mitigate any potential issues ensuring the integrity of our client data.” Solution “We investigated a number of possible solutions and ultimately selected Thales eSecurity® Encryption as the best solution for our business,” Avila said. A proof of concept was conducted, which emulated the primarily Microsoft®-based architecture of the service desk environment. “Piloting Thales eSecurity Encryption was very uneventful, which is exactly the way we like it, and we were able to quickly assess the solution against all of our evaluation criteria, including performance, end-user impact, ease of use and transparency,” said Avila. “It was apparent that we made the right choice.” Results The intuitive Thales eSecurity interface and straightforward administration requirements allow any changes to the infrastructure and team members to be made very expediently. “From an encryption perspective, it’s a trivial task to add more hardware or to bring someone new up to speed. Actually, since the original proof of concept installation, we have only had to make minor adjustments to the platform’s configuration, which is something we really value,” stated Avila. Encryption is performed throughout the Fujitsu environment, including replicated database instances. Avila remarked, “Despite how pervasively we’re encrypting data, users have no idea what is being done. Performance issues were originally a major consideration for us: our users are very demanding and we interpret the total lack of any negative feedback to be a great success.” “Because we had the Thales eSecurity solution in place, we were able to quickly and effectively onboard new clients, including those with contractual requirements for encryption. The initial driver to implement encryption was to safeguard sensitive data that had been uploaded to our systems, and since then, we’ve highlighted this capability as a standard part of our strategy.” Protecting Data Integrity is Critical: Thales eSecurity Makes it Look Easy Avila concluded, “With the continually increasing number and sophistication of Web-based threats, data encryption has become a necessity. Our ticketing system is internet-facing so the integrity of data is something I’m constantly thinking about. We were very nervous going into this: The system is a core part of our business – we bill per ticket – so any impact on our ability to perform is a big deal. Thales eSecurity encryption more than lives up to expectations and enables me to focus on the more demanding aspects of my role.”

The Challenge: Help Tunisia Grow Their Digital Economy While Delivering Security to its Citizens In 2015, the Tunisian government launched Digital Tunisia 2020, a plan designed to boost the nation’s digital economy by enriching online government services and electronic commerce. Fundamental to the success of the initiative was establishing Tunisia’s citizens’ trust and confidence in the public and private online services and electronic transactions. The National Digital Certification Agency (NDCA), representing the nation’s highest level of trust for electronic transactions, embarked on the cornerstone project of Digital Tunisia 2020 to re-engineer the national public key infrastructure (PKI), that underpins the security of digital transactions. To succeed, the project would need a smooth and rapid transition from the existing PKI while also providing enhanced trust services once implemented. Additionally, the PKI would need to comply with new stringent regulations for digital certification. The Solution: New PKI Secured By Thales HSMs Modernizing Tunisia’s government PKI would require installing up-to-date, best available hardware and software to improve availability, reliability, and quality of services. To protect the root keys used in the PKI, the NDCA knew they needed a hardwarebased solution, as processing sensitive information in softwareonly solutions exposes it to risk. NDCA Selects PrimeKey + Thales For optimum function and security, the NDCA chose a solution that combined two crucial components: A new PKI from PrimeKey, and hardware security modules (HSMs) from Thales. Thales nShield HSMs would provide security for the PKI by hosting and protecting the private keys of the Certification Authorities (CAs) during the highly sensitive transactions. The NDCA used two models of nShield HSMs to secure the PKI and protect transactions including the following: Authenticating electronic identities of citizens carrying out e-commerce transactions as well as businesses carrying out B2B and B2G transactions Securing online transactions including online tax payments and returns, electronic submission of customs and foreign trade declarations, electronic invoices, and e- banking services Validating companies responding to government Requests for Proposals using Tunisia’s on-line e-procurement system, TunEPS Creating signatures and authenticating information, such as biometric data and other personal identifying information (PII), stored on chips in documents including e-passports and eID cards The nShield Edge, Thales’s USB-connected HSM, is used to generate and manage keys for the offline root CAs. The nShield Connect, Thales’s network-attached HSM, performs a variety of services such as: Supporting Online Certificate Status Protocol (OCSP) transactions to obtain certificate revocation status Securing keys and transactions using those keys on the government signing server, which issues and signs certificates for biometric and electronic information stored in passport and eID chips. The NDCA installed their nShield HSMs in two datacenters, one for production and the second for backup and disaster recovery. In addition to providing HSMs and integration support, Thales also delivered training to NDCA’s technical team on how to take full advantange of their nShield HSMs. Proactive Collaboration Thales took the initiative to work directly with PrimeKey and provided them the assets and support they needed to design and test their solution. This direct and proactive collaboration helped the project run smoothly and resulted in an optimally integrated solution. About the Solution Thales HSMs Thales nShield HSMs provide a tamper-resistant environment for secure cryptographic processing and key management. nShield HSMs are FIPS 140-2 Level 2 and 3, Common Criteria certified and eIDAS compliant, and meet established and emerging security standards for cryptographic systems while staying highly efficient. nShield HSMs isolate and protect cryptographic operations and keys for organizations’ most critical applications, and perform encryption, digital signing, and key management for an extensive range of applications including PKIs, SSL/TLS, and code signing. nShield HSMs provide high-assurance solutions, and superior protection over software-only cryptography. nShield HSMs support all leading algorithms and feature worldclass transaction rate performance. With Thales HSMs and their unique Security World architecture, you buy only the capacity you need and easily scale your solution as your needs evolve. Key Thales Solution Benefits Protect cryptographic keys and operations within tamperresistant hardware to significantly enhance security over software-only solutions. Trust your certified solution—Thales nShield HSMs are certified to stringent standards including FIPS and Common Criteria, and are compliant to eIDAS standards. Maintain control over your keys and build HSM estates that scale with your evolving needs with Thales’ unique Security World architecture.

Headquartered in Carrollton, Texas, Driven Solutions is dedicated to providing the best in roadside assistance services and travel protection solutions. Founded in 1968 and privately owned, the company publicly declares the pride it takes in listening to its customers and crafting bundles of services that exactly meet the needs of each one. Serving the wholesale and retail markets, Driven Solutions customizes services for hundreds of programs and millions of households, delivering innovative private label programs that emphasize the human side of the multi-billion dollar industry. Business Challenge Many aspects of Driven Solutions’ business involve the use of personal credit card information. As such each transaction is governed by the Payment Card Industry Data Security Standard (PCI DSS) that mandates all stored cardholder data, irrespective of its format or state, must be encrypted. Additionally, Driven Solutions wanted to go beyond PCI DSS standards for encryption to ensure security of all relevant data. By continually focusing on delivering and exceeding customers’ requirements, the company is very skilled at adapting to meet new expectations. Trey Smith, Driven Solutions’ chief technical officer, provided a typical example, “We have a very high profile customer that is extremely sensitive about how all forms of personally identifiable information (PII) are handled and secured. We listened to their perspectives and jointly decided that the implementation of an encryption solution that protected PII at rest and in motion would address the potential concerns.” Technical Challenge Smith recounted, “We’d been using a specialized function to encrypt credit card account numbers, but it was not fully cryptographically standardized and therefore didn’t meet the PCI compliance to the degree we desired. “An additional requirement was that any encryption solution had to be able to support our mixed IT infrastructure. We run a diverse environment; including a Sun Solaris™ 10 stack for our legacy OLTP Sybase system and multiple Microsoft® SQL servers that host newer applications. In order to keep our IT operations running efficiently, we wanted a single encryption product that could support everything.” Solution Smith challenged his team to identify suitable candidates to evaluate. “After extensive research we selected Vormetric as the one solution we wanted to move forward to a proof-of-concept,” he recalled. “We really liked the encryption appliance approach and the low impact on performance. We also appreciated that it natively supported our Sybase and SQL databases: The cross-platform flexibility was very important because we don’t want to place limitations on our ability to continue to select best-in-class components as we expand, and we have too much going on to manage multiple encryption solutions.” The proof-of-concept was conducted in Driven Solutions’ quality assurance environment. “The install went very smoothly: The Vormetric consultant gave us a hands-on education as part of his deployment process and the implementation was completed inside a day,” commented Smith. “After a week-long period of extensively testing the encryption capabilities we were thoroughly satisfied, and embarked on a coordinated rollout across our full production environment.” Results Committed to minimizing impact on user operations, Smith’s team performed performance testing to quantify any overhead associated with the Vormetric encryption: He noted, “Our statistical analysis determined there was a nominal degree of additional latency, but significantly, when we surveyed the users they just couldn’t tell the difference. “Perhaps even more important from a business perspective, we commissioned an external audit to review our data security solution and were delighted to be told that it passed with flying colors.” He added, “When it comes to security no news is good news! We run a high availability 24x7 emergency call center, so the less we hear about the infrastructure the better. As far as I’m concerned Vormetric is a huge success because we just don’t need to think about it, it just does what it’s supposed to do.” Customer Focus Drives Excellence Smith concluded, “We saw an opportunity for improvement and quickly determined that Vormetric Data Security – with its flexibility, transparency and ease of use – would help us accomplish what was needed. We listened closely to our clients, and knew what we had to do to secure PII; we partnered with Vormetric to deliver a solution that meets everyone’s objectives.”

Rx Savings Solutions blends FireHost’s secure managed cloud and encryption service based on Thales eSecurity technology to protect ePHI, comply with HIPAA Richardson, Texas – June 23, 2015 – Saving patients money on rising prescription costs is only half of the challenge faced by Rx Savings Solutions, an emerging software-as-a-service provider that helps patients and self-insured employers find the best price on medication. Preventing data breaches, by building patient trust through compliance, security andconfidentiality, is the biggest cost avoidance opportunity of all. To ensure their customer and patient data is protected, Rx Savings Solutions relies on FireHost as its secure managed cloud provider. Today, FireHost announces that Rx Savings Solutions is taking an extremely proactive approach to reducing risk by utilizing its managed encryption service for data-at-rest protection. The encryption service, managed by FireHost’s security experts, is based on technology from encryption leader Thales eSecurity, one of its key partners. Together, the partnership between FireHost and Thales eSecurity is redefining the approach security- and compliance-driven companies can take in protecting sensitive data through a managed cloud provider model. Key Highlights Electronic personal healthcare information (ePHI) is 10-20 times more valuable than credit card data (Reuters). Through its partnership with Thales eSecurity, FireHost enables Rx Savings Solutions and other HIPAA-driven healthcare organizations to encrypt sensitive data and files on servers, control access to the encrypted data, and then report on who is accessing that data. Thales eSecurity partners with FireHost to provide the encryption technology that enables the service. Data-at-rest encryption is one of the most proven approaches to sound cybersecurity and is fundamental in complying with HIPAA. By building customer trust and encrypting personally identifiable information (PII), Rx Savings Solutions can save patients up to 45 percent on prescription costs. FireHost’s secure managed cloud, which incorporates this data-at-rest encryption service, is a major part of Rx Savings Solutions’ approach to reducing risk for their operations and patients. Rx Savings Solutions offloads around-the-clock security management responsibilities to FireHost’s team of specialized experts and security operations professionals. Quotes Bo Lais, CTO | Rx Savings Solutions “Protecting ePHI data is a top priority for Rx Savings Solutions and, therefore, encryption plays a key role in our security framework. We take advantage of FireHost's partnership with Thales eSecurity to utilize sophisticated encryption to protect the sensitive personal data of our members. The service is part of our strategic approach to embrace FireHost’s secure managed cloud provider model to help us protect member data and operations. This enables us to smartly balance our focus and help educate our members on their prescription medication options.” Kurt Hagerman, CISO | FireHost “True cybersecurity and compliance programs are organic and always evolving. Proactive organizations constantly evaluate their security posture, risk, and compliance scope. Rx Savings Solutions is an extremely forward-thinking healthcare company that is doing just that. They acknowledge the strengths of their in-house and external teams and play to their strengths for the reason that matters most — putting the health and security of their patients first.” CJ Radford, VP Cloud | Thales eSecurity “Use of data-at-rest encryption, access controls and access monitoring are among the strongest, and most proven best practices for preventing data breaches, and also allow healthcare organizations to meet many ePHI requirements. With their use of these security controls, RX Savings Solutions is taking a market leading stance — using protection for their customer’s private information that reaches beyond compliance requirements to stop the most advanced threats to data.”

Transaction Processor for Travel Industry Relies on Vormetric Encryption for Compliance with PCI DSS and State Data Breach Laws SAN JOSE, Calif. – June 19, 2012 – Vormetric, Inc., the leader in enterprise encryption and key management, today announced that Airlines Reporting Corporation® (ARC), the worldwide leader in transaction settlement for the travel industry, has selected Vormetric Data Security to protect its unstructured data stores and to meet regulatory compliance requirements. ARC is using Vormetric Encryption to protect files that contain payment card data and other personally identifiable information (PII) from unauthorized access. Vormetric enables ARC to enforce granular role-based access security policies on selected data sets. Click to Tweet: #Vormetric selected by Airline Reporting Corp to encrypt unstructured data for regulatory compliance #PCIDSS http://tinyurl.com/7mkn6qk ARC is an airline-owned company serving the travel industry with financial services, data products and services, ticket distribution, original travel solutions, and settlement in the United States, Puerto Rico, the U.S. Virgin Islands, and American Samoa. Its customers process more than $80 billion annually through ARC's world-class settlement system - making it the financial backbone of travel distribution. “We needed an encryption and access control solution that could protect a large data store of files that contain sensitive information,” said Jim Fallon, security operations manager for ARC. “One of the tipping points for us was Vormetric’s management console. It makes creating encryption profiles -- which contain unique guard points, security policies, and keys -- a snap. Meanwhile, all that’s required to apply these profiles to individual users is a simple connection to Active Directory. It’s one of the easiest products to implement I’ve ever used,” he added. To meet Payment Card Industry Data Security Standard (PCI DSS) and State Data Breach Law requirements, Vormetric Data Security enables ARC to encrypt sensitive unstructured data stored in files, control access to that information, and report on who is accessing the data. These reporting capabilities make it easy for ARC to satisfy auditors’ needs and identify data access attempts by unauthorized users. Vormetric Data Security is so transparent that ARC employees are unaware that files are encrypted unless they request access to data for which they lack authorization permissions. “ARC is a very discerning buyer of IT products,” said Bruce Johnson, vice president of worldwide sales and service operations for Vormetric. “Their decision to deploy Vormetric Data Security is high praise for its ease of use and ease of implementation, and helps explain why 15 of the Fortune 25 companies have standardized on Vormetric for their encryption needs.” “The Vormetric deployment took just a few weeks and was squeaky clean. That’s unusual for an enterprise security product,” concluded ARC’s Fallon. About Thales eSecurity Vormetric is the leader in enterprise encryption. The Vormetric Data Security product line provides a single, manageable and scalable solution to manage any key and encrypt any file, any database, any application, anywhere it resides— without sacrificing application performance and avoiding key management complexity. Some of the largest and most security conscious organizations and government agencies in the world, including 15 of the Fortune 25, have standardized on Vormetric to provide strong, easily manageable data security. Vormetric technology has previously been selected by IBM as the database encryption solution for DB2 and Informix on LinuxTM, Unix® and Windows; and by Symantec to provide the Symantec Veritas NetBackupTM Media Server Encryption Option. For more information, visit www.thalesesecurity.com.

Leading CRM/BPM Provider Deploys Scalable Solution to Automate Cloud Protection and Secure Sensitive Client Data in the Cloud SAN JOSE, Calif. – March 12, 2013 — Pegasystems (NASDAQ: PEGA), the leading provider of business process management (BPM) and customer relationship management (CRM) software solutions, has standardized on Vormetric Data Security to reassure its global customer base that it is securing their data based on security best practices and compliance requirements. Vormetric, the leader in enterprise data security for physical, virtual and cloud environments, was selected for its ability to automate Pegasystems' data encryption within a leading Infrastructure-as-a-Service (IaaS) cloud service provider as well as to increase the processing speed at which Pegasystems can encrypt its volume within a cloud infrastructure. Click to Tweet: New client @Pega knows how to #ProtectWhatMatters: http://bit.ly/KgtDYZ (their customers’ sensitive data) with @Vormetric #CloudSecurity “Our partnership with a recognized data security expert like Vormetric gives us a distinct competitive advantage,” said Jim Walker, Global Head of Pega Cloud Operations and Security. “Our customers are eager to move to the cloud and protecting their data is a foremost concern. With Vormetric Data Security in place, our clients can be confident in the security of our services when it comes to protecting their high-value data. And, our government clients are pleased that we’re using a solution that is already relied upon by major federal agencies.” “End customers rely on cloud service providers like Pegasystems to protect their data and the best way to do that is to encrypt it at its source,” said Frank Tycksen, Vormetric’s vice president of customer success. “As recent news demonstrates, hackers can break into networks to steal high-value data. Many security products improperly focus on trying to stop threats at the perimeter rather than focusing as close to the data as possible. The Pegasystems deployment is a fantastic example of protecting what matters in a dynamic cloud environment.” Pegasystems’ cloud offering has grown significantly over the past few years, and managing key rotation processes was becoming unwieldy. Pegasystems needed to simplify its encryption approach with a scalable solution that could keep pace with the company’s rapid growth. Pegasystems deployed multiple Vormetric Data Security Manager appliances for its global cloud footprint, and is leveraging Vormetric’s Federal Information Processing Standard (FIPS) 140-2 Level 3 certified solution to meet the requirements of government clients. The solution is being deployed globally across several hundred cloud server instances and will be used to protect applications and databases, including databases which could be housing personally identifiable health and financial information that is affected by compliance rules such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act, as well as other country-specific data breach laws, such as the UK Data Protection Act. “We protect what matters and simplify data security for our customers, even as they scale in the cloud,” said Derek Tumulak, Vormetric’s vice president of product management. “Pegasystems' deployment illustrates how we enable customer assurance that sensitive data will remain protected — on premise or in the cloud.” About Vormetric Vormetric (@Vormetric) is the industry leader in data security solutions that span physical, virtual and cloud environments. Data is the new currency and Vormetric helps enterprise customers and government agencies protect what matters — their sensitive data — from both internal and external threats. In a world of Advanced Persistent Threats (APTs), Vormetric’s market-leading privileged user access controls and security intelligence are invaluable. The company's scalable solution suite protects any file, any database and any application — anywhere it resides — while maintaining application performance and avoiding key management complexity. Many of the world's largest and most securityconscious organizations and government agencies, including 17 of the Fortune 25, have standardized on Vormetric to protect their sensitive data and provide them with advanced security intelligence. For more information, visit www.thalesesecurity.com. Media Contacts: Vormetric North America Monika Hathaway Sterling Communications +1 (408) 395-5500 vormetric@sterlingpr.com Vormetric UK/EMEA Jonathan Mathias / Kasia Murphy Johnson King +44 (0)20 7401 7968 VormetricTeam@johnsonking.co.uk Vormetric South Korea Mina Jeong M&K PR +82 2 566-8898 tpr@mincomm.com

Nautilus, Inc. has been a leading proponent of the worldwide fitness revolution delivering fitness solutions through its globally recognized brands that include: Bowflex®, Octane® Fitness, Nautilus®, Schwinn® and Universal®. The Vancouver, Washington-based company has always been focused on the health and wellbeing of its customers and this dedication extends to protecting the digital assets of all its stakeholders. Jon Wagner, senior manager of infrastructure and security, clarified, “It has always been our policy to treat customers as we would want to be treated. This is why we have a passion to protect all data, irrespective of source, as if it were our own. “Data integrity is of critical importance across the whole company – from my direct reports, to our IT leadership, to our executives, to our board members – the company is committed to security and data protection.” Business Challenge In part due to its involvement in direct sales operations, Nautilus has to comply with the Payment Card Industry Data Security Standard (PCI DSS) mandates, and as holder of a wide variety of other data the company also adheres to the Personally Identifiable Information (PII) security requirements. Wagner stressed, “We knew that to meet and exceed compliance with the various regulations we needed a commercial-grade encryption solution. Dealing with a lot of credit card information and handling large volumes of both PII- and PCI-related data; protecting our financial servers became a key consideration in the selection process.” Nautilus has adopted a centralized model to secure its business interests around the globe; leveraging a dedicated security team located at its Vancouver headquarters. Having discovered the administrative burden imposed by some encryption solutions, the proof of minimal overhead from a new encryption solution became another important evaluation criterion. Technical Challenge Nautilus engineers have been leading the development of innovative fitness equipment for decades and they are constantly generating a significant amount of intellectual property, any fragment of which would be a highly-prized trophy for a cyber criminal. “Protecting our archived intellectual property is a company-critical imperative for us: If it fell into the wrong hands it would have a significant negative impact on our ongoing operations,” Wagner cautioned. “And we’re designing new equipment all the time using engineering design systems, including CAD, so the ability to encrypt a diverse number of file types, in motion and at rest, also became essential requirements for us.” Solution Wagner described the selection process, “We did a lot of research and used analyst recommendations to influence our decision on selecting the optimal encryption solution. We were looking for a vendor that was well known in the industry and could meet or exceed our set of requirements. Having evaluated a lot pf proposals we then narrowed down our list of viable candidates; all of our analysis confirmed that Thales eSecurity stood out as the clear leader.” With the decision made to implement Thales’ Vormetric Data Security Manager, Wagner described another big plus, “Even though we run a lot of virtual servers, Thales’ host-based licensing scheme enabled us to really simplify the whole process.” Results Wagner recalled, “The deployment was very uneventful. When we did need guidance, the Thales team was really first rate and totally transparent in everything it did. We originally planned for a five-day implementation period but were able to get everything configured, tested and rolled out in just two. The whole project was a very positive experience.” He added, “Daily administration and key management have been very straightforward; they really have exceeded all of our expectations. “All of our credit card and customer information is safely encrypted, positioning us to be in full compliance with the applicable PCI and PII rulings. Similarly for the rest of our data, if a threat actor were somehow able to gain access to any of the servers, they would only find unintelligible, meaningless files.” Wagner noted, “Thales eSecurity has enabled us to unify our encryption strategy across all of our locations, including our engineering and manufacturing facilities in the U.S. and overseas. This encompasses data in motion and at rest, such as our archived CAD files and other forms of intellectual property.” As a long-time industry leader, Nautilus knows the benefit of partnering with a company that is not only at the head of its own field but one that is making the necessary investments to ensure that it retains its leadership. Wagner concluded, “The Vormetric solution is ideal for us today and we’re also excited about the company’s direction, and the advanced functionality that’s in the works. “I’m really proud of how our whole company is so committed to security. Our partnership with Thales eSecurity is another great example of how seriously we take this responsibility.”

Weber GmbH is a medium-sized family-owned corporation with locations in Germany, Poland, and China. Weber uses advanced injection molding techniques to create components for furniture, medical equipment and automobiles. To design plastic components for cars, Weber is entrusted with computer-aided design (CAD) 3D models of entire vehicles. Business Challenge Of all Weber’s wide number of clients, a world-renowned European auto manufacturer was the first to insist that CAD files for its prototype models be fully protected by a robust, commercial-grade encryption solution that was comparable in rigor to the stringent ISO 27001 information security standard. Technical Challenge Prior to embarking on its search for a viable encryption approach, Weber relied on its standard layered defenses to protect CAD information. Christopher Kutzner, Weber’s IT application manager, elaborated “We actually didn’t encrypt any of our CAD data. We had tested various options, but because of the emphasis on the client-side, we just weren’t comfortable with doing a full roll-out in our environment.” In addition to identifying and implementing a solution that would offer equivalent protection to the ISO standard, Kutzner had requirements for strong separation of roles to reduce unnecessary access to the files, and for the encryption to have zero detectible latency, even for users working with the largest CAD datasets. The diversity of Weber’s data, and the varying requirements for security, also elevated the need for granular access and file-level control. Solution Kutzner recalled, “We initially looked at a couple of hardware solutions but they were too monolithic in their approach, and far too expensive for our needs. This helped to surface the requirement that any option should not necessitate the purchase of new hardware. When we examined what was really needed, it transpired that only a relatively small portion of data needed to be encrypted. After further investigation we decided that the solutions from Thales eSecurity gave us by far-and-away the best performance and functionality for the investment. “We installed Vormetric Data Security Manager onto a server and ran comparisons for both reads and writes against a broad selection of CAD files. Performance was our final evaluation test and as we didn’t see any difference between accessing unencrypted files and those encrypted by Thales eSecurity we immediately decided to standardize on Thales eSecurity.” Results With the looming car company deadline for having encryption deployed, Weber hurried to implement Vormetric Data Security Manager to secure the CAD data. Kutzner revealed, “Since we only had a short timeframe, our initial plan was to begin the process of encrypting data to demonstrate that we had the commitment and the capability. “The solution is very intuitive; we quickly learned how to create administration roles to move files, how to set user roles to decrypt and modify certain files, and how to manage the encryption keys. We were able to proceed much faster than we originally anticipated, and had finished converting everything by the time the car maker’s team visited.” On receiving approval from the globally recognized auto company, the Weber team initiated a broader follow-on project to further refine its encryption needs. “Thales eSecurity scaled very easily on our virtual server farm and users didn’t see any performance degradation at all: When implemented, it’s that fast and invisible!” The Thales eSecurity solution has continued to impress Kutzner: “One of the critical requirements of the audit done by the car maker’s team was to have key administration separated from the data, and this is an area where Thales eSecurity really excels,” he noted. “We defined new roles for our administrators – they are allowed to create folders on the encrypted drive, delete empty folders, and rename them – but they do not have access to the data. When a user opens an encrypted folder they only see the files they are permitted to access; they can’t even see the files they are not authorized to decrypt. Thales eSecurity really impressed us with how easy it was to implement a worldclass encryption solution.” Kutzner concluded, “Vormetric Data Security Manager has fulfilled all our expectations and I would confidently recommend it to peers in similar situations.”

American River College (ARC) is a public community college with 38,000 students granting certificates and associate degrees across a variety of educational subjects, primarily serving the adult residents of the six-county Greater Sacramento, California region. To participate in a variety of government programs providing student grants and services, ARC has to store personally identifiable information (PII) about its students to facilitate regular reporting to various supporting program agencies. Business Challenge ARC had to ensure the security of PII to help meet various compliance requirements including the Federal law regarding the privacy of students’ records, Family Education Rights and Privacy Act (FERPA).Very aware of the need to protect sensitive student information, Linda Jurgens, ARC’s Information Technology Supervisor, explained, “As a district we have implemented numerous security policies, but as a college, we wanted to assure that the student data would not be viewable to any unauthorized persons.” Technical Challenge ARC had to protect a variety of data, including MSSQL, flat files, proprietary database information and scanned document images. Consideration also had to be given to how encryption would affect applications installed on the servers as well as requirements of the operating systems.After careful evaluation the IT staff identified and decided to encrypt resources that contained high-risk data. These resources contained several servers in a mixed environment, both physical and virtual holding a wide variety of shared information; multiple Microsoft SQL Server databases; and the digital warehouse containing over 300 gigabytes of data detailing 50 years of student enrollment history. The college needed an encryption solution that could accommodate its wide array of data types without requiring changes to existing custom applications. Solution The evaluation team set out to find a flexible system that could leverage ARC’s existing Active Directory groups to assign access permissions to specific folders and be transparent to existing applications. “We met JCS & Associates at a security convention,” recalled Jurgens, “and were told about the Vormetric Data Security solution and its Active Directory capabilities.” Ann Arbor, Michigan-based JCS & Associates, Inc. is an information systems security integrator helping customers accelerate the evaluation, proof-of-concept and executive buy-in cycle for new security solutions. The ARC team reviewed several solutions alongside Vormetric. “JCS’s responses to all our questions were very clear and informative,” stated Jurgens, “In comparison to Vormetric, other products were extremely complicated or awkward in some way. Vormetric’s capabilities encompassed being able to encrypt individual folders through to entire volumes; it is application and platform agnostic; and its key management was very intuitive and smooth. We were so relieved that we’d finally found such a great fit for ARC’s needs!” ARC asked Vormetric to assist in the implementation to help meet tight deadlines. “The servers were only offline for a minimum time during the encryption procedure,” observed Jurgens. “The Vormetric consultant was on top of the entire process, and we completed the first phase of installation in four days.” Results Jurgens communicated details of the Vormetric implementation to students and faculty, “Our user community was impressed to see our commitment to data security and pleased at experiencing minimum levels of interruption during installation.” Jurgens is very happy with the transparency and ease of administration, “Vormetric Data Security is virtually invisible and does not require special groups or structures; it leverages what we already have in place and delivers on the promise of simple enterprise key management. Using our standard Active Directory groups to apply permissions really simplifies the overall administration.”

Founded in 1998, TAB Bank was originally started by parent company, Flying J, Inc. – now FJ Management, Inc. – to serve the financial needs of the $300B US and Canadian trucking industry. It quickly built one of the largest portfolios of trucking relationships and became the leader in transportation-related financing, currently with over $670M in assets and $20M net revenue. TAB Bank has subsequently expanded into other commercial industries by providing a wide range of working capital facilities, equipment financing and deposit products. Business Challenge TAB Bank desired Payment Card Industry Data Security Standard (PCI DSS) compliance because this certification is an important component for banks. Daryl Belfry, Director of IT for TAB Bank, stated, “PCI DSS requires that all stored cardholder data is encrypted, irrespective of the file type or location. We understood why this is so important but were concerned that it could negatively impact the performance of our whole infrastructure.” Technical Challenge He continued, “We knew that the encryption solution we ultimately selected had to allow us to manage access policies via a simple and intuitive front end. We needed to precisely control how users could access data – such as selectively limiting the copying of files to a removable USB device or local hard drive – as well as being able to implement explicit system policies like encrypting specific archived data.” Solution Belfry and his staff investigated a number of encryption solutions. “We felt that the user interface and policy management capabilities of the Vormetric solution were a lot better than the competition,” noted Belfry. “We liked the simplicity of the Thales approach and the manageability from an administrator perspective; System Administrators can be configured to allow execution of certain functions, while a Security Officer can be granted a superset of administration access. John Hillas, TAB Bank’s Senior Systems Administrator, commented, “The majority of our environment is virtualized using VMware with a virtual desktop infrastructure (VDI) but we also have some separate SQL Server and AIX-based database servers. Thales’ coverage of a wide variety of operating systems and infrastructure configurations allowed us to protect our complete environment, making it very attractive to us.” “A demonstration of the Vormetric solution proved that it had minimal impact on infrastructure performance, and we were so impressed we decided a proof of concept would not be necessary.” Thales eSecurity provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. The Vormetric Data Security Platform delivers industry-leading data encryption and key management capabilities without the need to modify existing infrastructure components. High performance encryption methods ensure negligible impact on transaction throughput and a sophis-ticated Web-based management console minimizes incremental operational overhead. Vormetric Data Security Manager appliances were installed in the bank’s primary data center in Ogden, Utah and at a disaster recovery facility in Salt Lake City, Utah. “We had a Thales consultant booked for three days onsite,” recalled Hillas, “but after the first day we had already achieved everything we needed! The whole implementation process was far more intuitive than we had anticipated.” Results The decision was made to keep all data, including backups, encrypted by the Vormetric solution even though the tape archival system provided its own encryption mechanism. Hillas reflected, “We explicitly configured which programs are permitted to decrypt data, so in order to facilitate controlled access to tape-based archive files we needed to know what executable code our backup system software was utilizing.” Log files generated from the Vormetric “learn” mode enabled the capture and identification of the specific application modules that would be granted permission to perform the decryption. “We love the learn mode capability,” enthused Belfry. “It logs user interactions so administrators see how data is being accessed and can then configure our data access policies to take these patterns into consideration.” Hillas added, “It’s so easy to implement the right policies from the outset.” Exceeding Expectations “The Vormetric solution provides us with all the encryption capabilities we needed to attain PCI DSS compliance,” summarized Belfry. “Since going live we’ve experienced no impact on systems’ performance. The Vormetric appliances work as described and more, and we are delighted with the solution.”

Located at the center of the nation, the Japanese town of Yamanouchi borders the world famous Joshinetsu Koger National Park, home of the celebrated hot spring dwelling Japanese Snow Monkeys. In addition, Shiga Kogen – the largest ski resort in Japan and one of the 1998 Nagano Winter Olympics locations – is situated adjacent to Yamanouchi. For two decades Yamanouchi’s Town Hall has been proactive in using technology and policies to ensure the integrity of citizen’s data. Having implemented the Japanese government’s Personal Information Security Policy mandates, the Town also has authored multiple administrative reforms that further protect the digital assets of its people and public organizations. Challenges As part of its ongoing efforts to protect data, Yamanouchi Town Hall IT staff wanted to further increase security around the volumes of personal information it held; protecting it from both external attempts to breach the data and from users with incorrect authorization credentials. In order to be viable contenders for consideration, any additional security measures had to impose minimal extra workload on the town’s small IT department. Given the need to have Internetbased services and access to data continually available to its residents, the Town Hall could not justify introducing a solution that would cause downtime during implementation or one that had the potential to create any form of delay in response time for users. Solution To assist in its research efforts, the town enlisted the guidance of security experts Ryoyo Security Services. As a subsidiary of the Ryoyo Electro Corporation, the team offered a wide range of IT-related services and a solid reputation as a leader in customer satisfaction. After assessing the situation and defining the Town Hall’s requirements, the Ryoyo team recommended the implementation of Vormetric Data Security Manager. Benefits Throughout encryption of the full suite of personal information managed by Town Hall personnel, everything proceeded smoothly, and the deployment was successfully managed in a manner that avoided any operational downtime. Today, data on every server is fully protected and even if a user gains access to a file the information remains fully encrypted and therefore totally unintelligible unless they have the correct credentials to access the data. Leveraging the highly granular segmentation capabilities of Vormetric encryption, the Town Hall IT team has enforced policies to ensure that only an absolute minimum number of users are authorized to access individual data sets. With automatic data encryption and decryption, users have seen negligible impact to application functionality or response times. Thanks to the extremely efficient and intuitive Vormetric administrative console, the workload on the IT department has remained virtually constant even though the town’s security posture has been significantly enhanced. And the citizens of Yamanouchi can be confident that, even in the event of a breach, all sensitive data is protected.

The St. Marianna Association is a network of hospitals and a medical school in the greater Tokyo area. Founded shortly after World War II, it pioneered treatment for displaced civilians and soldiers with post traumatic stress disorder. Today, the association is focused on evolving its capabilities and competencies to serve the health and wellness needs of its surrounding communities. BUSINESS CHALLENGE After the Japan Pension Service was breached in 2015, and 1.2 million people’s personal data was exposed, the country founded the National Center of Incident Readiness and Strategy for Cybersecurity (NISC). This organization spearheaded an initiative to protect Japan’s critical infrastructure – including hospitals – from cyber attacks by deploying the most advanced technologies, including encryption. From the outset it was St.Marianna’s goal to meet and surpass the NISC guidelines. The association needed encryption to secure critical data across a diverse number of discrete environments. Mr. Hosi Akaoi, St. Marianna’s chairman of the Board of Directors explained, “In the past, Japan’s medical service infrastructure has been slow to grow and strained when ramping up for natural disasters. Furthermore cyber security has lagged behind the standards implemented in Europe and the United States. It is time to expand our medical system while simultaneously improving protection for the medical information of the individuals we serve.” TECHNICAL CHALLENGE The healthcare association wanted an encryption solution that could enhance its multi-layered security architecture. Mr. Shinji Kumagai, director of the Social Systems Department reflected, “We sought to safeguard critical data at its lowest level, rendering it unintelligible even if stolen. Because of the way our applications are architected, server-level encryption was a top priority for us.” At the same time, St. Marianna needed to maintain the user experience for patients and staff with no degradation in performance. SOLUTION After assessing multiple encryption solutions, St. Marianna’s investigations culminated in the selection of Vormetric Data Security Manager and Vormetric Transparent Encryption from Thale eSecurity. The association first implemented the encryption solution in its flagship location, Megumi Hospital, Tokyo. Vormetric Transparent Encryption was deployed across all of the hospital’s file servers and the rollout proved to be exceptionally easy. Akaoi noted, “While our multi-layered network security is our main protection, now encryption forms our last line of defense. “Expansion of the scope of file encryption is proving to be effortless; the Vormetric agent is simply copied onto each server without making any changes to the system being encrypted.” RESULTS A key objective of NISC was to safeguard all critical infrastructure against cyber attacks by the 2020 Olympic Games. With the implementation of Thales eSecurity’s powerful and scalable encryption solution, St. Marianna is enjoying being ahead of that goal. The efficiency of Vormetric Data Security Manager results in end users being unaware that all the files are encrypted. Even if threat actors were to breach the St. Marianna network and access sensitive, personal information, the data is protected and the criminal would only find meaningless character strings. ENABLING A NEW PARADIGM IN HEALTHCARE COLLABORATION In Japan, an association in the healthcare sector must share data with more small-and medium-sized organizations than in any other critical infrastructure industry. After deploying the Vormetric Solution, St. Marianna achieved regulatory compliance and is enjoying the new era of security and cooperation. Kumagai concluded, “As we continue to broaden the scope of our network – and number of endpoints – we need a multi-layered security architecture that can expand with us: The powerful solutions and tools from Thales eSecurity have proven to be more than capable of scaling to meet our needs. Together, St. Marianna and Thales eSecurity demonstrate a best-in-class approach for other institutions to emulate.” LEADING THE WAY WITH A NEW ERA IN SECURITY STANDARDS Business Need: Comply with new government regulations ahead of the 2020 Olympic Games Encrypt critical data across the entire network to enable future expansion Technology Need: Enhance the security architecture by protecting data, even in the event of a breach Implement encryption while maintaining system performance for the users Thales eSecurity Solutions: Vormetric Data Security Manager Vormetric Transparent Encryption Results: Complied with critical infrastructure security regulations well ahead of the 2020 Olympic Games Deployed encryption without affecting user experience Ushered in a new era of data and security cooperation across the association Capable of supporting steady growth ABOUT THALES eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Founded in 1997, RewardsNOW offers fully turnkey, enterprise-wide loyalty programs – also known as relationship rewards programs – for hundreds of financial institutions. On the INC. 5000’s “fastest growing companies” for the past five successive years, it has enjoyed proven success in helping credit unions, and commnuity, regional and national banks provide individualized programs to offer rewards to their customers and members. Now over $15 million in revenue, the company has recently expanded into additional industry verticals – such as retail, associations and organizations, health-related, and other organizations outside of the financial industry – attract, retain and grow their customer bases. The company also launched a merchant-funded shopping network, called ShoppingFLING that provides additional value as part of a rewards program. ShoppingFLING also has been implemented as a standalone product. In order to build a tailored program containing reward discounts or other special offers to encourage continued loyalty, RewardsNOW has to assemble a detailed profile of the engagement patterns of a client’s customers. Richard Tremblay, Security Officer for Rewards- NOW, explained, “We receive full data feeds of customers’ debit and credit card transactions to comb through – using business rules that have been jointly defined – to create customized programs that will actively incent further participation.” Business Challenge The volume of transactional data needed to construct a comprehensive understanding of each client’s business environment can be enormous, and always requires careful and diligent handling. Tremblay elaborated, “As we receive credit and debit card information we have to make sure that it is stored securely and in complete compliance with the Payment Card Industry Data Security Standard (PCI DSS).” Paul Butler, RewardsNOW’s Database Development Team Leader, noted, “While we don’t actually process credit card transactions, it’s our storing of the sensitive data that makes it essential to ensure the security of the data and to conform to thePCI DSS standards.” Technical Challenge A key component of complying with the PCI DSS is the protection of cardholder information. “We wanted encryption for our file transfer protocol (FTP) server from the point we receive customer feeds, as well as other servers that needed protection,” stated Butler. “In addition, we were always concerned with the overhead imposed by key management activities and therefore wanted to streamline this function.” Tremblay added, “Prior to the first audit we worked with our Qualified Security Assessor (QSA) to do a preliminary review to prepare us for attaining PCI Level 1 certification. Even though the SQL Server database had built-in encryption, the QSA advised us that it did not satisfy the PCI Council’s criteria for data encryption at either the database or operating system levels.” Solution “We did a lot of research to find the right tools that could deliver the levels of encryption and functionality we required with a goal to select best-of-breed components,” recalled Butler. Tremblay noted, “Doing due diligence, we looked at a variety of options, including open source tools, to identify possible solutions. We found nothing suitable in open source, but among vendor solutions our investigations showed Vormetric Data Security satisfied all of our requirements – and more!” Vormetric provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. Vormetric Data Security delivers industry-leading data encryption and key management capabilities without the need to modify existing infrastructure components. High performance encryption methods ensure negligible impact on transaction throughput and a sophisticated Web-based management console minimizes incremental operational overhead. “While many companies go through a proof of concept with new security solutions, we were sufficiently confident to just bring in the Vormetric appliances,” said Butler. “A Vormetric consultant arrived onsite and helped set up the environment. The deployment experience was awesome and totally painless! The consultant walked us through device configuration using the Web-based portal to define encryption rules and mount points. We did the FTP server first and it worked perfectly right from the get-go.” RewardsNOW’s production data center is hosted by a company based in the southwest U.S. Encryption was set up to cover the core Windows-based SQL Server database cluster. “We configured guard points on all nodes of the SQL Server configuration because we run an active-active cluster and wanted to protect the database files, logs, backups and also the file shares that hang off the cluster,” stated Tremblay. Results Under PCI DSS specifications, encryption key rotation must be performed at least once a year. “We had a Vormetric support technician on the phone and he walked us through the key rotation process; it was quick and totally straightforward,” said Butler. “This was huge accomplishment because we didn’t have to rekey each individual guard point. It was a ten minute exercise at most!” reflected Tremblay. Most importantly, RewardsNOW achieved its goal of being PCI DSS Level 1 compliant on schedule. “The Vormetric implementation was so fast and smooth it allowed us to focus on other areas that needed to be addressed to meet the regulations in the tight timeframe,” remarked Butler. Flexibility for Future Growth In addition to the current server cluster, the company is evaluating locating a secondary site for disaster recovery purposes on the east coast. “The Vormetric solution can handle a geographically dispersed active-passive cluster configuration just as well as it protects our current configuration,” stated Butler, “and we really appreciate the flexibility that this provides.” Tremblay concurred, “To be able to have a transparent solution that can flexibly accommodate any infrastructure configuration as we continue to grow is very valuable to us, and will obviously save us capital expenditure in the future.” He concluded, “We are a modest IT organization in a rapidly growing company so we look for partners that can deliver reliable products that work as described, provide support when we need it, and accommodate our growth: Vormetric does exactly all of this.”

Founded in 1985, Medical Consultants Network (MCN) is a national provider of medical judgment services. MCN offers a comprehensive range of review services including Independent Medical Evaluations (IMEs), Peer Reviews, Utilization Reviews, Bill Reviews, Pharmaceutical Reviews, and a broad spectrum of services related to Workers’ Compensation as well as Disability Claims and Auto/Liability claims. For example, when an employee is injured on the job and there are questions regarding their treatment, a state department of labor may ask for an independent doctor to review their history, make healthcare recommendations, and answer specific questions; MCN performs examinations in all 50 states, Washington DC, and Canada. Originally a regional company based in Seattle, MCN quickly outgrew its northwest roots as it recognized that examinations needed to be near the claimant, and claimants live throughout the U.S. MCN was the first Independent Review Organization (IRO) in its field to create a national network (in 1997) to connect physicians and consultants to claimants and clients. Today, the network encompasses more than 23,000 entities and MCN has offices, staff, and call centers located in Alabama, Florida, Georgia, Illinois, Indiana, Michigan, New Jersey, New York, Oregon, Texas, and Washington. Business Challenge MCN links its offices and staff in real-time via a proprietary, secure information system that tracks all service requests and workflows. The company continues to be at the forefront of directly interfacing with clients’ claims systems. Several years ago, given changes due to federal regulations and client needs, and to maintain its best-in-class data integrity protection portfolio, MCN launched an upgrade of its data encryption processes. Technical Challenge William Ellison, MCN’s information security officer, noted, “We track detailed information about various services we perform for individual claimants and specific consultants. The data involved can be very complex because of dealing with so many healthcare entities throughout the United States and the various state and federal laws involved. We have the data broken down so everything is specific to a client and/or claimant, or what we call ‘case service.’” MCN was unsure it would find an encryption solution that could easily meet all its needs because of its broad portfolio of IT infrastructure components. Ellison commented, “We have about 70 Microsoft SQL Server databases – ranging in size up to hundreds of gigabytes and tracking information for over 30,000 healthcare providers. It’s a dynamic environment spanning a range of hardware vendors, some virtualized environments, and with several elements moving to the cloud. So we needed an encryption solution that could accommodate securing data in a wide variety of formats and capable of fully embracing our future development plans.” Solution It turned out that Vormetric Encryption was an easy choice for MCN because of Vormetric’s flexibility and ease of use. Ellison reflected, “Vormetric supports an excellent variety of file formats.” He added, “It only took the Vormetric consultant a couple of days to fully roll-out the encryption across our production and data recovery site storage devices.” MCN has a client portal – a secured web interface to its systems – where clients can access the status of their referrals as well as upload records and download reports. “There’s always a worry about malicious attacks but now we feel more comfortable because all of the information is encrypted with Vormetric both in the production databases and back-up files,” stated Ellison. Results Today, MCN’s network features secured access to data in a customized encrypted database, compliant with all applicable federal and state laws and meeting all client protocols. It enables clients to upload records, review service status and update information in a secured environment. “Our experience with Vormetric Encryption has been ‘set and forget,’” said Ellison. “We can move off one database to another and transition from one clustered environment to an alternate one. We simply set up the folders, move the data, and it is all encrypted in the process.” Securing Data is Seamless and Transparent Ellison concluded, “From a security standpoint, Vormetric’s solution just works. It was easy to set up and implement, and keeping it going is very simple. It’s never been a distraction and that’s important! As we continue to evolve our environment, I know the data will remain secure with Vormetric.”

As a leading multi-vendor cloud managed services provider, Florida-based CloudHesive is focused on helping companies realize the compelling benefits of a cloud-based infrastructure. Jim Walker, CloudHesive’s CEO, explained, “The advantages are very clear and our goal is to make the transition to a cloud ecosystem completely painless.” CloudHesive offers a broad portfolio of cloud-related services that allow a company to concentrate on running their own business, and removes concerns related to the complexities of managing an unfamiliar operating environment. Challenge Initially focused on the financial service and healthcare industries, CloudHesive is now attracting the attention of a wide range of sectors. As with any Internetrelated undertaking, security is always a major consideration. “Understanding the measures we take to protect data is probably the single biggest question we get asked,” stated Walker. “To further complicate things, the diversity of our clients, and, by extension, the variety of data we manage, means that we have to comply with a broad set of regulatory requirements, including PCI-DSS and HIPAA, as well as the applicable ISO and SSAE mandates.” Solution As a highly experienced executive in the managed services business, Walker implemented a solution in which he already had familiarity and confidence: “The team at my previous company performed a tremendous amount of research to determine the optimal way to handle encryption. When we created CloudHesive, using Vormetric Data Security Manager was a decision we really didn’t have to waste any time over!” The flexibility and ease of deployment of Vormetric Data Security Manager dovetails perfectly with CloudHesive’s services model: “We can offer a robust set of security solutions for not only our own deployments where we completely host client environments in our own cloud but also for hybrid and customers’ on-premise infrastructures.” Results Thales eSecurity’s imperceptibly low transactional overhead is one of the factors that make it the encryption solution of choice for custodians of sensitive data across the world. “Thales eSecurity provides us with an ideal platform on which to build,” noted Walker. “We’ve been able to create a sophisticated suite of services, all encrypted without any detectable impact on user throughput or response times. Also, we are able to utilize the solution’s powerful separation of duty features to maintain independence between vendors; dramatically increasing the security posture of each client.” Implementing Vormetric Data Security Manager automatically addresses the complex issue of handling client data in a manner that is compliant with all of the requirements mandated by the governing bodies of each industry. “Thales eSecurity’s flexible approach means that we don’t need to have knowledge of the nature or format of each client’s data. Our whole business model would be impacted if this wasn’t the case,” reflected Walker. Fundamentally Superior “The merits of the Thales eSecurity solution really are compelling; so much so, that we’ve launched a new ‘Encryption as a Service’ [EaaS] offering. This allows clients to maintain control of their own environment in-house and be fully protected by an industrial-strength encryption service, built on the Thales eSecurity platform, and delivered by CloudHesive,” described Walker. CloudHesive delivers its EaaS solution using highly available clusters of key management appliances, administered by the company’s team of cloud security engineers. Security policies are custom designed for each client to exactly fit their unique requirements. Walker commented, “The level of granularity that we have with Thales eSecurity allows us to offer directory- and user-level encryption, and to stipulate who has access to every single element of data. Another big selling point is that the keys are stored offsite, so neither the customer’s cloud provider nor CloudHesive have access to any client data; this is yet another example of how we reassure prospects that they can entrust us with their business.” The architecture of Thales eSecurity enables encryption to be deployed across hugely diverse environments without need for customization or complex implementation procedures. “Our clients can integrate the CloudHesive Encryption as a Service solution with whichever provider they prefer; including Amazon, IBM-SoftLayer, Rackspace, and even at their own co-location center.” Walker concluded, “We always have to answer the question of how a client’s data is going to be encrypted in the cloud but the strength of Thales eSecurity’s reputation and the superiority of its solutions allows us to quickly make this a non-issue.” “There are many companies in the cloud managed services sector but we differentiate ourselves through quality and innovation. The amazing flexibility of Vormetric Data Security Manager, coupled with its ability to flawlessly deliver enterprise-grade encryption, gives CloudHesive the agility to scale and to stay ahead.”

Digital Compliance launched its innovative Venminder solution in 2013 in response to a growing need for FFIEC-compliant vendor management within financial institutions. This cloud-based application enables banks and credit unions to meet all regulatory and business management requirements in the complex vendor management arena. Federal regulations now require annual exams (audits) to make sure financial institutions are doing due diligence in terms of securing access to their customers’ data and money. Among various regulations, the Federal Deposit Insurance Corporation (FDIC), an independent agency that governs banks, requires that private cloud data be encrypted. Business Challenge Digital Compliance prepares clients and their vendors for annual audits. Describing itself as a private cloud, the company collects proof of conformity documents from clients’ vendors either by creating a portal, or by facilitating the direct upload of information. Needing to protect this data both in transit and at rest, Digital Compliance looked for an encryption solution that embodied ease of implementation, reliability and value. Technical Challenge Although the company primarily runs a Microsoft Windows®-based environment, Brian Adams, Digital Compliance’s chief technology officer, explained, “We wanted the flexibility to be able to move pieces to different cloud environments or even to a different operating system.” Additionally, Digital Compliance wanted to offer the flexibility to have encryption at either the folder and/or file levels. Solution Adams and his team researched a variety of encryption solutions. “Vormetric gave us the flexibility that other offerings couldn’t,” said Adams. “It was the perfect value proposition, plus we already had the knowledge that it works in our industry.” Vormetric’s ability to maintain encryption in all states, permitting only authorized users access, proved to be a big advantage over other solutions. Adams noted, “What Vormetric did that nobody else could was enable our cloud computing environment to keep running backups of our software and data while all the information remains encrypted. In other words, facilitating what needs to be done at the data center to make sure we could recover the data should there ever be a failure, while keeping the data encoded and secured against advanced persistent threats.” Results Digital Compliance opted to encrypt its SQL server database. Working closely with Vormetric’s team to implement the solution, Adams described the process as “smoother than anything else we’ve experienced.” In fact, Venminder was offline for less than two hours while the encryption rolled out. When the implementation was complete Adams noted, “Everything worked perfectly. Equally important, Vormetric Encryption had no noticeable negative impact on performance.” Secured Data for Compliance Vormetric was on call and present for Digital Compliance from creating an initial proof of concept through post implementation follow up. Adams summarized, “Vormetric’s attention was particularly noteworthy. Its staff not only made sure our rollout went smoothly but that a week later, things were still on track and the configurations were all correct. It’s been ‘set it and forget it’ with Vormetric. I know our clients’ data is secure and meeting all federal requirements.”

Best known for brands such as Frosted Flakes, Rice Krispies, Special K, Cocoa Krispies, Pringles, Pop-Tarts, Cheez-It, Eggos, Kashi, and Nutri-Grain; Battle Creek, Michigan-based Kellogg Company (Kellogg’s) is a food manufacturing giant with production facilities in 18 of the 90+ countries in which it conducts business. Business Challenge Kellogg’s views technology as a key enabler in marketing, selling, and manufacturing its brands, loved by consumers around the world: It relies on best-in-class IT security solutions to keep its infrastructure and digital assets protected. Recognizing the significant importance of encryption for security and compliance, Raghbir Sandhu, chief security architect for Kellogg’s, revealed, “It is mission-critical to the company to protect our employee and customer data from cyber attacks. Implementing formal data governance principles helps us to ensure data – especially any personally identifiable information (PII) – is secure and complies with all appropriate privacy regulations in the countries in which we operate.” Technical Challenge Many encryption solutions encode data in motion but not while it is archived. Kellogg’s sought a more comprehensive solution that would encompass both states. Sandhu reflected, “The first priority was encrypting flat files and data at rest: We wanted to make sure that even if our back up tapes were stolen, our data would be safe. “The second piece of our encryption puzzle was access control. At the operating system level we needed to ensure we could clearly delineate between roles. For example, while local administrators are responsible for maintaining the systems, they should not be allowed to have access to confidential data.” Solution “We looked at disk, network, application, and file-level encryption solutions,” recounted Sandhu. “We investigated many different characteristics; including using support and maintenance expenditures to determine an accurate total cost of ownership for each solution. “Based on its successes in our evaluations we narrowed the list of candidates down to a single winner: Vormetric. We then conducted a proof of concept (POC) to ensure that system performance would not be impacted by the encoding/decoding process. The POC confirmed that we could be confident in entrusting our encryption requirements to Vormetric Data Security Manager.” The company found implementation to be quick and simple. “We started with a North American rollout, expanded to Europe, and now are implementing in Asia Pacific,” Sandhu shared. “It is easy, efficient, and flexible. Best of all, to the users it is 100 percent transparent.” Results Kellogg’s relies on an SAP ERP environment for running its worldwide operations and Sandhu was reassured that despite the sophisticated level of protection, Vormetric enabled business to continue as usual. He noted, “Other encryption solutions we considered for the SAP data would have required changes to the schema, which in turn would have violated our SAP agreement. However, Vormetric enables us to maintain the original structure while also protecting the integrity of the database.” The company is now able to encrypt all of its information, including data at rest and in the cloud. Sandhu stated, “Our internal audit team has endorsed the measures we are using to protect our data – including encryption of log files – and we are completely PII compliant. “We have a data warehouse where we store a significant amount of confidential information and it is all protected by Vormetric.” Kellogg’s system administrators are able to manipulate files without having access to the contents. Sandhu commented, “With Vormetric Key Management the encryption keys are well managed and secure. We can provide access controls based on a need-to-know basis; this granularity gives us a much better safeguard on confidential data.” Vormetric Delivers Vormetric Data Security Manager satisfied everyone’s criteria for the ideal encryption solution; Sandhu concluded, “The database administrators wanted a solution that could integrate seamlessly with SAP; the application developers needed flexibility across file types and operating systems; the security team insisted on robust separation of roles capability and encryption of data at rest; and accounting wanted optimal total cost of ownership! At the end of the day, we all agree that Vormetric is the ideal encryption solution: It is impressing us all.”

Systems East, Inc., a leading provider of comprehensive finance, billing and collection solutions, was established in 1981. Today, it specializes in the development and support of finance and collection applications both in Microsoft Windows and cloud-based environments. The company is headquartered in the Finger Lakes Region of New York State. Through Xpress-pay, Systems East has experienced a steady, controlled growth. As a direct result of its continued expansion, the company elevated its security protocols to PCI DSS Level 1, the highest in the industry. Over the last several years, the volume of payment transactions processed through Xpress-pay and Xpress-pay Mobile, the company’s integrated ePayment solutions, has increased exponentially. The dramatic throughput upsurge is due both to the continual introduction of new capabilities, such as the recurring payments functionality, and the attraction of new clients. Business Challenge “As a payment facilitator, we regularly encounter sensitive consumer information, and respect our obligation to do all we can to ensure its integrity and security” explained Peter Rogati, Systems East’s Director of Support. “Beyond the financial network’s demand for a high level of security, our continued success depends on it. The processing infrastructure and company culture must both rise to the task and encryption is one of the imperatives. Technical Challenge Although many of its clients do not mandate Level 1 compliance, it is a requirement for the majority of larger financial institutions. The company therefore elected to meet and where possible, exceed the broader scope of PCI data security requirements.This included certification with Visa Cardholder Security Program (CISP), MasterCard Site Data protection program, American Express Data Security Standards and Discover Cards DISC program. Solution As Systems East researched encryption solutions for Xpress-pay, it looked for reliability, ease of implementation and cost value. Rogati noted, “The expense associated with implementing an additional level of security was not originally in our budget, but we were obligated to make a sound decision and begin implementation.” “I researched several different companies and Vormetric was the only one that was diligent in making sure that I was well-informed and properly equipped to make such an important decision. Its staff was patient, and thoroughly answered any and all questions; they really made me feel confident that Vormetric was right for us.” Xpress-pay relied on Vormetic’s professional services for implementation, but according to Rogati, “They didn’t require as many hours as first thought: Despite allotting three days, it actually only took a day and a half. Everything we needed to encrypt was completed smoothly and without incident.” Rogati pointed out, “One advantage to Vormetric was its ability to combine file-level encryption and key management into a fully integrated package. It really is transparent to our programmers and users.” Results According to Rogati, “Xpress-pay has experienced virtually no degradation of services while running the application: Once I became familiar with the solution and transitioned from ‘learn mode’ to going live, the whole system never missed a beat. Now that Systems East is PCI Level 1 compliant, Rogati anticipates that the company’s solutions will appeal to an even broader set of clients,including the most discerning customers requiring the highest level of compliance. Vormetric Secures Data for Xpress-Pay “With Vormetric, we feel we have the best product out there – not just that it was fairly priced, but the best-in-class solution to keep our own information and our customers’ data highly secure, and with a high degree of control,” summarized Rogati.

Company Introduction Zhongxing Telecommunication Equipment (ZTE Corporation) is a global provider of communications equipment and network solutions. ZTE is a leader in technology innovation, delivering superior products and business solutions to clients all over the world. Founded in 1985, the company now has more than 65,000 employees located in 160 countries. ZTE is listed on both the Hong Kong and Shenzhen Stock Exchanges, and is China’s largest listed telecom equipment company. Zhongxing Micro Finance, a ZTE subsidiary, offers modest-sized, short-term loans at very competitive interest rates. Targeting small business owners and consumers, the majority of business is conducted online. Zhongxing Micro Finance’s objective is to extend financial services and broaden access to funds throughout China. Business Challenge As with any Internet-related undertaking, security is always a major point of consideration, especially when it involves sensitive personal information. Peter Chen, CTO for Zhongxing Micro Finance, emphasized, “Keeping client data secure is a critical matter for us. We can’t afford to have customer information compromised and we don’t want to see any damage to our own, or ZTE’s, outstanding reputations in the industry.” Technical Challenge Hacking from outside a company is always a concern for any business but recent studies have shown that insider threats are becoming a significant issue. “We wanted to identify a way to prevent our staff from being in a position where they either accidentally or maliciously could put us at risk,” commented Chen. “Our IT staff had almost unlimited access, including data in motion and at rest. Whatever solution we deployed had to have the flexibility to accommodate information in any state and any location across the whole infrastructure.” He continued, “Another challenge was how to transfer sensitive client-related data between our different systems and applications without making it vulnerable or susceptible to compromise.” Zhongxing Micro Finance handles a lot of unstructured data in the form of text-based forms, scanned images, and other financial records. “Unstructured data represents the most common format of information that we have and it was imperative that any solution could handle a wide variety of information,” said Chen. Solution Chen recalled, “We evaluated a lot of different options and decided that encryption was the best approach to address our needs. We initially investigated several encryption solution suppliers but were unable to find a something that worked well in our environment. “Feeling like we might have to make a compromise from our original requirements, we were delighted when one of our Internet security advisors recommended that we investigate Vormetric: Vormetric Transparent Encryption was exactly what we were looking for!” Results One of the big advantages of the Vormetric solution was ease of implementation: “Some of the encryption providers we considered estimated that it could take several months to encrypt all of our data. With Vormetric we were able to get everything done in two or three hours; this saved the company a lot of resources and enabled us to minimize the amount of time that we were without the enhanced level of protection,” said Chen. Zhongxing Micro Finance has a layered approach to data security: “It’s impossible for a single solution to cover all aspects of security, so we rely on a number of measures to protect our information.” stated Chen. “However, inevitably there are gaps and Vormetric is able to fill in all the holes left by our other, more traditional defenses.” Despite encrypting all of the data, users have not noticed any change in response times. “The speed of Vormetric encryption is a great advantage for us and another one of the critical reasons that we made the choice,” stated Chen. “The solution has been very stable and we use it to protect all of our sensitive data, irrespective of the format, location, or state. “With Vormetric Transparent Encryption we’ve been able to address one of my biggest concerns, that of insider threats. Now we’re able to ensure that even privileged users, like our system administrators, can’t access data in a way that could lead to compromise. Even if someone does actually manage to get to a file or even save it on a USB memory stick, there’s absolutely nothing they can do with the contents.“ He summarized, “Ensuring the integrity of client information is critically important to our company: Vormetric enables us to secure our clients’ data with the best encryption solution we know of.”

Founded in 1975, CHS is the industry’s largest independent provider of workforce health care solutions. The company offers onsite health and wellness services to Fortune 500 firms who prefer to self-insure their employees by taking on the capital liability of providing coverage. Clients depend on CHS for health and productivity management solutions including onsite primary care, health coaching, occupational health, and pharmacy services. Business Challenge CHS typically maintains information on all the employees who are eligible to participate in health care benefits for each of its clients. This results in dealing with substantial amounts of highly sensitive personal data, including health records, clinical information, and examination results. The nature of the data means that CHS must meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA). Joseph Johnson, chief information security officer for CHS, commented, “Frequently HIPAA is the primary compliance driver for how we manage client data but there is a possibility that we have to handle payment information, so conforming to the Payment Card Industry Data Security Standard (PCI DSS) also became a priority for us.” Technical Challenge CHS looked for solutions to be compliant with these standards. Johnson recalled, “The requirements around the ‘meaningful use’ of information are pushing more medical organizations into using electronic health records (EHR) which is very positive but it does present a variety of security challenges. Many current EHR applications don’t lend themselves very well to easily securing data, especially the encryption of data at rest. “We evaluated native SQL TDE encryption solutions but they ended up being extremely costly and actually offered very little in return. On top of this, certain EHR solution vendors don’t directly support encryption.” He continued, “We investigated other solutions that ultimately weren’t viable because of their need for unrestricted access into the core of our applications. So we found ourselves in a bind: The solutions were either too expensive and didn’t even meet the requirements or they were incapable of interacting with our closed source application environment. Even if we did decide on a workable encryption product, it looked like we would have to deploy a completely separate solution to handle key management, or add full time employees just for the keys and certificate exchanges.” Solution “We were very excited when we discovered the Thales eSecurity solution; by performing data-level encryption it completely avoided the need to modify the application in any way, and this alone was a big win as we did not need to involve our development or applications support teams,” stated Johnson. “Not only could it handle all of our encryption needs but it could seamlessly perform key management. The Thales eSecurity solution also gave us the ability to effectively implement role-based encryption; this was really important because some of our environments are multi-tenant and our clients are obviously very serious about data segregation. Being able to offer this level of granularity and sophistication was a really powerful driver in our decision to purchase Thales eSecurity’s solutions.” The CHS team conducted a proof-of-concept to validate expectations across all of the organization’s stakeholders. “There were absolutely no problems whatsoever and everyone quickly gave their approval to move to production,” recounted Johnson. “Once we’d done this, the impact on performance of implementing encryption across the live environment was exactly as promised; virtually imperceptible.” Results “EHR environments are not built with very strong access management capabilities. They just weren’t designed to accommodate the different roles of practitioners and explicitly control who can get to specific records. With the Thales eSecurity solution we can see exactly who is trying to view sensitive data and this has enabled us to implement very effective role-based access controls throughout our environments. We’ve been able to mitigate the data leakage issues that have traditionally plagued the healthcare industry,” noted Johnson. The ease of deploying and managing the Thales eSecurity solutions were appreciated by Johnson. He stated, “After the purchase decision is made, I think a lot of organizations overlook the level of effort and cost that goes into implementing and maintaining security in their own environment. Thales’ ability to so efficiently provide this level of sophistication takes away all those concerns about both initial and ongoing resource requirements.” He concluded, “One of the biggest fears of my peers is that they know they have to solve the issue of encrypting data but are afraid of investing in a solution that never becomes fully operational. The approach that Thales has taken with streamlining both encryption and key management has removed this concern for CHS. We have an unwavering commitment to security and protecting the integrity of our data: Thales eSecurity helps us to deliver exactly what is required.”

Crowe Horwath LLP serves clients worldwide as an independent member of Crowe Horwath International; one of the 10 largest accounting organizations in the world. With 3,000 employees in offices throughout the United States, Crowe provides audit services to public and private entities, while also helping clients reach their goals with tax, advisory, risk and performance services. Its customers primarily consist of large – and mid-market public companies as well as sizable privately-held businesses. Business Challenge As a close partner to its own clients, Crowe has to abide by whatever requirements or regulations apply to those businesses. With its highly diverse customer-base, Crowe is subjected to a multitude of datarelated mandates that impact the way it holds clients’ information. For example, the data owned by any Crowe clients that fall under the Health Insurance Portability and Accountability Act (HIPAA) must be encrypted to the required standards, both in transit and at rest. Andrew Sappenfield, assistant director for Security Compliance at Crowe Horwath, commented, “We often have to hold copies of client data, so have to ensure that we meet with the requirements that effect them, including regulations like the GLBA, SOX, HIPAA and Federal Information Processing Standards Data Encryption Standard (FIPS 140-2).” Technical Challenge Crowe’s approach had been to utilize legacy disk and database-level encryption but this was proving to be time consuming and cumbersome. Sappenfield elaborated, “They weren’t easy to administer and didn’t have good processes for managing keys. We needed to move to a centralized key management solution.” The vast majority of Crowe’s workforce is mobile and the company standardized on laptops running Microsoft Windows® and a Microsoft SQL Server-based infrastructure. Crowe wanted a flexible solution that would provide data-level encryption regardless of hardware or file type. Solution Sappenfield noted, “As we started looking at possible encryption solutions Vormetric Data Security Manager caught our attention because it utilizes a FIPS 140-2 certified hardware appliance with true centralized key and policy management designed for distributed enterprises. It also provides enterprise encryption management for SQL Transparent Data Encryption (TDE), as well as offering storage for any other encryption keys. Crowe ran a month long proof-of-concept (POC) evaluation of the Vormetric Data Security Manager appliance. “Everything was very successful, and to become fully operational we just expanded the POC,” recalled Sappenfield. “We leveraged Vormetric consultants for the final production environment roll-out. Today our SQL Server databases are encrypted using Vormetric and the data is backed-up in its encrypted format too.” Results Reflecting on the purchase decision, Sappenfield stated, “During the POC we saw instantly this would be a solution we could deploy and it would immediately provide the coverage we wanted without having to be constantly managed. It’s a huge bonus because the low operational overhead means we haven’t needed any extra administrators, which is great.” Crowe’s employees have been impressed too. “We have a couple of business units that provide solutions that are very closely monitored for throughput and response times. The stakeholders of those groups are always very vigilant about anything that could have a negative impact on their environment,” recounted Sappenfield. “We were quickly able to prove to them that not only was Vormetric a better solution for encryption than their legacy product, they actually would receive a measurable performance improvement.” In the last few years Crowe’s growth strategy, in part, has focused on making a number of significant acquisitions. Sappenfield noted, “When we acquire a company we have to assimilate new data into our operation. Now we’re able to on-board all of the company’s stored information straight into Vormetricencrypted SQL databases and make it immediately accessible, knowing that is fully secured at the data-level: It makes this part of the process very simple.” He continued, “We’re frequently asked about our encryption management strategy, both by existing accounts and prospective clients. As soon as we state that we use Vormetric, the conversation is pretty much over because of the solution’s excellent reputation throughout the industry.” Encryption Made Easy Sappenfield concluded, “For anyone considering an encryption solution I’d strongly recommend deploying Vormetric Data Security because firstly it’s solid and easy to manage, secondly it’s so beneficial to have data-level security regardless of file type, and finally, should you need it, Vormetric support is highly competent and quick to respond.”

Houston, Texas-based Empyrean is an advanced human resources technology and service company focused on administration of employee benefits for corporations of all sizes. It currently oversees the benefits packages of more than 90 organizations, managing over one million individuals. Rick Miller, vice president of information technology for Empyrean Benefit Solutions, Inc., explained, “We provide services and software to administer benefits programs, including self-service websites for administrators and staff. We deliver a fully custom .NET structure, via our Web portal, that streamlines the required infrastructure and improves efficiencies through use of a common database.” Business Challenge “To accomplish economies of scale for our clients, each database is logically partitioned but they all reside on the same pool of hardware,” commented Miller. “A recent prospective customer shared that they had experienced a data breach prior to talking to us and this resulted in them mandating that all of their sensitive information be encrypted, irrespective of location. “Originally we would only encrypt back-up copies of our databases before they were shipped to our offsite storage facility; we didn’t have the data encrypted within our data center, which we knew would be a problem for this new client.” Technical Challenge Empyrean handles massive amounts of sensitive employee data every day and while its customers need robust levels of security, there are some complicated considerations. “Our clients understandably want to know about our security procedures, such as how their data is destroyed if they should retire from using our services. But because the storage process didn’t differentiate between individual clients, it wasn’t feasible for us to go to the back-up media and erase a specific part of it,” noted Miller. Solution The company wanted to have a security solution that would set it apart from the competition and that would be sufficiently flexible to scale with client growth and accommodate individual customer needs. Miller recalled his search for the right solution, “Our original desktop encryption product turned out not to be recommended for SQL servers and it lacked the necessary key management capabilities. We also looked at a native SQL server encryption product, but this compromised our flexibility and actually required platform changes that we just didn’t have time for. “We knew we needed an enterprise-class solution, so started researching alternative options; the Thales eSecurity solutions really stood out. The ability to execute data at rest encryption, very straightforward key management and negligible impact on performance really differentiated it from the competition. We undertook a month long proof of concept and, very importantly, demonstrated that Vormetric Transparent Data Encryption gave us the ability to place private keys on specific information and be able to pin-point that data within the back-ups, which was critical for meeting our clients’ data destruction requirements.” The deployment of Vormetric Transparent Data Encryption proved to be seamless and had minimal impact on Empyrean’s clients. “We installed it across our whole environment, giving us the ability to fully leverage the sophisticated key management capabilities and to perform targeted data destruction, if needed,” recounted Miller. “The Thales eSecurity consultants’ performance was excellent and they were always able to give us answers whenever we had any questions.” Results Integrating the capabilities of Vormetric Transparent Data Encryption into its offerings is giving Empyrean tangible competitive advantage. Miller stated, “Across the board we’re seeing demand for far more rigorous search and procurement processes; having Vormetric Transparent Data Encryption enables Empyrean to demonstrate its commitment to protecting the integrity of all of our clients’ data and that we really understand their requirements.” Miller likes the partnership that Empyrean has formed with Thales eSecurity. He noted, “The experience I’ve had has exceeded expectations; I work with a lot of technology companies and implementing the Thales eSecurity solution has been remarkably smooth. It has quickly proved to be a very stable solution in our environment. I’m extremely happy.” There are many powerful aspects of the Thales eSecurity architecture: “The scalability of the solution means that there are no restrictions on how far or how fast Empyrean can grow. The data-centric strategy gives us the control and granularity our clients are demanding. And Thales eSecurity’s capabilities to handle data located in physical, virtual or cloud environments provide us with great flexibility. We’re confident that we can accommodate the data security requirements of even our most creative customers!” asserted Miller.

Known for being one of the most recommended and highest rated providers of legal management solutions, Bridgeway Software, Inc. is continually evolving its model of delivering quality software and services to clients. Justin Knowles, director of information technology and security at Bridgeway, commented, “We’re constantly expanding our portfolio, including the introduction of cloud-based applications. We wanted to ensure the integrity of our customers’ data against malicious cyber-based threats with an industry-leading protection solution.” Business Challenge Knowles stated, “With data breaches now a statistical certainty, traditional data protection technologies were no longer sufficient to protect our clients’ information and with a notable client list – most from the Fortune 1000 – our SaaS offerings make a prime target for malware such as Advanced Persistent Threats (APTs). In addition to APTs and other external threats, we needed to protect ourselves from insider attacks. Even with stringent processes and controls, we still needed to demonstrate to customers and prospects that we have these potential vulnerabilities suitably mitigated.” Technical Challenge The breadth of Bridgeway’s product portfolio attracts a wide range of client data that must be continually secured. Any viable solution needed to accommodate this diversity without requiring additional resources. Knowles recalled, “The Bridgeway team created a set of technical, business and operational requirements. Our solution had to include, at a minimum, a 128-bit AES encryption algorithm, robust key and data separation, and congruency with HIPAA requirements was imperative. We also needed policy-based encryption and the ability for centralized administration.” Solution “Having done extensive research and evaluations, only one company was able to meet all of our requirements and that was Vormetric,” Knowles recounted. “In addition to our individual selection criteria, we really liked Vormetric’s data-centric model. It’s very evident that traditional security measures are no longer sufficient to defend against cyber-based threats: The Vormetric Data Security strategy emphasizes focusing protection at the data level so even if a malicious attack gets past everything else, no harm can be done. Our client’s information is never at risk!” Bridgeway implemented several Vormetric Data Security Encryption appliances and used the Vormetric Toolkit to accelerate and automate deployments across its infrastructure. Vormetric Encryption provides enterprises with the ability to encrypt sensitive data residing in physical, virtual and cloud environments. Sophisticated access control protects both structured and unstructured data – on Linux, UNIX and Windows-based platforms – within a common infrastructure environment. Results Information security is a primary concern for enterprise clients considering any SaaS solution, never mind one that manages privileged legal information like Bridgeway. While enterprises drive to exploit the benefits of SaaS, the vendor they choose must be able to mitigate these concerns and Bridgeway does. “I’m very happy with the flexibility of the Vormetric architecture: We could have one of our appliances go offline and service offerings will continue to function using an appliance at a secondary location. Performance has been great too; our users have not been able to discern any difference in response times with encryption turned on,” reflected Knowles. He continued, “We don’t have the luxury of a massive IT or security staff, so we really appreciate the ease of operations that Vormetric gives us. The products are very intuitive and we were able to quickly gain operational proficiency. We need tools that do a lot of the ‘legwork’ for us and the inherent intelligence of the Vormetric solutions definitely enables us to make best use of our team’s resources.” Vormetric Encryption includes the Vormetric Data Security Manager which provides console functionality for centralized key and policy management within a FIPS (Federal Information Processing Standard) 140-2 certified appliance. “We’re really delighted to be able to leverage the ruling that if data encrypted to a level compliant with FIPS 140-2 is ever compromised, it is deemed unusable and considered destroyed,” noted Knowles. “This officially waives a section of the reporting and mediation requirements imposed by mandates such as HIPAA, which is great for us.” He concluded, “Given the critical importance of data protection, our selection of Vormetric solutions is definitely giving us a competitive advantage. The policy-based encryption and separation of duties, coupled with the data-centric security model puts us in a powerful position when discussing data integrity with our existing clients and prospects: The benefits are obvious and compelling.”

Jointly owned by the Bulgarian National Bank and the country’s major commercial banks, Borica-Bankservice AD develops and maintains the primary IT infrastructure for the Bulgarian payment industry. It focuses on ensuring high-quality and innovative disbursement services for retail and card payment transactions. A component of this responsibility involves interfacing with global card providers, such as MasterCard, Visa, and American Express. Business Challenge As well as being a formally stipulated mandate from the major payment card vendors, encryption is one of the fundamental business requirements for handling confidential information. Valeri Ivanov, head of information security for Borica-Bankservice, described, “We were already looking at data encryption technologies but the imperative for us to become PCI DSS compliant was a compelling reason to expedite our investigations into finding the optimal solution. “Although they were protected by traditional security measures, many of our existing applications – including several from the actual card providers themselves – needed to be encrypted to become fully PCI DSS compliant.“ Technical Challenge Ivanov continued, “We take great pride in our ability to innovate; so in addition to meeting functional expectations, any solution we bring in has to be able to accommodate any changes we want to make to the environment and without imposing restrictions on our creativity.” The constant evolution of services developed by the company drove a need for finesse: “We looked at several encryption products that took an ‘all or nothing’ approach where there was zero ability to differentiate between systems, applications, or even users,” remarked Ivanov. “Our environment is predominately Windows-based but we have some Linux and are considering introducing UNIX systems, so we needed something that was operating system neutral, as well as being compatible with both client- and server-based operating systems.” Solution “We looked at a lot of different encryption-related solutions,” recalled Ivanov, “and evaluated each one against a very structured set of measures that included criteria in areas such as functionality, flexibility, ease of use, and performance. “Our efforts culminated in a strong recommendation to purchase Vormetric Transparent Encryption. I presented this to our executive team, along with a side-byside comparison against the ‘number two’ contender, and we received an enthusiastic approval to proceed with the investment in Vormetric.” Performance was an important factor in the selection phase. “We tested many different products using a series of gigabyte files and saw zero degradation in response times or throughput with the Vormetric solution: Nothing else even came close to this level of transparency,” Ivanov reported. The implementation of Vormetric Encryption proved to be very straightforward. “We especially liked being able to initially run the solution in learning mode: It doesn’t block anything but you get a really good feel for how the systems will behave in the production environment. This was a very unique feature that made it extremely easy to transition into being fully operational and to avoid any surprises,” noted Ivanov. Results The enhanced granularity for file access levels was immediately obvious, “We really liked the fine control we had over each of the file operations; far superior to anything else we had looked at. And the ability to customise individual application access to files is just not available in other encryption solutions,” commented Ivanov. “Another major plus was that, despite repeated attempts, we just couldn’t compromise the keys in any way; this wasn’t the case with some of the products from Vormetric’s competitors.” He continued, “We take full advantage of the ‘separation of roles’ capabilities that are inherent in the Vormetric solution. We have several different key custodians and are able to ensure that we don’t have single points of exposure. “We discovered that Vormetric is one of the very few solutions that supports both client-based and server-based operating systems; most of the other options we researched only offer one or the other. We currently use Microsoft Windows® Server and Windows 7 and 8 clients but we know that Vormetric can accommodate any platform that we choose in the future and that we can continue to be in compliance with all prevailing mandates.” “Threat actors will inevitably get through even the most robust defences, so having a world-class encryption solution is especially critical for us. We had all the traditional security measures in place but adding Vormetric Encryption really is the key element in ensuring that our data remains secure,” stated Ivanov.

Founded in 1995, Focus Services is a privately owned call center service provider, specializing in multi-product telesales and customer relationship management. Headquartered in Roy, Utah, the company currently has 2,000 employees working at eight facilities worldwide. Focus Services has built its business on the simple premise that “if its staff can sell, it will always have clients who need its services” and this principle has enabled the company to excel in both the highly competitive, complex consumer and B2B markets. Business Challenge As an outsourced call center, Focus Services doesn’t directly store credit card data because payment processing is conducted via portals supplied by its clients. However, as Bill Wiser, VP of information systems, security and networks for Focus Services, pointed out, “We audio record 100 percent of our communications with customers and these recordings – where credit card data is discussed – now fall within the scope for PCI DSS compliance under which information must be encrypted. Aside from meeting this standard we also want to make sure we’re always providing a totally secure environment for our customers’ data.” Technical Challenge Focus Services has a corporate policy to store call recordings in-house for a minimum period of three years and some clients require up to a seven-year retention period. “The recordings currently occupy about 12 TB of storage,” stated Wiser. “While it’s not a massive amount of space it is significant and definitely a headache to attempt to individually encrypt the files. We were looking for an easy way to encrypt and decrypt that data.” Developed in-house, the application that Focus Services relies on to manage recordings enables employees to search using any piece of client information, to instantly retrieve a recording. Wiser explained, “We can locate and have immediate access to an audio file, consequently we wanted an encryption/decryption capability that allowed us to keep as close to real-time as possible.” The company wanted to avoid an expensive, complex encryption solution, Wiser described, “We needed to gain this new level of security in a way that would easily integrate with our current systems and that wouldn’t require hours of implementation effort.” Solution The company’s PCI compliance auditors suggested Wiser investigate Vormetric Data Security because of previous experience with its effectiveness in the call center industry. “They made the suggestion based on what they saw as being a good fit for us, and a quality product,” recalled Wiser. “So we contacted Vormetric and that’s where the relationship started. “We were able to configure our Windows® server with its storage area network to be protected by a single Vormetric Data Security Manager appliance. With the help of a Vormetric consultant we had it operational in our infrastructure in under four hours: Despite the sophistication of the solution, it more than met my requirements for a simple and straightforward install.” Results Focus Services’ employees have not experienced any degradation in recording retrieval or latency of any kind associated with encryption. “All of the transactions for call recordings take place right on the server where they are stored,” explained Wiser, “And there’s been no perceptible change in performance, which is really pleasing. “I’d anticipated that implementing encryption would require a lot of complex technical work, but I was very surprised by quickly it was to roll out: Kudos to Vormetric for making it so easy to deploy and operate.” Simply Easy Encryption Wiser plans to expand Focus Services’ use of Vormetric Encryption in the near future. He commented, “We’ve created a cloud-based solution to integrate all of our worldwide call centers into one logical view – so we can see all of our agents showing on a single dashboard – and we will need to secure the call recordings on the hosted system. We are also looking at an additional backup system for disaster recovery. Both of these new environments will end up being protected by Vormetric Data Security.” He summarized, “Vormetric Encryption is very simple to set up, and very easy to manage and operate: I don’t have to think about it every day; it’s just there and running. Additionally it gives us the ability to scale quickly when needed, knowing that it will cover a wide range of file types to give us data-level protection and PCI compliance no matter what our clients ask of us.”

Headquartered in Monrovia, CA, Green Dot is America’s leading provider of prepaid cards. Green Dot Corporation pioneered the retail prepaid debit card product and is the largest company providing such products and services. With nearly 50,000 stores nationwide selling its products, Green Dot Corporation maintains a commanding market share of the retailer-sold debit card category. Additionally, Green Dot Corporation owns and operates the Green Dot Financial Network (GDFN). GDFN is the largest domestic cashacceptance network of its kind offering prepaid card reloading and other cash collection services to America’s leading banks and financial services companies. Problem Issuing and managing card accounts comes with a high level of responsibility to consumers as well as the need to comply with the Payment Card Industry Data Security Standards (PCI DSS). The PCI DSS requires that any company who stores, processes or transmits credit card data must protect that data in very specific ways. Not only is this mandate a requirement of the card brands (Visa, MasterCard, American Express and Discover), but it has a deadline and carries fines for non-compliance. Green Dot found themselves in dire need to comply with these standards in a very short timeframe. Solution Justin Ferris, Green Dot’s Information Security lead, and CIO Mark Goldin, were charged with solving their compliance issue and securing the data within their IT environment. His first step was to choose a trusted advisor and auditing company to help with the audit of their network (also a PCI requirement). For this, Justin and Mark selected 5PEG SECURITY, a Visa Qualified Data Security Company (QDSC), and one of a relatively small number of companies qualified to perform such assessments. 5PEG was able to quickly asses the Green Dot network and determine what steps needed to be taken to sufficiently secure their sensitive credit card data and comply with the PCI standards. Both companies then turned to Vormetric. Vormetric’s unique data protection solution, Vormetric Data Security Expert Solution, enables compliance with some of the most difficult requirements of the PCI DSS. Specifically, encryption, access control and audit logging. With a lower than average product cost, an easy implementation process and no change required to existing systems, choosing the Vormetric solution enabled Green Dot to be up and running and compliant within days, rather than weeks. The value of implementing Data Security Expert extends beyond the data security it provides. Because PCI compliance must be proved year over year, for QDSCs like 5PEG and their customers, it means an easier audit process moving forward. CoreGuard tracks access – unauthorized and authorized – to all data it protects and logs that data in secure files only accessible by those who have been granted access, clearly showing that the credit card data has been and continues to be protected. The silver lining in all this is that implementation of Data Security Expert for PCI requirements automatically satisfies requirements of many other government and state regulations, such as SOX and GLBA. About 5PEG Security 5PEG SECURITY is dedicated to assisting our clients with fraud management, risk mitigation, and security assessments. Our offering of compliancy experience includes the payment industry PCI Program and a proven Sarbanes-Oxley Compliance Program. 5PEG SECURITY is a qualified assessor for the VISA/MasterCard PCI program and has been involved in that program since it’s inception in 2001. We have successfully certified PCI compliant Service Providers, Merchants, and Payment Applications. In addition, 5PEG Security also leverages its Security Consulting Services and experienced staff to assist in the remediation phases of all compliancy projects.

Nicor Gas is one of the largest natural gas distribution companies in the United States, serving more than two million customers in 643 communities. Nicor Gas operates a network of more than 34,000 miles of pipelines, connected to the largest underground storage facilities in the country. Nicor Gas adopted WAUSAU Financial Systems’ (WAUSAU) integrated receivables solution, ImageRPS®. The lockbox banking capabilities provided by WAUSAU’s ImageRPS solution enables Nicor Gas to accelerate the payment and deposit portion of its business by streamlining collection, processing and documentation for the approximately 80,000 payments Nicor Gas receives every business day. Business Challenge In addition to the normal information technology best practices around security to minimize the risk of fraud and abuse, Nicor Gas needed to comply with the recently enacted Illinois state law protecting consumer information – the Illinois Personal Information Protection Act (PIPA). A multidisciplinary task force reviewed computing infrastructure including applications, databases and file shares that might contain Personally Identifiable Information (PII) affected by the Illinois PIPA. The internal task force identified the WAUSAU ImageRPS application performing lockbox work as a system requiring data protection. Technical Challenge Nicor Gas identified the ImageRPS production data as requiring remediation. The ImageRPS archives can be encrypted by the ImageRPS application, but the ImageRPS production data containing PII was “in the clear” and posed a data breach risk. Nicor Gas required a transparent solution that would protect the sensitive data generated by the WAUSAU ImageRPS application while having a negligible impact on system performance. As Mark Guth, the Senior Manager of Information Security at Nicor Gas, explained, “We needed to encrypt information without interfering with the performance of the WAUSAU application. As you apply encryption to files that the WAUSAU system uses, the system cannot slow down.” Requiring significant system changes would be costly and time-consuming, so any security solution had to be transparent to the ImageRPS application. Solution Nicor Gas deployed Vormetric Data Security to protect the image data created by the WAUSAU solution. The ImageRPS application runs on a Microsoft Windows Server 2003 virtual machine in a VMware virtual environment with data residing on a Storage Area Network (SAN). The Vormetric Data Security agent resides on the Windows Server machine and is managed by the Vormetric Manager appliance for policy and encryption key management. Nicor Gas was able combine the Vormetric deployment with an ImageRPS update required for the US Federal Check 21 Act. As Guth explained, “We had refreshed our test environment as part of the Check 21 process, and we were able to test both at the same time. We ran a subset of checks through the test environment without Vormetric and then with Vormetric, and the performance results came out equal. We tested response times of the systems and there was no recognizable difference in response time.” After completing the test and staging process, Nicor Gas moved the configuration into production. Results Nicor Gas lockbox data is now protected by the Vormetric Data Security. Commenting on the Vormetric interaction with ImageRPS, Guth observed, “The transparency turned out to be very positive. It really turned out to be as seamless as advertised. We know the data at rest is secure. It mitigated the risk we had with the Illinois Personal Information Protection Act.” After proving the Vormetric solution protects lockbox data, Nicor Gas is now considering expanding its deployment of Vormetric file encryption to protect fileshares containing sensitive information. Vormetric Data Security for Banking Vormetric provides a proven approach to securing lockbox banking data that meets rigorous data governance and compliance requirements. Vormetric Data Security can be quickly deployed to secure data without changing to the Lockbox banking application or the underlying hardware infrastructure. Utilizing high performance encryption, this transparent approach enables enterprises to meet data governance requirements with a rigorous separation of duties without changing the application performance characteristics.

British Columbia Automotive Association implements Vormetric Data Security to protect customer information across heterogeneous databases, enterprise applications, and document management systems. Problem British Columbia Automobile Association (BCAA) is a leading provider of emergency roadside assistance, insurance, and travel services. With nearly 790,000 members and $130 million in revenues, BCAA is the largest organization of its kind in B.C. and the fourth largest CAA-affiliated association in Canada. Like thousands of other large enterprises, BCAA needed to protect sensitive customer information and enforce compliance with industry regulations, including the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS mandates include data encryption, protection of stored cardholder data, detailed auditing and logging of all access attempts, and controls on those who are authorized to view or work with the data reliably and securely. To complicate matters, BCAA had a heterogeneous IT environment which included applications such as Open Text Hummingbird document management, Business Objects, Microsoft Exchange, DB2, SQL Server and various file servers. Also, part of BCAA’s mission is to earn its members’ and customer’s trust by exceeding expectations for high value, enjoyment and peace of mind. To achieve this, it was of paramount importance to BCAA that they put their best efforts towards protecting sensitive personal information. Solution BCAA selected Vormetric based on top-notch performance, strong access controls and the ability to meet their diverse data protection needs through an easy to manage, centralized solution. Vormetric delivered BCAA centralized data protection, regardless of the file, application or database type, and unlike other encryption solutions, Vormetric did not require any underlying changes to these applications. As a result, BCAA saved the time and costs associated with those development cycles. Additionally, Vormetric requires almost no administrative support as it encrypts and protects data, no matter where in the enterprise it resides. Vormetric Data Security enabled BCAA to meet these PCI DSS requirements, as well as internal corporate data protection policies, to protect valuable information wherever it is stored within the enterprise. Vormetric made it easy for BCAA to account for the systems that needed compliance during implementation because Vormetric Data Security doesn’t create any changes in the applications and closes compliance gaps. About BCAA BCAA is dedicated to meeting the needs of its members and customers throughout B.C. and the Yukon, connecting them with a team of membership, automotive, travel and insurance professionals. With nearly 790,000 members and $130 million in revenues, BCAA is the largest organization of its kind in B.C. and the fourth largest CAA-affiliated association in Canada. For the past three years, BCAA was named one the 50 Best Employers in Canada by international HR consultants Hewitt Associates and the Globe & Mail’s Report on Business magazine. In addition, BCAA Insurance has been awarded the highest satisfaction rating among home insurance providers by consumer research group, J.D. Power and Associates.

Rausch, Sturm, Israel, Enerson & Hornik, LLC (RSIEH) is a debt collection law firm headquartered in Wisconsin with offices in 13 states and a nationwide network of firms for clients seeking additional coverage. In service of premier multi-state law firms, RSIEH operates facilities with state-of-the-art data management, software, imaging, call center and analytics. Business Challenge RSIEH operations include the collection of credit card information and cardholder data. RSIEH needed to achieve compliance with the Payment Card Industry’s Data Security Standard (PCI DSS). Lawyers and staff regularly receive and process documents containing credit card holder data affected by PCI DSS, and consequently clients required RSIEH to get certified for PCI DSS. Rick Olejnik, RSIEH’s Chief Information Security Officer (CISO), commented that, “In the legal collection industry, PCI is a requirement getting applied to firms, and we needed to encrypt data at rest to get the PCI certification.” The PCI DSS Requirement 3 to “protect stored cardholder data as part of ongoing operations. Technical Challenge RSIEH collects sensitive information in several locations with the largest repository being the Commercial Legal Software (CLS) Collection-Master application, a commercial off-the-shelf application that provides a critical element for RSIEH’s business operations. CLS Collection-Master processes a variety of documents and information involved in the debt-collection process, much of which contains sensitive cardholder information, and it does not have integrated data security functionality. PCI DSS required securing the volumes of images containing cardholder data used by CLS Collection-Master. RSIEH needed a solution that could secure both structured database information and unstructured image files used by the CSL Collection-Master application. RSIEH research various options and had initially attempted to use open source TrueCrypt volume encryption software, but found that the offering broke IT operations processes including backup and vaulting. Solution RSIEH researched the market and commissioned an outside resource that located Vormetric Data Security as an option to encrypt both structured and unstructured data. RSIEH needed to protect Windows Server 2008 R2 servers running in a VMware virtual environment with data residing in a Storage Area Network (SAN). While the CLS Collection-Master information was unstructured flat-file information, other servers requiring security included SQL Server 2008 R2 and SQL Report Server. RSIEH’s CISO Olejnik observed that, “We brought [Vormetric] in, tested it, threw everything at it to see if anything broke. Se threw SQL, flat files and a variety of other workloads at it, but have not found a real problem or noticed any system slowdown.” Results RSIEH was able to obtain their PCI DSS certification and currently has Vormetric Data Security protecting both structured and unstructured data. This PCI DSS certification is a milestone as RSIEH works to obtain ISO 27001 certification in the near future. Vormetric Data Security Vormetric provides a proven approach to securing data affected by PCI DSS. Vormetric Data Security can by quickly deployed to encrypt data without changes to applications, databases or the underlying hardware infrastructure. Utilizing high performance encryption, this transparent approach enables enterprises to meet data governance requirements with a rigorous separation of duties without changing the application performance characteristics.

A leading global human capital and management consultancy handling more than 70 million customer interactions every year across multiple geographic regions throughout Europe. Business Challenge A core part of the consultancy’s operations revolve around the collection and careful management of individually identifiable human resource records. Given the huge volume of sensitive data that its operations hold and manage across interconnected networks, strict privacy control and access policy are a necessity for the company. In light of plans to consolidate aspects of its Pan-European operations, it became a priority to implement a data protection solution which could address various data privacy compliance concerns in the EU and worldwide. Due to the sensitivity of the data involved, it is essential that the company be able to demonstrate to its customers that their data could not be accessed indiscriminately, and that customer data could not be copied, duplicated or transferred across international borders in contravention of local legislation stemming from the EU Data Protection Directive. Evolving European Union (EU) data protection regulations – including the UK Data Protection Act – require that the firm must be able to continually demonstrate to customers that it is compliant with the latest industry and governmental requirements. In addition, the new USA PATRIOT Act presented a serious business challenge for the company as customers in Europe required clear and auditable processes be put in place to ensure that only certain staff can access certain types of data, as well as that specific data cannot be transferred or duplicated across international borders. Robust encryption with monitored key management was determined the best way to overcome not only the risk posed by increasingly prevalent cyber attacks, but to also meet stringent regulatory compliance demands and issues surrounding ‘data sovereignty’ in a consolidated virtual environment. Technical Challenge Despite having existing data security solutions in place to protect sensitive customer data, the company found itself in a position whereby it needed a more powerful and simple way to manage security across a variety of systems and locations. The Vormetric Data Security solution addressed the security and access policies required to manage and secure the data of its growing customer base. A spokesperson for the company said, “We’re under a lot of pressure to demonstrate separation of duties to our end users, many of which being large banks and other international financial institutions. As a result, we must have security provisions in place that allow us to report precisely on where data is stored, where it can be accessed from and who can access it.” Solution Given that the company’s customer interactions are highly transactional by their very nature, encryption performance and the impact on the speed and reliability of systems, was of utmost concern. The company has no option but to implement strict security measures, but at the same time could not tolerate any significant impact on application performance. Prior to going into production with the solution, the Thales eSecurity solution was deployed in ‘learn mode’, enabling the implementation of polices in a draft form without explicitly enforcing them. This low-risk approach, initially applied to a disaster recovery environment, enabled the company to test and review policies before applying them to the production environment. After this highly successful proof of concept trial, the Vormetric Data Security solution was applied to a heterogeneous database environment. Results Implementation of the solution took just one month and was deployed during scheduled database maintenance, minimizing the risk of downtime or the violation of any client agreements. Thales eSecurity Encryption agents reside on the company’s servers and evaluate all information requests against customisable policies, providing intelligent and seamless security and access control over sensitive data. Following implementation, a spokesperson for the company commented that, “There had been extremely minimal impact on operations and no material degradation in performance” – demonstrating how the product’s design is such that it mitigates impact on database and application performance. He continued, “We needed a data protection strategy that not only secured our data stores effectively but also allowed us to implement a policy to monitor data movement – identifying who accessed what and where. The Thales eSecurity solution allows us to simplify separation of duties and, with initial roll-out taking just one month, disruption and administration-overhead has been minimal.” Vormetric Data Security The Vormetric Data Security product family provides a single, manageable and scalable solution to manage any key and encrypt any file, any database, any application, anywhere it resides — without sacrificing application performance and avoiding key management complexity.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Healthcare information Credentials Require data protection during the following circumstances: Database security Intellectual property Data segregation Contractual requirements (either with a customer or for suppliers) Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Protect sensitive data in Big Data deployments Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators UNIX/LINUX root users Security administrators Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data A data-centric strategy locks down the data, and removes risk from privileged users Data is the main target for APTs and server data is the biggest target

Case Study Customer: A leading Fortune 500 corporation providing financial data services with 19,000 employees generated in excess of $4 billion in revenue from clients including financial institutions, telecommunications and utility companies, healthcare and insurance providers, retailers and municipalities. Business Challenge An important component of this commerce systems provider's business operations involves maintaining credit and debit card information on be half of financial services clients. In order to provide the highest levels of security and customer confidence, it participates in the Payment Card Industry’s Data Security Standard (PCI DSS) which provides a stringent set of requirements for handling and protecting sensitive card-related data. The company, a long-standing supporter of PCI DSS, has always been proactive in ensuring that its environment exceeds the expected compliance requirements. As part of the initial ramp up to gain compliance the company determined the need for a robust, centralized encryption and key management solution. Technical Challenge Potential data security solutions were identified and evaluated against a detailed set of criteria. In addition to flawless performance in encryption and key management, contenders were assessed on heterogeneous capabilities, impact on transaction processing time and the ability to handle a wide variety of applications and data repositories. The Technical Project Manager for the commerce systems provider recalled, “We looked at many products, including native solutions for our Linux and IBM AIX platforms, and even several open source candidates. It rapidly became apparent that the Vormetric Data Security solution was coming out on top.” Solution Having selected Vormetric Data Security, a two month proof of concept was conducted using data located in servers running the IBM AIX operating system. The Technical Project Manager commented, “We deliberately picked a very challenging scenario to test the application. We knew that if things worked well, deployment into a more standard environment would be easy.” After a highly successful proof of concept, the Vormetric Data Security solution was fully incorporated into the commerce systems provider’s diverse infrastructure. Results Following the Vormetric Data Security deployment, the company was able to attain PCI DSS compliance within its planned implementation schedule. The current infrastructure utilizes virtual desktop infrastructure (VDI) and Hypervisor from VMware, with direct-attached SCSI drives containing approximately 5 TB of encrypted data. The Technical Project Manager stated, “The combination of Vormetric Data Security and our VMware VDI environment provides us with great protection. There is multi-factor authentication to get to the virtual environment and then an arsenal of policies to guard the data inside of the VDI; all contributing to helping us exceed the rigorous PCI DSS audit requirements.” In the three years since the original proof of concept was completed, the solution has continued to excel. The Technical Project Manager commented, “Once configured, the Thales eSecurity solution really just runs itself. We don’t have to explicitly manage anything and despite the sophistication of the product, the Web-based management console makes administration a very straightforward task.” He continued, “Right from the outset, we knew that we could not tolerate any negative impact on the speed of processing card transactions. We’ve been able to successfully layer the comprehensive Thales eSecurity capabilities on top of our existing heterogeneous environment with no discernable drop in transaction throughput. “The Thales eSecurity support team is always accessible and committed to doing whatever it takes to ensure we are successful. It is very clear that the whole company views our relationship as a true partnership.” Vormetric Data Security Thales eSecurity provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. Vormetric Data Security delivers industry-leading data encryption and key management capabilities without the need to modify existing infrastructure components. High-performance encryption methods ensure negligible impact on transaction throughput and a sophisticated Web-based management console minimizes incremental operational overhead.

Challenges Is concerned about protecting the following types of information: Credit Card information Require data protection during the following circumstances: Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Uses the following SIEM solutions to identify possible internal threats or APTs: RSA Envision FireEye Results Purchased Vormetric Data Security for the following reasons: PCI requirements Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Employee personally identifiable information (PII) Mission-critical text, voice, and video information Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Contractual requirements (either with a customer or for suppliers) Security of data during hardware repair or disposal Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Secure personal information Meet the electronic code of federal requirements for compliance with the HIPAA Security Rule Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including APTs and zero-day attacks Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Engage in ongoing monitoring and reporting Uses the following SIEM solution to identify possible internal threats or APTs: RSA Envision Results Prevents the following insiders from accessing protected data with Thales eSecurity: UNIX/LINUX root users Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Intellectual property Customer PII Require data protection during the following circumstances: Database security Intellectual property Data segregation Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Secure personal information Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Create strict access policies that ensure only authorized users can access sensitive information Establish an appropriate separation of duties between IT operations and IT security Uses the following SIEM solutions to identify possible internal threats or APTs: IBM Q1 Labs Splunk Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators UNIX/LINUX root users Purchased Vormetric Data Security for the following reasons: A data-centric strategy locks down the data, and removes risk from privileged users Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 8 out of 10.

Challenges Is concerned about protecting the following types of information: Healthcare information Employee PII Customer PII Require data protection during the following circumstances: Database security Unstructured data security Contractual requirements (either with a customer or for suppliers) Security of data during hardware repair or disposal Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Secure personal information Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Enable large, consolidated datacenters to segregate and control data to meet the legal obligations of data across borders compliance measures without modifying applications or storage infrastructure Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Establish an appropriate separation of duties between IT operations and IT security Protect cloud deployments securely Uses the following SIEM solutions to identify possible internal threats or APTs: AlertLogic Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Credit Card information Employee personally identifiable information (PII) Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators UNIX/LINUX root users Purchased Vormetric Data Security for the following reasons: Application and system independent; cheaper than Oracle’s database encryption product Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Customer PII Require data protection during the following circumstances: Database security Contractual requirements (either with a customer or for suppliers) archive data at rest (on tape) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Protect cloud deployments securely Meet ISO 27001 requirements Uses the following SIEM solutions to identify possible internal threats or APTs: Splunk Symantec Security Information Websense Results Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Credit Card information Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Use Case Is concerned about protecting the following types of information: Credit Card information Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Database administrators UNIX/LINUX root users Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business Rates the likelihood of recommending Thales eSecurity as 9 out of 10.

Challenges Is concerned about protecting the following types of information: Healthcare information Employee personally identifiable information (PII) Mission-critical text, voice, and video information Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Data segregation Contractual requirements (either with a customer or for suppliers) Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure and controls access to ePHI – both unstructured medical imagery or structured database information from HIPAA/HITECH Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Uses the following SIEM solutions to identify possible internal threats or APTs: Splunk Symantec Security Information Trustwave Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Database administrators UNIX/LINUX root users Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Intellectual property Require data protection during the following circumstances: Intellectual property Data segregation Legacy application security Security of data during hardware repair or disposal Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Enable large, consolidated datacenters to segregate and control data to meet the legal obligations of data across borders compliance measures without modifying applications or storage infrastructure Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Uses the following SIEM solutions to identify possible internal threats or APTs: McAfee Nitro Security RSA Envision Splunk Symantec Security Information Trustwave Dell SecureWorks Results Prevents the following insiders from accessing protected data with Thales eSecurity: Security administrators Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Credit Card information Customer (PII) Require data protection during the following circumstances: Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Engage in ongoing monitoring and reporting Uses the following SIEM solutions to identify possible internal threats or APTs: Splunk Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Mission-critical text, voice, and video information Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Data segregation Contractual requirements (either with a customer or for suppliers) Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure personal information Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Uses Vormetric Data Security to achieve the following: Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Engage in ongoing monitoring and reporting Establish an appropriate separation of duties between IT operations and IT security Uses the following SIEM solutions to identify possible internal threats or APTs: HP Arcsight Symantec Security Information IBM TSIEM Solutionary Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Database administrators UNIX/LINUX root users Security administrators Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Intellectual property Customer PII Require data protection during the following circumstances: Unstructured data security Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS Meet national data protection laws including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Provide security, access control and reporting mandated by Sarbanes-Oxley, GLBA, and Basel III Uses Vormetric Data Security to achieve the following: Create strict access policies that ensure only authorized users can access sensitive information Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Incorporate security intelligence that generates log information for behavioral analysis Establish an appropriate separation of duties between IT operations and IT security Uses the following SIEM solutions to identify possible internal threats or APTs: Bitacora Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Rates the likelihood of recommending Thales eSecurity as 7 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Healthcare information Customer PII Require data protection during the following circumstances: Database security Unstructured data security Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Secure and controls access to ePHI – both unstructured medical imagery or structured database information from HIPAA/HITECH Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Protect sensitive data in Big Data deployments Uses the following SIEM solutions to identify possible internal threats or APTs: Log Logic Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Database administrators Security administrators Purchased Vormetric Data Security for the following reasons: A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 9 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Employee PII Customer PII Require data protection during the following circumstances: Database security SAP Unstructured data security Data segregation Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Sensitive data identified by our company Uses Vormetric Data Security to achieve the following: Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Uses the following SIEM solutions to identify possible internal threats or APTs: RSA Envision Splunk Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators UNIX/LINUX root users Security administrators Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 8 out of 10.

Challenge Is concerned about protecting the following types of information: Healthcare information Intellectual property Employee PII Mission-critical text, voice, and video information Customer PII Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Data segregation Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Secure and controls access to ePHI – both unstructured medical imagery or structured database information from HIPAA/HITECH Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Enable large, consolidated datacenters to segregate and control data to meet the legal obligations of data across borders compliance measures without modifying applications or storage infrastructure Implement security controls for addressing DHS Sensitive Systems Policy Directive 4300A and the Sensitive Systems Handbook Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Engage in ongoing monitoring and reporting Uses the following SIEM solutions to identify possible internal threats or APTs: Splunk Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Network administrators UNIX/LINUX root users Purchased Vormetric Data Security for the following reasons: A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Efficient, effective, and company is an outstanding partner Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

As one of North America’s premier drug store chains this company handles large amounts of sensitive personal and business-related information. One factor in the impressive longevity and growth of the organization is the encouragement of continual innovation to create new products and services that benefit the organization’s large customer base: These include online prescription refills, web and phone-based medical advice hotlines, and a wide range of health and wellness programs. Business Challenge With many hundreds of retail locations and a large headquarters presence, maintaining rigorous standards for the protection of data is a constant priority. The nature of the company’s business involves many different types of data – from patient records to financial information and intellectual property – each falling under the directives of a variety of governmental and industry requirements. Maintaining compliance – either voluntarily or under regulatory mandate – requires that a number of security measures be in place at all times. A critical element of the company’s multi-layered defense strategy involves the use of encryption to encode sensitive data; in order to ensure that the infrastructure continues to be populated by best-in- class products, it was determined that a new encryption solution should be identified, tested, and implemented. Technical Challenge To support the pharmacy chain’s constant release of new capabilities for its employees and customers, it was imperative that the IT infrastructure – and all its constituent components – be commensurately flexible and scalable. Reflecting the diversity of data under its control, the company placed an emphasis on being able to choose if individual files needed to be encrypted or not: Not every file needs securing, so the ability to accurately differentiate between candidates became a key selection criterion in the search for a suitable encryption solution. Solution Following a period of investigation the short list of viable contenders was narrowed down to one solution: Vormetric Transparent Encryption. The company’s director of network and security recalled, “We had an exhaustive list of evaluation metrics and used these to uncover that Vormetric was clearly the best solution for us.” A proof of concept was undertaken to verify performance in the organization’s own environment: “We subjected the Vormetric solution to a wide range of challenges – including regression testing – and it performed admirably,” the director noted. “We were able to confirm that it really was the most flexible option out of everything we’d reviewed and had the ability to execute across all the different scenarios we threw at it.” Once the decision to proceed had been made, a pilot involving 10 stores was conducted to validate the implementation procedures. Following the successful completion of the trial, the remaining stores were deployed in batches of 40-50 each week. The security expert extolled, “We were able to do the full rollout from a central location: Saving us considerable time and money when compared with the alternative of visiting each one of the many hundreds of sites.” Results Implementation of Vormetric Transparent Encryption ensures that sensitive information is never exposed, irrespective of its state, location, or format. “Vormetric now protects everything we need encrypting, including data at rest; making it ideal against any network-sourced malware attacks that do manage to evade our other measures,” the director commented. He continued, “The inherent flexibility of the Vormetric architecture makes it ideal to support our current operational model but equally important, we don’t have to worry about encryption-related issues restricting any of the new capabilities we want to implement in the future. “Vormetric is totally application transparent and the ability to protect data is not impacted by modifications to key infrastructure components, like changes to our database platform.” To keep business running smoothly in its hundreds of branch locations, the company has an in-field service unit replacement policy that includes swapping out disk drives as a resolution for hardware and software problems. The use of Vormetric encryption ensures that even when physically removed from the stores, the contents of every drive continue to be secure. Performance And Protection Vormetric Key Management’s extremely granular level of control gives the security team the capability to precisely specify which users are permitted access to individual data elements across the network. “Despite the dramatically enhanced levels of protection and control, performance has been outstanding. Prior to the proof of concept we did have some concerns about the ability of certain of our legacy infrastructure products to support the new functionality but we’ve had zero negative feedback from any users,” remarked the company’s director of network and security. He summarized, “Encryption is a critical component in our security strategy but it also needs to function in a way that doesn’t impose limitations on where we want to take the business. Vormetric gives us the protection, the flexibility, and performance – all with the right cost of ownership – to make it a compelling addition to our environment.”

Challenge Is concerned about protecting the following types of information: Credit Card information Healthcare information Employee PII Customer PII Require data protection during the following circumstances: Database security Unstructured data security Contractual requirements (either with a customer or for suppliers) Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Secure and controls access to ePHI – both unstructured medical imagery or structured database information from HIPAA/HITECH Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Incorporate security intelligence that generates log information for behavioral analysis Uses the following SIEM solutions to identify possible internal threats or APTs: LogRythm GFI Languard Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators UNIX/LINUX root users Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenge Is concerned about protecting the following types of information: Credit Card information Healthcare information Intellectual property Customer PII Require data protection during the following circumstances: Database security Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Secure and controls access to ePHI – both unstructured medical imagery or structured database information from HIPAA/HITECH Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Uses the following SIEM solutions to identify possible internal threats or APTs: Log Logic Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Database administrators UNIX/LINUX root users Security administrators Purchased Vormetric Data Security for the following reasons: A data-centric strategy locks down the data, and removes risk from privileged users Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 9 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Employee personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Results Purchased Vormetric Data Security for the following reasons: Covers many platforms

Challenge Is concerned about protecting the following types of information: Financial data Employee personally identifiable information (PII) Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Enable large, consolidated datacenters to segregate and control data to meet the legal obligations of data across borders compliance measures without modifying applications or storage infrastructure Uses Vormetric Data Security to achieve the following: Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Uses the following SIEM solutions to identify possible internal threats or APTs: IBM Q1 Labs Results Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs

Challenge Is concerned about protecting the following types of information: Financial data Credit Card information Credentials Require data protection during the following circumstances: Database security Unstructured data security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Uses the following SIEM solutions to identify possible internal threats or APTs: McAfee Nitro Security Splunk Results Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business Rates the likelihood of recommending Thales eSecurity as 9 out of 10.

Challenge Is concerned about protecting the following types of information: Financial data Credit Card information Intellectual property Employee personally identifiable information (PII) Mission-critical text, voice, and video information Customer personally identifiable information (PII) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Secure personal information Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Establish an appropriate separation of duties between IT operations and IT security Uses the following SIEM solutions to identify possible internal threats or APTs: HP Arcsight Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Purchased Vormetric Data Security for the following reasons: A data-centric strategy locks down the data, and removes risk from privileged users

Challenge Is concerned about protecting the following types of information: Healthcare information Employee personally identifiable information (PII) Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure and controls access to ePHI – both unstructured medical imagery or structured database information from HIPAA/HITECH Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Engage in ongoing monitoring and reporting Establish an appropriate separation of duties between IT operations and IT security Uses the following SIEM solutions to identify possible internal threats or APTs: RSA Envision Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Purchased Vormetric Data Security for the following reasons: A data-centric strategy locks down the data, and removes risk from privileged users Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Customer (PII) Require data protection during the following circumstances: Database security Unstructured data security Contractual requirements (either with a customer or for suppliers) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Incorporate security intelligence that generates log information for behavioral analysis Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Engage in ongoing monitoring and reporting Uses the following SIEM solutions to identify possible internal threats or APTs: Integritysrc.com Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Intellectual property Employee PII Customer PII Credentials Require data protection during the following circumstances: Database security SAP Legacy application security Security of data during hardware repair or disposal Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the PCI DSS that call for the protection of cardholder information Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Secure personal information Enable large, consolidated datacenters to segregate and control data to meet the legal obligations of data across borders compliance measures without modifying applications or storage infrastructure Uses Vormetric Data Security to achieve the following: Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Engage in ongoing monitoring and reporting Protect cloud deployments securely Protect sensitive data in Big Data deployments Results Prevents the following insiders from accessing protected data with Thales eSecurity: UNIX/LINUX root users Security administrators Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Thales eSecurity sets controls around the data and examines controls from the inside out Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

How an innovative Company Added Convenience for Commuters While Delivering Iron-clad Security The Challenge: Maximize Security For Mobile Transit Purchases Without Slowing Performance Snapper, an enterprising New Zealand company, set out to improve public transportation for riders in Dublin, Ireland. The National Transport Authority of Ireland wanted to make paying for transit much more convenient for their riders, even letting them load their cards while a bus approaches within sight. Snapper needed to give NTA’s customers a way to check their balance and instantaneously re-load their LEAP transit cards using their smart phones. Their solution needed to serve up to 500 people topping up at the same time—and to do so with the utmost security. The Solution: Smart Phone Payments Secured By Thales HSMs Snapper designed a solution that lets customers load their transit accounts by tapping their smart cards to their phones and making payments through Snapper’s app. The phones recognize the contactless chips embedded in the cards, triggering Snapper’s app to open. The app authenticates and reads the cards and guides customers through PCI-compliant credit card transactions. Customers then use the transit cards to travel by bus, tram, and rail in Dublin. To help secure their solution, Snapper turned to Thales nShield HSMs (hardware security modules). Snapper’s app encrypts customer transaction data, and uses nShield HSMs to manage the encryption keys critical to safeguarding the data. For high assurance security, all encrypted data is stored in the contactless chips in the smart cards. CodeSafe Helps To Secure Transactions The security of Snapper’s solution relies on managing encrypted data, keys, and, to ensure integrity, the mutual authentication between the smart cards and HSMs—all driven by Snapper’s custom routines. These sensitive routines and the data they handle would be vulnerable to threats if exposed outside the closed system. Thales CodeSafe provided the protection Snapper needed by securing the crypto code within the boundaries of their nShield HSMs. nShield Lets Customers Control Their Keys The NTA’s master keys are their most valuable secrets and the NTA’s IT managers follow very strict processes to protect them. Thales nShield HSMs and the associated Security World architecture fully supported these key handling processes and made it easy for the NTA to manage all production key related functions securely and without involvement from Snapper. Thales’s Architecture Supports Strict Policy Adherence Security World greatly reduces the risks of non-authorized personnel gaining control of encryption keys by enforcing roles- based controls, thus helping to ensure comprehensive security. About The Solution Thales HSMs Thales nShield HSMs provide a tamper-resistant environment for secure cryptographic processing and key management. nShield HSMs are certified and meet established and emerging security standards for cryptographic systems while staying highly efficient. nShield HSMs isolate and protect cryptographic operations and keys for organizations’ most critical applications. nShield HSMs perform encryption, digital signing, and key management for an extensive range of applications including public key infrastructures (PKIs), SSL/TLS, and code signing. nShield HSMs are high-assurance alternatives to software-based cryptography – supporting all leading algorithms and featuring world-class ECC performance. With Thales HSMs and their unique architecture, you buy only the capacity you need and easily scale your solution as your needs evolve. Thales CodeSafe CodeSafe hosts and runs sensitive custom applications within nShield HSMs. CodeSafe lets applications decrypt, process, and encrypt data inside the secure environment. As a result, applications, such as Snapper’s code used to authenticate smart cards, are well protected from outside threats. Advanced Solutions Group (ASG) The Thales ASG team of security consultants delivers customized services to meet specific business needs. Experienced with a variety of applications, the ASG team helps organizations plan integrations, mitigate risks and execute projects through deployment and field testing – quickly and securely. Key Thales Solution Benefits Protect cryptographic keys and operations within tamper- resistant hardware to significantly enhance security over software-only solutions. Run sensitive custom applications within HSM boundaries using CodeSafe. Maintain control over your keys and build HSM estates that scale with evolving needs with Thales’ unique Security World architecture. Develop your solution efficiently and confidently with Thales ASG’s expert guidance.

How An Innovative Leader In mPOS Solutions Ensures That Cardholder Data And PINs Are Protected At All Times The Challenge: Card Acceptance Needs To Be Simple, Secure And Available Anywhere With the decline of cash payments, merchants of all sizes are increasingly looking for a flexible, cost effective and secure payments solution to accept EFTPOS (electronic funds transfer at point of sale) and credit card transactions on the go. It is no longer just the established bank acquirers and third party processors that want to offer card-based payment solutions to merchants, with telcos and other service providers looking to integrate card payments into their solutions or expand their current offerings. Together with the increasing desire for integrators to develop payment functions into their mobile apps, a solution supporting secure card acceptance without the traditional merchant POS device installation, configuration and security audit complexity is urgently needed. The Solution: Flexibility and Security Powered by Thales HSMs In order to address these issues, Mint Payments chose Thales hardware security modules (HSMs) to provide high assurance encryption and key management functionality as an integral part of their PCI DSS compliant data center. Mint’s mobile card acceptance solution uses a small portable card reader that connects via Bluetooth to a merchant-owned smartphone or tablet. The device is magnetic stripe, EMV Chip and contactless enabled, allowing the merchant to accept “customer present” payments securely. Tight control of the remotely initiated key injection process for card reader activation, encryption of the payment data at the point of capture and the use of hardware security modules (HSMs) at the payment platform level, enables mPOS solution providers like Mint to attain PCI DSS compliance and delivers a clear win for all participants in the value chain. Thales payShield 9000 hardware security modules (HSMs) are used in the Mint infrastructure for a variety of purposes, including: Generating keys for the card readers Decrypting card data PIN block translation at the payment platform prior to sending the transaction into the acquirer network for authorization How Mint and Thales deliver the win-win for corporates and merchants The Mint Solution for mPOS using Thales HSMs is Comprised of Three Main Product Offerings: Minterprise: a branded mobile payments platform for enterprises and banks, customizable to their needs Mintegrate: a program supporting a set of SDKs and APIs that allow developers to seamlessly integrate payments into third- party software while leveraging Mint’s PCI capabilities Mint mPOS: a solution comprising a mobile app and card reader combination that allows merchants of all sizes to accept contactless, chip and PIN-based card payments securely, anytime and anywhere. Mint offers a complete and modular solution for mobile card acceptance, enabling many players in the value chain to leverage its proven bank grade payments infrastructure rather than having to invest in their own. All components of the solution meet relevant PCI, EMV and card scheme standards and certifications, provide simple integration and enable live deployments within weeks rather than months. The combined Mint Payments and Thales solution expands card acceptance in a flexible and secure way, delivering clear benefits for the various adopters. Minterprise (for Enterprises): Accepts a wide range of global/regional/national credit and debit card brands using smartphones and tablets supporting iOS and Android Utilizes the bank grade security infrastructure hosted by Mint, eliminating the need for banks, telcos and service providers to create their own in-house PCI DSS compliant mPOS payment gateway Offers white label, custom branded or integrated solutions generating strong brand awareness and tight integration where necessary Mint mPOS (For Merchants): Enables merchants to offer secure mobile card acceptance to customers as an alternative to cash Eliminates clear text payment data from the merchant environment (and hence PCI DSS compliance overhead) through the use of point-to-point encryption (P2PE) Benefits from an easy, quick on-boarding process as well as simple pricing options About the Solution Thales PayShield 9000: proven, Scalable Payment System Security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM’s design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

How Thales payment HSMs Provided The Flexibility And Global Payment Network Interoperability This Fast-Growing Company Needed To Develop a Solution That Would Revolutionize The Industry. The Challenge: find a Card Payment Security Solution That Could Promote Innovation and Confidence The founders of Marqeta wanted to do something in the card payment space that had never been done before: create a card issuing and payment system that had multiple closed loop and open loop accounts on a single card. This new model would combine a nearly unlimited amount of prepaid, debit and credit accounts into a single piece of plastic. When a Marqeta-enabled card would be swiped at a Point of Sale (POS) terminal anywhere in the world, within a split second the company would be able to identify the cardholder and merchant, and authorize a transaction based on sequestered funds available or on restricted rules for the merchant. But securing the system would be the challenge. Even as Marqeta sought to revolutionize the payment network, a tried and true payment security and information protection technology was essential to widespread adoption. Marqeta’s security technology had to be a strong, stable platform that could enable real-time, dynamic processing of card information, while also being able to operate with the standard payment network used by all the other players in the space. The Solution: Thales Payment Hardware Security Modules. To secure its new payment system, Marqeta chose Thales payShield 9000 hardware security modules (HSMs). As the most widely deployed payment HSM in the world, the payShield 9000 provides Marqeta with a solution that communicates with merchants, issuers, and acquirers worldwide. As an external peripheral supporting a wide range of hosts including mainframes and servers, it provided the interoperability and high assurance Marqeta required for POS credit and debit card transactions. Key Benefits Achieve comprehensive, certified security specially designed for card issuing and payment processing. Maximize business continuity with redundant hardware, field serviceable components, and support for clustering and failover. Streamline deployment and maintenance and reduce the cost of compliance. Reduce costs by paying only for the capacity you need, choosing from a range of scalable, high-performance models. Get off-the-shelf support for all major payment applications. With cryptographic functionality and management features that meet or exceed the card application and security audit requirements of other major international card schemes, payShield 9000 enables Marqeta to gain the trust of key players throughout the payment industry. With security provided by Thales HSMs, Marqeta today is the platform for payment innovation. The company has expanded the platform going beyond multi-merchant commerce capabilities to enable a host of dynamic spend controls and advanced processing capabilities. The platform is powering a number of popular card solutions for some of the world’s largest brands and retailers. About the solution Designed specifically for payments applications, payShield 9000 from Thales eSecurity is a proven hardware security module (HSM) that performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. payShield 9000 is the most widely deployed payment HSM in the world, used in an estimated 80% of all payment card transactions. The payShield 9000 design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The payShield 9000 device is deployed as an external peripheral for mainframes and servers running card issuing and payment processing software applications for the electronic payments industry—delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, UnionPay, and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

How a Startup Is Helping Pharmaceutical Companies Bring New Drugs To Market Faster And More Cost-Efficiently Through a Secure, Cloud-Based Document Solution. The Challenge: Find A Way TO Secure Clinical Documents In a Highly Regulated Industry SureClinical wanted to bring the pharmaceutical trial process into the 21st century. Drug trials historically were a slow, paperintensive process, relying on hundreds of clinical investigators across the globe to print, fill out, sign and physically ship the documents required to populate data in a clinical study for a new drug. The cost in labor, shipping, paper and document handling was enormous. SureClinical envisioned a cloud-based solution that would allow pharma companies to eliminate paper, share documents easily, automate document handling, and capture regulatory-compliant signatures on hand-held devices – the tablets and smart phones that most clinicians prefer. This new technology would accelerate speed to market – a critical competitive advantage in an industry with a 20-year patent cliff – and it would save many companies hundreds of thousands of dollars in shipping costs alone. But there were significant security challenges to address. Above all, SureClinical needed a solution that pharmaceutical and healthcare companies would trust. With $50 billion per year in fraudulent paper-based transactions, the medical records industry is prone to substantial vulnerability and risk. It’s also one of the most highly regulated industries in the world. Pharmaceutical companies developing new medicines are subject to the strictest standards of security and privacy, and are audited regularly. While SureClinical knew that pharma companies would be attracted to the savings in cost and time its solution promised, it also knew that adoption of this new model of document handling was out of the question unless there was a strong root of trust in the digital signature process. The Solution: Digital Signing Solution Powered By Thales HSMs SureClinical solved this trust and security challenge with a solution that works with the built-in Adobe document signing/ verification technology and is secured in the cloud with Thales Hardware Security Modules (HSMs). It is the first such cloudbased digital signing solution to win U.S. Food and Drug Administration (FDA) and European Commission compliance validation for use in pharmaceutical trials, and has secured SureClinical’s inclusion in BioSpace’s list of the Top 30 Life Science Startups to Watch in the U.S. To securely authenticate users and share documents that include patient information and intellectual property, the SureClinical solution needed X.509 compliant certificates protected by a FIPS 140-2 level 3 HSM that could be independently verified by any third party recipient, with an audit trail available for all signing transactions. Based on digital certificate technology secured by a Thales nShield Connect HSM, the solution requires signers to have the right mobile phone, the right PIN, and the right username and password before they are allowed to digitally sign a document with their HSM-protected private signing key – significantly reducing the possibility of fraud. Clinicians around the world are able to use tablets and smart phones to sign documents at the point of origin, speeding the process and providing greater convenience. Copies of the digital certificate are kept in the HSM, which reside in data centers that are audited to FDA 21 CFR Part 11, European Commission Annex 11, and HIPAA standards. With Thales HSMs securing the root of trust, SureClinical’s patentpending cloud digital signing solution is helping pharmaceutical companies save as much as $200,000 per year in shipping charges, accelerate time to market, and speed the development of new drugs. Key Benefits Implement secure digital signing with high-availability solutions appropriate for your most critical processes Support the most demanding online applications and transaction volumes with high performance capabilities Enforce policies requiring separation of duties, strong authentication for administrators, and quorum authorized signing operations by employing finegrained security controls Accelerate deployments with out-of-the-box integration with commercial solutions as well as standards-based APIs for custom integrations Streamline auditing and compliance reporting by utilizing globally respected product level security certifications such as FIPS 140-2 Level 3 Why Thales? After initially working with a competitor’s product, SureClinical ultimately chose Thales HSMs to secure the root of trust for several reasons: Trust. SureClinical knew its solution wouldn’t be acceptable to customers without strong trust in the authentication process. Thales HSMs and the Thales brand provided the assurance and strong cryptographic technology that pharmaceutical companies required in order to place their trust in this innovative solution. Scalability. With the need to eventually accommodate up to 50 million users, scalability was a critical factor in choosing Thales HSMs, which can scale to handle high levels of transaction volume. The Thales architecture is designed for easy scalability, allowing the HSMs to be distributed across SureClinical’s twelve global data centers. Reliability. SureClinical required a solution that would be responsive and reliable, in order to allow people all over the world to efficiently and confidently sign documents, and the proven reliability of Thales HSMs filled the bill. Certification. Thales provided the standards compliance, including the critical FIPS 140-2 Level 3, that was needed for regulatory requirements and for SureClinical’s patent-pending high trust digital signing with multifactor authentication for mobile and web devices. Ease of use. The nShield Connect is easy to set up, configure and manage. Support. The Thales pre-sales and support team were able to get SureClinical up and running very quickly, integrating the custom software application using a Java JCE interface even before the purchase was complete. About The Solution Thales HSMs Thales HSMs provide a hardened, tamper-resistant environment for performing secure cryptographic processing, key protection, and key management. With these devices you can deploy high assurance security solutions that satisfy widely established and emerging standards of due care for cryptographic systems and best practices – while also maintaining high levels of operational efficiency. Thales HSMs are certified by independent authorities, establishing quantifiable security benchmarks that give you confidence in your ability to meet compliance mandates and support internal policies. Thales HSMs are available in multiple form factors to support all common deployment scenarios ranging from portable devices to high-performance data center appliances. With Thales HSMs You Can: Deliver certified protection for cryptographic keys and operations within tamper-resistant hardware to significantly enhance security for critical applications Achieve cost-effective cryptographic acceleration and unmatched operational flexibility in traditional data center and cloud environments Overcome the security vulnerabilities and performance challenges of software-only cryptography Reduce the cost of regulatory compliance and day to - day key management tasks including backup and remote management. With HSMs from Thales, you buy only the capacity you need and can scale your solution easily as your requirements evolve

How a Manufacturer of Digital Cinema Technology Cornered The Market On Online Key Management For Digital Cinema Distribution By Providing The Highest Levels Of Trusted Content Protection. The Challenge: Find a Secure Way To Manage Digital Cinema Keys Online. As a manufacturer of servers, projectors, mastering and distribution technology for digital cinema, Qube Cinema saw a unique opportunity to introduce a highly disruptive technology to the market as the film industry was completing a decade-long transition from physical to digital distribution. Digital offered tremendous benefits – it was much less expensive to produce and send hard drives than multiple reels of film prints. Digital films could be distributed much more quickly, enabling distributors to better meet demand. Digital films wouldn’t degrade over time, and they could be projected by less-skilled labor. The biggest hurdle, and the reason the film industry lagged behind other industries in converting from analog to digital, was security.Content owners– the companies producing films– were incredibly concerned about piracy and wanted incredibly high security measures. Theater owners and distributors, on the other hand, didn’ t want to have to deal with complicated or costly security measures that would harm profitability and introduce operational burden.The Qube team knew that if it could find an efficient way to manage digital cinema keys online with the highest grade of security that was also remarkably easy to operate, it could revolutionize the industry. The Solution: KeySmith: An Online Key Management System Powered By Thales HSMs. To address the need for efficient security in distributing digital cinema, Qube used Thales Hardware Security Modules (HSMs) to develop an easy-to-use distribution system with the strongest level of security available in the industry. In Digital Cinema, movies are encoded and encrypted into a Digital Cinema Package (DCP) and distributed via hard drive or satellite feed, then can be decrypted at the theater with information contained in a unique Key Delivery Message (KDM) that unlocks the film for a specific theater, timeframe and number of showings. Key Benefits Overcome security vulnerabilities of host-side applications by executing them inside a trusted environment Safeguard critical applications from manipulation, malware and Trojans Make HSM cryptographic services available to support a wide variety of connecting devices Deliver certified protection with FIPS 140-2 Level 3 approved tamper-resistant hardware Reduce the cost of key management task KeySmith satisfies the requirements of content owners and distributors alike. Content owners no longer need to worry about the software-based, in-house encryption measures typically used by distributors, or about the worst case scenario – losing the encryption keys and getting locked out of their own content. Thales HSMs provide the highest grade of protection for content encryption keys in the industry, while simultaneously ensuring that keys are never lost. For distributors and theater owners, the Qube system also provides a level of operational ease that removes any barriers to implementing high security, or temptation to sacrifice security for the sake of convenience. Here’s how the system works: a studio or independent filmmaker submits a movie for distribution. It gets converted to a DCP, which is an industry standard format for the media files and metadata that make up a movie. Within the DCP, a set of AES keys are used to encrypt individual files. A Distribution KDM (DKDM) that securely carries these keys is then made available to the distributor’s KeySmith account. This DKDM enables KeySmith to generate KDMs for individual theaters. Thales HSMs create a unique RSA public/private key pair and associated digital certificate for each company within KeySmith. These HSMs encrypt the AES keys with the recipient theater’s public key using an application that runs inside the certified security boundary of the HSM. Only the intended recipient can decrypt the package with the associated private key which is unique and securely installed at manufacture. Within KeySmith, the AES keys are handled solely within the security boundary of the HSM. KeySmith can also deliver the KDMs directly to the theaters. This is typically done after the theaters receive the movie via hard drive or satellite download. It’s a highly efficient system that provides ease of use for distributors while at the same time ensuring high assurance protection of the movie content – two critical elements of the Qube business value proposition. About The Solution Thales HSMs provide a hardened, tamper-resistant environment for performing secure cryptographic processing, key protection, and key management. With these devices you can deploy high assurance security solutions that satisfy widely established and emerging standards of due care for cryptographic systems and practices – while also maintaining high levels of operational efficiency. Thales HSMs are certified by independent authorities, establishing quantifiable security benchmarks that give you confidence in your ability to support compliance mandates and internal policies. Thales HSMs are available in multiple form factors to support all common deployment scenarios ranging from portable devices to high-performance data center appliances. With Thales HSMs You Can: Deliver certified protection for cryptographic keys and operations within tamper-resistant hardware to significantly enhance security for critical applications. Achieve cost-effective cryptographic acceleration and unmatched operational flexibility in traditional data center and cloud environments. Overcome the security vulnerabilities and performance challenges of software-only cryptography. Reduce the cost of regulatory compliance and day-to-day key management tasks including backup and remote management. With HSMs from Thales, you buy only the capacity you need and can scale your solution easily as your requirements evolve. Thales CodeSafe: The Thales CodeSafe developer toolkit provides the unique capability to move sensitive applications within the protected perimeter of a certified nShield HSM. Securely loaded and executed on FIPS 140-2 Level 3 HSMs, applications are protected from manipulation and can decrypt, process, and encrypt data inside the secure environment. CodeSafe Enables Organizations To: Prevent intellectual property theft by delivering remote control of sensitive applications no matter the environment, and offering cryptographic services regardless of the operating system or configuration used by the customer, whether server or mainframe. CodeSafe also allows application owners to maintain up-to-date application execution environment without physical presence. Protect applications from attack by hackers or rogue administrators by providing the ability to digitally sign trusted applications so that their integrity is verified prior to launch. CodeSafe also protects applications from theft, even in uncontrolled environments utilizing outsourcing and contracting. Protect sensitive SSL data by providing true end-to-end SSL encryption, terminating SSL and processing sensitive data inside the HSM to protect it from attacks.

How a media company surmounted studio security concerns to deliver newly-released films straight to home cinemas. The Challenge: Develop a Secure Way to Deliver just-released films directly to a home audience The founders of PRIMA Cinema wanted to exploit a new market opportunity to deliver just-released films to customers with home cinema systems at the same time the films were appearing in theatres. The number of high-end home theatres being built each year was growing quickly, as the number of people interested in watching films from home rather than at the cinema was steadily increasing. The PRIMA Cinema team felt they could make a significant play by delivering films with theatrelike quality to home cinemas, if they could just solve the biggest hurdle: security. Film piracy is an enormous concern for studios and distributors who, by some accounts, lose billions of dollars each year when film and TV properties are illegally copied and distributed. When films are shown in theatres, theatre managers can monitor audiences to prevent “camming” – recording films in the theatre with a video camera – but for home theatres, a different kind of security would be needed. The PRIMA team knew that to get buy-in from studios and other content owners for their business model, they would need to devise a highly secure way to distribute and show films – while not diminishing the viewer experience. The Solution: Multiple Cryptographic Layers Using Thales HSMs To address the concerns of studios and distributors, PRIMA Cinema developed a system for encoding and distributing films to home theatres that involved multiple layers of encryption as well as strong authentication between their servers and home playback devices, using Thales hardware security modules (HSMs) to generate and protect private encryption and digital signature keys. Before distribution, PRIMA Cinema encrypts films using 256-bit AES with keys generated by an HSM. The playback device installed in home cinemas includes a trusted platform module (TPM) where private keys and certificates associated with the decryption and device authentication are secured and managed. Key Benefits Overcome vulnerabilities of performing security functions on standard application platforms by instead executing them inside a trusted environment Safeguard critical applications and secret encryption and signature keys from manipulation, malware and Trojans Make HSM cryptographic services available to support a wide variety of connecting devices Deliver certified protection with FIPS 140-2 Level 3 approved tamper-resistant hardware Reduce the cost of key management tasks During manufacture, keys are never exposed outside the HSM and the consuming device – the application that controls all cryptographic processing and key handling is executed within the secure confines of the HSM using the unique Thales CodeSafe capability. The role-based access features of Thales Security World, common to all nShield HSMs, ensure that appropriate multi-person administrative controls are enforced to help prevent the possibility of an insider attack to the system. Films are transferred to playback devices via broadband and are protected with bi-directional certificate-based authentication. Additionally, a biometric fingerprint reader built into the playback device ensures that only the true registered owners can actually initiate a screening. Finally at the time of playback, a session-specific watermark is generated by the HSM and used to invisibly mark the video to deter camming of the film. PRIMA Cinema’s approach to security was subjected to independent review and found to satisfy the highly stringent requirements of content providers, and enabled the company to proceed to market as the first company in the history of cinema to be granted rights to license and distribute theatrically-released movies to private home theatres. About the Solution Thales HSMs Thales HSMs provide a hardened, tamper-resistant environment for performing secure cryptographic processing, key protection, and key management. With these devices you can deploy high assurance security solutions that satisfy widely established and emerging standards of due care for cryptographic systems and practices—while also maintaining high levels of operational efficiency. Thales HSMs are certified by independent authorities, establishing quantifiable security benchmarks that give you confidence in your ability to support compliance mandates and internal policies. Thales HSMs are available in multiple form factors to support all common deployment scenarios ranging from portable devices to high-performance data center appliances. With Thales HSMs you can: Deliver certified protection for cryptographic keys and operations within tamper-resistant hardware to significantly enhance security for critical applications Achieve cost-effective cryptographic acceleration and unmatched operational flexibility in traditional data center and cloud environments Overcome the security vulnerabilities and performance challenges of software-only cryptography Reduce the cost of regulatory compliance and day-today key management tasks including backup and remote management. With HSMs from Thales, you buy only the capacity you need and can scale your solution easily as your requirements evolve Thales Codesafe The Thales CodeSafe developer toolkit provides the unique capability to move sensitive applications within the protected perimeter of a FIPS 140-2 Level 3 certified nShield (HSM). Using this approach applications are protected from manipulation and can decrypt, process, and encrypt data inside the secure environment. CodeSafe enables organizations to: Prevent intellectual property theft by delivering remote control of sensitive applications no matter the environment, and offering cryptographic services regardless of the operating system or configuration used by the customer, whether server or mainframe. CodeSafe also allows application or handheld owners to maintain up-to-date application execution environment without physical presence Protect applications from attack by hackers or rogue administrators by providing the ability to digitally sign trusted applications so that their integrity is verified prior to launch. CodeSafe also protects applications from theft, even in uncontrolled environments utilizing outsourcing and contracting Protect sensitive SSL data by providing true end-to-end SSL encryption, terminating SSL and processing sensitive data inside the HSM to protect it from attacks Why Thales? Thales won the business based on the security and functionality of its HSMs. Thales HSMs provided: Greater security. From the outset, the PRIMA Cinema team knew that to get approval from the studios it would need the higher assurance security of a FIPS-certified, hardened appliance approach instead of using inherently riskier standard application platforms. And PRIMA Cinema needed a proven solution with security certifications so that anyone reviewing the system would be easily satisfied as to its reliability and security pedigree. And they wanted a multi-layered approach to security, using industry standard algorithms and key lengths suitable for the strongest protection available. Thales HSMs delivered on all accounts CodeSafe. Thales HSMs provide a security feature that no other solution offers. CodeSafe enables applications to run within a secure environment – inside the HSM – where they are protected from attacks that are prevalent on standard server-based platforms. PRIMA Cinema used CodeSafe to perform all key handling and encryption/decryption operations, providing the highest level of security possible Thales Security World architecture. The Thales Security World architecture streamlined key management and enabled PRIMA to build and manage their overall system by making it easy to define all of the strict security and control the project required. The Security World architecture provides an unified administrator and user experience and guarantees interoperability whether one or hundreds of devices are deployed Superior user experience. Thales HSMs were able to transparently provide the strong security required by the studios without interfering with or compromising the quality of the user experience – an absolute must for PRIMA Cinema’s value proposition

Leading Manufacturer Uses Thales Hsms To Protect Mission-critical Processes and Meet Regulatory Requirements With more than 130,000 employees, ZF is one of the world’s leading manufacturers of automotive chassis and driveline technology. The company’s network of 230 manufacturing facilities stretches across 40 countries, producing the innovative transmissions, steering systems, axels, and chassis components that the world’s top vehicle makers need. ZF’s primary focus is on continuing its tradition of quality and innovation, but it realizes that today success requires reliance on advanced technology systems to power manufacturing and core business processes. To secure its systems from internal and external threats, ZF relies on Microsoft Windows Server PKI (public key infrastructure) technology and Thales nShield hardware security modules (HSMs). “Thales HSMs give us auditable key protection for the computers that conduct our office-based processes, and they enable more cost-effective and scalable security for the technology that drives our production lines,” says Jürgen Paulmichl, information technology security manager for ZF. Benefits With Thales: Reducing IT costs with enterprise-class eSecurity Meeting the expectations of auditors and regulators Managing HSMs remotely and cost-effectively Protecting manufacturing processes from unauthorized access Decentralized Security Expensive To Maintain For several years ZF used PKIs to protect individual processes. Within the company’s PKIs, various certificate authorities (CA) issued digital certificates to machines, such as servers and desktop computers, in the company’s network. Using digital certificates, systems could be uniquely identified and authorized to access business systems, such as ZF’s SAP accounting applications. As ZF operated these PKIs, the company realized that they presented two challenges. Managing thousands of certificates without a centralized process was time-consuming and inefficient, especially when it came to tracking and updating expiring certificates. And importantly from a security perspective, its PKIs were not completely secure or recoverable because the private keys underlying the certificate issuing process were not protected in a scalable, hardware-based environment. ZF subsequently decided to establish an enterprise-wide PKI. Paulmichl says, “With an enterprise PKI, we can manage certificates more efficiently. We chose to use Thales HSMs to secure our PKI and to enable a more reliable CA key storage environment. Implementing Thales HSMs has proven to be a smart move, as they have allowed us to easily meet the escalating security expectations of auditors, governments, and company leaders.” Proven Technology To issue certificates and manage its PKI, ZF decided to implement the PKI provided with Microsoft Windows Server. ZF undertook an extensive evaluation process for the HSMs securing the PKI, and it solicited proposals from four leading HSM vendors. The company was looking for seamless integration with Microsoft Windows Server, FIPS certification, and support for 64-bit Windows. Of the HSMs that met those basic requirements, Thales nShield stood out thanks to its remote management capabilities and proven ability to integrate with Microsoft Windows Server. “Only Thales HSMs had reference customers available to confirm ease of integration with Microsoft Windows Server,” explains Paulmichl. “We were also impressed with the fact that we could manage Thales HSMs remotely. It’s a capability that fit well with ZF’s global reach, allowing us to place HSMs as far away as Brazil while managing them from Germany. Being able to manage HSMs remotely cuts travel and management costs.” Seamless Integration After receiving training from Thales Advanced Services Group, ZF was able to integrate its Thales nShield HSMs into its PKI environment using in-house resources. “Thales provided all the insight we needed to manage our HSMs securely and remotely,” says Paulmichl. “When we do need to administer the HSMs, we do so using smartcards, which enforce separation of duties for added security and compliance validation.” Today, ZF manages tens of thousands of machine certificates with its PKI, and it secures the CA issuing keys protecting each certificate with Thales HSMs. Perhaps most crucially, the certificates serve to authenticate all of the machines involved in producing its products. Its machines are connected to each other over wireless networks, and the certificates ensure that no unauthorized machine can interfere with or eavesdrop on ZF’s manufacturing processes. “Thanks to our Thales HSMs, no one can issue, forge, or duplicate a certificate with our PKI. That is important to us from business perspective and to our auditors who must sign off on our processes,” explains Paulmichl. Company Profile Headquartered in Friedrichshafen, Germany, ZF develops and manufactures driveline and chassis components for the global automotive industry. The company is best known for its innovative transmissions, including the world’s first 8-speed transmission. Ready For Changing Regulations In an effort to fight tax evasion and smuggling, the government of Brazil implemented regulations—called nota fiscal electronica—requiring that manufacturers produce electronic bills of lading “stamped” with a digital signature. The regulations mandate the use of HSMs to store and protect the time stamping certificates. While many manufacturers scrambled to implement compliant systems, ZF was ready. The company simply integrated its PKI with the SAP system it used to generate bills of lading. “Brazil’s nota fiscal electronica is a good example of how regulations can require HSMs,” says Paulmichl. “Because our processes were already protected by HSMs, it was easy for us to comply. We are able to easily manage our HSMs in Brazil from Germany.” Performance, Scalability, And Reliability Delivered By Thales When a process reengineering effort required that ZF update certificates for tens of thousands of machines in a 24 hour period, its IT security staff was pleased that the company’s Thales nShields were more than up to the task. Paulmichl explains, “We rolled out certificates to all clients all over the world in one day. No location reported any errors. Our HSMs performed perfectly. You expect security from HSMs. Thales HSMs also provide the superior performance, scalability, and reliability needed to protect our global manufacturing processes.”

European and Slovenian national directives and legislation now allow companies to issue invoices solely in an electronic format, as long as they follow a strict set of rules. Si.mobil–Vodafone was quick to realise the huge savings that could be achieved by eliminating paper-based invoicing and, with the help of technology from Thales, it is now one of the largest electronic invoicing systems in Slovenia. Si.mobil-Vodafone is the first private mobile telephony operator in Slovenia and with its variety of new services, products and technologies is competing directly with the large state owned telco. With more than 500,000 customers, billing is a major cost to the business. Si.mobil-Vodafone therefore took the decision to introduce electronic invoicing. As a result, it is now possible for all of Si.mobilVodafone’s customers to choose whether they receive invoices in paper or electronic format, or both. The electronic invoices must be created in accordance with strict EU directives and legislative requirements that require proof of authenticity and integrity. To do this Si.mobil-Vodafone worked with ecommerce solutions provider SETCCE who is experienced in automating electronic business processes in accordance with legal requirements. SETCCE also has a strong technology partnership with Thales who provided the core security technology. The solution was effectively designed as an ‘in-house electronic print shop’ that captures the data normally sent to the printing house and post office for paper-based invoicing. The data is then processed and an electronic invoice is produced along with any necessary supplementary information such as detailed specifications on services provided. All electronic documents are created in accordance with the VAT Act and Accounting Standards. Next, each invoice is digitally signed to seal its integrity and authenticity and delivered to customers via e-mail or through alternative electronic channels. SETCCE’s eBiller® system processes the input data and generates invoices while Thales nShield™ hardware security modules (HSMs), part of the nCipher product line, are used to digitally sign the electronic invoices. With high volumes, time is a crucial factor and the nShield HSM plays an essential role by accelerating the cryptographic processing. It is capable of more than 5,000 digital signatures per second (1024 RSA key signing). Benefits With Thales Protecting customers and the business from fraud Up to 80 percent of product and distribution costs saved by eliminating paper-based processing Reducing the risk of data breeches Managing encryption keys quickly and cost effectively Delivering integrity, authenticity and a secure audit trail Another very important requirement was the secure storage of cryptographic keys needed to apply digital signatures to electronic invoices. The nShield HSM not only securely stores the keys for digital signing but it also secures and manages access to the information. The Thales HSM provides a tamper-resistant hardware environment certified to FIPS 140-2 level 3, one of the most stringent security benchmarks in the industry; and the private keys can only be accessed and used for signing if the correct number of authorised personnel are present. This means that the chances of compromising the keys and the process are almost eliminated. E-invoicing has further strengthened Si-mobil’s position as a progressive mobile services operator and the financial benefits are increasing daily as more and more customers opt to receive invoices solely in electronic format. Si.mobil-Vodafone believes that up to 80 percent of production and distribution costs have been saved by eliminating paper-based processes. With the massive growth in fixed and mobile telecommunications, billing is a major challenge for all network operators. The move to electronic invoicing not only cuts costs and streamlines the invoicing process but also reduces the carbon footprint for telcos. However, it is also essential that the process is completely secure and Thales technology has a major roll to play in delivering protection and a secure audit trail. Company Profiles Si.mobil-Vodafone is part of Mobilkom Austria the mobile division of Telekom Austria Group. The group connects more than 15 million mobile customers across central and eastern Europe. First mobile operator in Slovenia to enable fast data transfer using EDGE technology First mobile operator in Slovenia to offer broadband mobile internet through its own UMTS/HSDPA network Products and services include GPS-based navigation solutions, business messaging services and mobile internet services More than 500,000 users in Slovenia SETCCE is focused on developing cutting edge products and services for business process dematerialization. The introduction of paperless business has to follow strict legislative frameworks and rely on the latest technology standards. SETCCE’s goal is to promote and support electronic business practice which is in line with national and European legislation and compatible with international standards.

Using Thales HSMs, North Dallas Bank & Trust Co. Improves Service To Customers While Lowering Costs And Protecting Pin Data. Founded in 1961, North Dallas Bank & Trust Co. (North Dallas Bank) is a rock of financial stability. Even as other banks experience the consequences of poor decision making, BauerFinancial, a leading bank rating firm, recently bestowed its highest possible rating for financial strength and stability on North Dallas Bank for the 78th consecutive quarter. With $1 billion in assets and an 11 percent growth rate last year, the bank is attracting customers who value stability in uncertain times. To improve service to customers by offering real-time account information, North Dallas Bank recently moved its ATM and debit verification processes in-house. The bank chose hardware security modules (HSMs) from Thales to protect in-house processing, giving the bank confidence that customer PINs and its reputation are safe from breaches. “Customers want the balance they see online and on ATM receipts to reflect all their transactions, but with outsourced processing, customers had to wait,” says Greg Niemeyer, executive vice president of marketing and operations for North Dallas Bank. “Looking at customer service, security, and costs, it made sense to take control of ATM and debit transactions. With Thales HSMs providing security, our customers’ PINs have never been safer.” Taking Charge of Transactions Until recently, North Dallas Bank outsourced its ATM and debit transaction verification processing to a larger bank. Using an HSM-protected process, the larger bank drove PIN verification and sent North Dallas Bank a transaction file detailing activity. To update customer account balances, North Dallas Bank regularly posted the file to its internal systems. While the larger bank was well-regarded and followed leading security practices, North Dallas Bank did not like that its customers’ data was outside of its control and that another bank had so much potential influence over its reputation. Not only expensive for the bank, outsourced processing also inconvenienced customers because it often took several hours for balances to reflect recent ATM and debit transactions. According to Niemeyer, “It made sense to move processing in-house while continuing to protect customers with excellent security. A risk to PIN privacy is a threat to the trust we’ve earned from our customers. That is why our solution is protected by Thales HSMs. Their reputation is as solid as our own.” Benefits with Thales Solutions: Securing customer PINs with tamper-resistant hardware Protecting its reputation for stability and great service Lowering transaction processing costs Supporting future growth with secure services Exploring the Technology Realizing that tamper-resistant hardware is the cornerstone of a secure PIN verification process, the bank carefully evaluated the payment HSMs on the market before selecting the Thales HSM 8000. In speaking with vendors, the bank’s decision makers learned that Thales HSMs are trusted by many of the world’s leading financial institutions, and that Thales HSMs protect 70 percent of the world’s card transactions. Ready to integrate with the STAR Network that provided ATM and debit infrastructure to the bank and the bank’s S1 Postilion payment software, Thales HSMs also offered ease of deployment. “We realized that we could buy an HSM that was similar to a Thales HSM or we could buy a Thales HSM,” explains Niemeyer. “Why compromise? We decided to go with Thales rather than a supplier who might be playing catch-up with technology or that might not be around for the long term. The Thales people we worked with were clearly encryption and key management experts, and they helped us gain a deeper understanding of the technology.” Easy Implementation and Operation North Dallas Bank integrated its S1 solution with two Thales HSMs. In less than a day, the HSMs were ready to provide a protected environment for PIN encryption and decryption. Niemeyer reports that, “One consultant implemented our Thales HSMs in just a few hours. The HSMs worked well with S1 software and the STAR Network right out of the box. They require very little maintenance, so the cost of ownership is low.” Increasing Customer Satisfaction—and Profits With its new system in place, North Dallas Bank verifies its customers’ transactions in-house. When customers use their North Dallas Bank card at an ATM or for a debit transaction, their PINs are encrypted until they reach the Thales HSM. Inside the protected hardware environment of the HSM, the PIN is decrypted and verified. If the PIN is valid, the system approves and processes the transaction. PINs are never decrypted outside the HSM. The bank is enjoying a number of benefits, as compared to outsourced transaction verification. Each transaction posts quickly, increasing customer satisfaction by providing easy access to more accurate balance information. Because it controls its customers’ sensitive PIN information, North Dallas Bank is more confident that the process and its reputation are secure. As an added benefit, the bank has seen transaction processing costs go down significantlyhelping to make ATM and debit services more profitable. “Add up the benefits of increased customer satisfaction and lower processing costs,” notes Niemeyer. “There’s no question that moving to in-house PIN processing with Thales HSMs and our S1 solution was a great decision.” Company Profile North Dallas Bank & Trust Co., established in 1961, has more than $1 billion in assets and is a locally owned bank with five locations in the Dallas, Texas, area. To learn more about North Dallas Bank and Trust Co., visit http://www.ndbt.com. A Foundation for Growth As people and businesses switch to banks that deliver unwavering stability, North Dallas Bank expects more strong growth. Niemeyer sees the security provided by the Thales HSMs making a key contribution. He says, “Our reputation attracts customers and inspires confidence. We plan to support our reputation by continuing to make prudent financial choices. But today, data security is also vital to success. By using Thales HSMs, we’re protecting our customers’ PINs with the same unwavering diligence we apply to safeguarding their deposits.”

With Thales HSMs, Hypercom Protects POS Devices Against Counterfeiting And Tampering. Hypercom Corporation is one of the world’s leading providers of electronic payment solutions and point-of-sale (POS) devices. Its products are used by many of the world’s top financial institutions, payment processors, and retailers along with single-location retail shops and restaurants. Hypercom’s many customers share one similarity: They rely on high-security POS solutions to protect themselves against transaction fraud. And they turn to Hypercom because it designs and builds a unique layer of trust into its POS devices using digital certificates. Issued using a certificate authority (CA) and Thales hardware security modules (HSMs), digital certificates protect the authenticity of Hypercom’s POS devices. This system of validation and encrypting security protects Hypercom’s customers from counterfeits and tampering, helping them to secure the trust of banks and consumers worldwide. “Security is first and foremost in every product and service that we sell,” says Stuart Taylor, Vice President of Global Marketing for Hypercom. “Thales HSMs provide the trusted elements of PKI-enabled security that are essential to the success of our products in every market of the world. They are at the core of how we ensure that the devices we manufacture can be trusted to protect our customers— and consumers—against unauthorized activity within the payment system, whether or not it’s actual fraud.” Built-in Trust The potential financial impact of data breaches and fraudulent transactions on companies is staggering. Data breaches can lead to direct money loss due to fraud and result in irreparable brand damage. POS systems are a key defense against fraudulent transactions entering the payment system. But what ensures the integrity of POS devices themselves? How do merchants and banks know there has been no tampering of the software within the device itself? All too often, the answer is that they do not—unless it’s a Hypercom device. Digital certificates are the difference. Digital certificates uniquely identify each Hypercom POS device and allow only devices authenticated using a digital certificate to remotely access the payment device for downloads or key injection. This makes it impossible for a counterfeit or modified software application to be added to the payment device, thereby preventing a potential security weakness. The certificates in Hypercom POS devices allow each device and each download transaction to be identified and therefore trusted. Benefits With Thales Prevents unauthorized access to software or firmware that changes functionality of the payment device Ensures only trusted devices operate within trusted environments by using tamper-proof digital certificates Prevents merchant service provider “slamming” Enables secure remote debit key management to reduce costs and eliminate downtime Reliable Integration With Leading Certificate Authorities In setting up its digital certificate system, Hypercom evaluated a number of CA and HSM options. It chose RSA Keon as its CA, and Thales HSMs for key protection. Thales HSMs stood out for their excellent reputation for reliability and security, along with tested and seamless integration with leading CA solutions. “Thales had an established track record for delivering a stable product with good support, performance, and integration,” says Patty Walters, Vice President of Global Solutions at Hypercom. “With digital certificates playing such an important role in our product strategy, we wanted a trusted and proven HSM. Thales HSMs were the obvious and best choice.” Secured Global Manufacturing Processes Today, secure issuance of digital certificates and protection of the issuance process are built into Hypercom’s manufacturing operations worldwide. The company’s factory in one country connects to the Hypercom CA in another. Thales HSMs securely manage the private keys that enable the CA to issue a unique digital certificate for inclusion in each device. “Thales HSMs protect our digital certificate issuance process as part of our global manufacturing operation, so that only authenticated and trusted POS devices are on our customer’s networks—protecting merchants and consumers against potentially costly data breaches,” notes Mr. Vences. Company Profile Delivering high-security, end-to-end electronic payment products and services, Hypercom solutions are used in more than 100 countries and handle more transactions than any other company in the world. Hypercom was founded in 1978 and Phoenix, Arizona. Customers Win—and Winning Customers The digital certificates within Hypercom’s POS devices allow secure download of new firmware or applications to the devices. Hypercom POS devices accept updates only from trusted sources with authorized digital certificates. Without the protection provided by digital certificates and HSMs, the devices would have to be removed and serviced manually at a secure location at significant expense and disruption. “The protection afforded by our Thales HSMs is the cornerstone of our advantage in the marketplace,” adds Ms. Walters. “They help to enable a level of security that exceeds current standards while also lowering the lifetime operating costs of POS devices. Our customers understand and appreciate the difference. It’s one of the reasons we are successful in winning new customers and retaining long-time customers.” Enhanced Trusted Operations When asked about the advantages of superior device protection, Ms. Walters sums it up this way: “Regulations in most countries do not require the level of assurance and trust Hypercom builds into each device with the help of Thales. Our customers who choose to utilize the level of protection the digital certificate provides do not face financial and reputational risks from the types of threats inherent in less secure systems. Thales HSMs are at the core of our success—an essential part of our competitive advantage.”

Thales HSMs and Time Stamp Servers Help Create High Assurance Digital Credentials. The Goal: To Create a Hard-To-Forge And Easy-To-Authenticate Degree Certificate Many universities around the world are faced with the growing problem of counterfeit degree certificates. People who had never attended university were buying forged degrees and presenting themselves to employers as graduates. University of Malaya decided to address this problem by pioneering a digitally signed and time stamped certificate called the e-Scroll. This e-Scroll is not only hard to forge but also can be easily verified by a prospective employer. As University of Malaya looked for a way forward to produce degree certificates that could not be forged and that could be easily authenticated, Dr. David Asirvatham, Director of IT Centre at University of Malaya, struck on the idea of an e-Scroll: a digital degree that can be digitally signed and time stamped, allowing it to be authenticated online. The potential advantages were significant. In a world where a growing number of graduates apply for jobs online, an applicant could attach an e-Scroll certificate to an online job submission, and employers would be able to quickly and easily validate its authenticity. An e-Scroll would also provide cost savings by eliminating the need to print expensive specialized paper-based certificates. Delivery of e-Scrolls is also made easy as students can login to a portal to download their e-Scroll. Most importantly, University of Malaya could virtually eliminate the negative impact of fraudulent certificates. The challenge was in finding the right technology to implement the solution. It would need to be easy for university officials to create the certificates the graduating classes included 7,000 students on average. It would need to allow employers to authenticate the certificates quickly. Most of all, it would need to be secured in order to foil the highly sophisticated forgers who had been making a great deal of money selling counterfeit certificates. Benefits of High Assurance Digital Signatures Thales solutions provide a mechanism to assure the integrity and authenticity of almost any form of electronic document or message, enabling you to: Implement secure digital signing with high-availability solutions appropriate for critical processes Take advantage of high performance capabilities that can support the most demanding online applications and transaction volumes Employ fine-grained security controls to enforce policies requiring separation of duties, strong authentication for administrators and quorum authorized signing operations Accelerate deployments with standard APIs and out-of-thebox integrations Utilize globally respected product level security certifications such as FIPS 140-2 to streamline auditing and compliance reporting The solution: Thales High Assurance Hardware With Digital Signature Applications From GiAT Infosys Sdn Bhd To implement their innovative e-Scroll solution, the university chose a complete digital signature solution offered by Thales in collaboration with GiAT Infosys Sdn Bhd, a Malaysian IT provider together with their business partner, Haynik Holding Sdn Bhd. Using a specialpurpose software program, the university converts each student’s particulars and credentials into an Adobe PDF e-Scroll certificate. Each approved e-Scroll is digitally signed by the university’s Registrar and Vice Chancellor using GlobalSign® Digital IDs in an automated batch signing process. Thales nShield HSMs high-assurance tamperresistant hardware security modules provide strong protection for the digital identities of the two signatories by securely storing their private signing keys and preventing any unauthorized access. As part of the process, each e-Scroll is issued a secure time stamp against the Malaysian National Clock (located at SIRIM) by Thales Time Stamp Server. The inclusion of a protected time stamp as part of the digital signature process provides an additional layer of security indicating the exact date that the credential was issued. Paper-based certificates can be post-dated or pre-dated but not e-Scrolls. The Challenge of Digital Signatures Organizations use digital signatures today in a wide variety of applications. As the virtual equivalent of a traditional wet ink signature, a digital signature is intended to verify the authenticity of messages, transactions, digital documents and software, proving that the information originated with the signer and has not been altered. Digital signatures offer a host of potential benefits in addition to document security, including greater efficiencies and cost reductions realized through the automation of manual processes. Digital signatures, however, pose a number of challenges for organizations. Because digital signatures and digital identities rely on the use of public key cryptography, the protection of private keys is critical to the integrity of the whole system. If the digital signing process is not secured, attackers can create seemingly legitimate signatures over forged data, compromising the system and the organization’s reputation. Moreover, organizations that fail to maintain adequate documentation and certification for policies and practices can risk rejection of digital signatures in certain jurisdictions. Finally, some digital signing processes can be computationally intensive, slowing down business processes and limiting their ability to scale. Thales Digital Signature Solutions Thales eSecurity helped create a high-assurance digital signing processes that give University of Malaya valuable flexibility in automating and integrating with critical business processes. Thales offers proven, independently certified HSMs that provide a much higher level of assurance and performance versus software-based digital signing. Thales nShield HSMs meet the highest security standards, provide the capacity and performance you need, and are straightforward to deploy and manage. In addition, Thales time stamping products provide organizations with a source of trusted time for digital signing applications in which time is an important factor. By adopting industry best practices and Thales proven technology you can be confident of staying ahead of the security curve, ensuring authenticity and integrity and complying with evolving legal standards and regulatory requirements.

How Thales HSMs Helped a Payment Service Provider Deliver The Security They Needed To Rollout a New Mobile Payment Product The Goal: To Bring The Highest Standards of Security To Mobile Point-of-Sale (mPOS) Technology CreditCall, a leading payment gateway service provider, saw a huge opportunity to reach a new market with an innovative, mobile point-ofsale (POS) credit card payment technology. In years past, it was difficult for certain types of merchants to utilize mobile POS systems. The technology was expensive – smaller merchants often couldn’t afford the costs or want the long term contractual commitments. Traditional POS equipment requires a physical network connection meaning merchants who provided products or services away from an office or retail location were forced to either operate on a cash basis, missing out on the convenience and security that credit card payments offered, or rent expensive and bulky GPRS terminals. With the enormous popularity of mobile devices, CreditCall envisioned an opportunity to bring face-to-face card payment solutions to a whole new category of smaller businesses and micro-merchants by incorporating portable, low cost card reader devices that could connect wirelessly via (merchant-owned) tablets and smartphones to remote payment gateways. Mobile businesses like gardeners, plumbers and electricians could now accept credit card payments on-site at their customers’ homes. This solution now stands to replace conventional POS systems in certain environments, with low cost readers and mobile device-based application software. This significantly reduces cost and complexity, paving the way for widespread adoption by all types of merchants, not just micro-merchants. The CreditCall team began to develop mobile POS technology they could sell as a white label solution to banks, acquirers, payment processors and mobile network operators (MNOs), who could in turn sell the products and associated services to their merchant customers. But while the opportunity was significant, the CreditCall team knew security would be the primary challenge. Mobile devices are inherently insecure. If the customer’s credit card information was present in a smartphone or tablet, it would be much more vulnerable to malware, Trojans, backdoors, memory scraping and other advanced malicious threats than a traditional POS terminal. For their banking and financial clients to buy-in to the new mobile POS business model, CreditCall would have to ensure the highest levels of security could be achieved. Benefits For Payment Service Providers (PSPs): Increase transaction volume and revenue by enabling a broader community of merchants to accept card payments in a highly secure manner with low onboarding costs Minimize installation costs by using HSMs to secure the remote key injection process for the card readers, eliminating costly pre-personalization at the factory or manual installation on site at the merchant Reduce cost to scale internationally by enabling additional data centers and merchant terminals to be managed remotely from a central location using a flexible pool HSMs Accelerate implementation projects with HSMs that are pre-qualified to integrate with products from leading card reader vendors Benefits for Merchants: Move the merchant environment out of scope for PCI DSS compliance by ensuring that all sensitive data is encrypted using proven and certified hardware-based techniques Facilitate payment acceptance anytime and anywhere through a flexible, low cost and secure card-based solution, supporting the strongest EMV standards Reduce certification costs by eliminating the need for the merchant mobile device (smart phone or tablet) to undergo any independent security certification Minimize staff and customer training costs by delivering the same cardholder experience as traditional chip and PIN based POS terminals The Solution: Point-to-Point Encryption and Thales HSMs The CreditCall team integrated card readers certified to the PCI SRED (secure reading and exchange of data) standard together with Thales payShield 9000 hardware security modules (HSMs) to enable a point-topoint-encryption (P2PE) zone to be established between the card acceptance point and the internet-based payment gateway. As the emerging preferred approach to providing strong hardware-based encryption of sensitive payment data in POS payment environments, the P2PE process encrypts data inside the secure card reader and protects it as it flows through the merchants’ system and into the payment processing chain. By encrypting the data before it enters the merchant smart phone or tablet device (and ensuring there is no means for the device to decrypt the data), there is no requirement for security certification of the smart phone or tablet, significantly reducing complexity, costs and time to market. CreditCall was able therefore to satisfy their clients’ security requirements and protect customer personal and credit card information from potential attacks in a highly efficient and secure manner. Thales payShield 9000 HSMs were a critical component in securing the CreditCall CardEase Mobile solution. Designed specifically for the payment industry, payShield 9000 HSMs combine state-of-theart security and operational ease. They are deployed as an external peripheral for devices running card issuing and payment processing applications, with a long history of delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions. In fact, approximately 80% of all payment card transactions worldwide run through a payShield HSM. These devices are involved in protecting and validating PINs, processing transactions, issuing payment cards and managing keys. CreditCall chose Thales HSMS for two overriding reasons. The first was reputation – CreditCall knew their banking and payment processing customers would require a solution that was recognized industry-wide as a proven and reliable security solution, and Thales fit the bill. But even more importantly, CreditCall chose Thales because payShield provided more robust protection and management of encryption keys than competitive solutions. Proper key management is critical to securing customer data in a P2PE solution, both to defend against malicious external data extraction threats and to protect against compromise by a malicious insider. With robust role-based access controls, tamper-resistant security and easy-to-use management capabilities, Thales HSMs offered CreditCall the highest level of security in the industry. Reduce Scope for PCI DSS Compliance Complying with payment card industry data security standards (PCI DSS) can be a costly and time-consuming endeavor for any business. Thales HSMs can help reduce the cost and burden of compliance by significantly reducing a merchant’s scope of PCI DSS compliance. If a P2PE process is implemented correctly and account data is encrypted within a secure capture device using keys protected by Thales HSMs, a merchant will benefit from being taken out of scope for PCI DSS compliance for their mPOS solution. Strict controls for protection of and access to decryption keys must be in place; in fact, the PCI P2PE Solution Requirements and Testing Procedures requires the use of HSMs with an appropriate security rating to protect access to those keys. Thales HSMs fulfill this requirement and can play an essential role in implementing a P2PE strategy to reduce the scope and cost of compliance. Benefits of PayShield 9000 Delivers comprehensive, certified security specially designed for card issuing and payment processing Provides off-the-shelf support for all major payment applications Maximizes business continuity with redundant hardware, field serviceable components, and support for clustering and failover Streamlines deployment and maintenance and reduces the cost of compliance with a choice of software options tailored for issuers, processors, and acquirers Offers a range of scalable, high-performance models, so you pay only for the capacity you need Jeremy Gumbley, Chief Technology Officer, CreditCall says: “I see hardware solutions as being pivotal in making security viable in mobile environments. You need to be able to police and control your encryption keys independently from the rest of your infrastructure and know that those keys are not ever going to come out of that device. I see hardware as being essential as there is no really good way of doing this without hardware.” Thales payShield 9000 HSMs The Thales payShield 9000 HSM provides a payment system certified method for remotely deploying the cryptographic keys required by secure capture devices such as the Miura Shuttle for PIN and data encryption and to perform the secure decryption of payment transaction data prior to onward transmission to the acquirer. Where online PINs are used, the HSM additionally facilitates a secure PIN translation process to enable issuers to validate the PIN entered at the secure capture device. This gives Payment Service Providers (PSPs) an off-the-shelf, proven solution that can help small merchants accept card payments in a cost-effective manner.

ORC’s PIVotal ID™, a Federated Identity Solution Used By The U.S. Government, Shows How Cloud-Based Identity as-a-Service(IDaaS) Backed By Hardened Cryptography Delivers Strong Security And Wide Interoperability. For many companies thinking about moving sensitive data to the cloud, security issues remain a significant concern. But one company, Operational Research Consultants Inc. (ORC), is proving that the cloud really can be made as safe or even safer than on-premise deployments even for organizations as security-focused as the U.S. Federal Government. ORC – a Pioneer In Federal Identity Management ORC has been a trusted partner of the U.S. government since the mid-‘90s, when the company launched the Navy Acquisition Public Key Infrastructure to support secure interactions with contractors and suppliers. As the government’s emphasis on information assurance expanded over the next two decades, ORC became a go-to partner for security solutions and one of the first companies authorized to provide government-compliant identity management solutions. Today ORC manages more than three million identities and has issued more than 10 million federal-compliant digital certificates to a variety of employees, contractors, allies, veterans and citizens conducting business with the government. The Need For Secure And Interoperable Identification And Authentication In August 2004, the Bush administration issued a Homeland Security Presidential Directive (HSPD-12) to secure federal facilities and resources by establishing a government-wide standard for secure and reliable forms of identification. Going far beyond simply issuing ID badges to government employees, this initiative would focus on the processes needed to issue secure personal credentials, on methods to validate those issuance processes and credentials and on managing risk and quality throughout the lifecycle of the credentials.The Personal Identity Verification (PIV) program implements these processes, and FIPS (Federal Information Processing Standard) 201 specifies interface and data elements of the PIV smart card. Among the data elements on a PIV card are one or more asymmetric private cryptographic keys. Departments and agencies must use a compliant public key infrastructure (PKI) to issue digital certificates to users. The PIV initiative has also spawned other high assurance credentials that support specific Businessto-Government, Citizen-to-Government and Citizen-to-Business transactions while supporting federated interoperability between the issued credentials. These include various PIV-Interoperable (PIV-I) and PIV variants, such as: Transportation Worker Identification Credential (TWIC®), First Responder Authentication Credentials (FRAC), Commercial Identity Verification (CIV), and External Certificate Authority (ECA) PIV-I that address various regulatory requirements and are built to scale globally. The processes and policies for certificate issuance and the protections afforded to the critical root and issuing certificate authority keys in that PKI are critical factors in the overall assurance level of the system. Thales Hardware Security Modules (HSMs) Enable Companies To: Achieve unmatched operational flexibility, high availability and scalability in virtualized and cloud environments. Reduce the cost of regulatory compliance and day-to-day key management tasks such as backup and remote management. Achieve high assurance business continuity with simplified HSM enrollment, efficient key provisioning and fully resilient hardware features. Enhance security for critical applications by protecting cryptographic keys and operations within tamperresistant hardware. Establish strong separation of duties and dual controls through robust administration policies including role-based multi-factor authentication and flexible quorum-based authorization. The Challenges: Certification, Interoperability and Trust Traditional on-premise identity management systems don’t easily extend to the cloud. Recognizing that security was an important differentiator in order for cloud-based identity management to be trusted across the federal government, ORC knew that high assurance cryptography was the only way to meet NIST’s security requirements. In the context of PKI, this meant that root and issuing certificate authority keys needed to be generated and protected in high assurance, FIPS-certified hardware. The reasons extended beyond simply strong security: the operational impact of compromise of one of these keys would be that all certificates issued under the PKI would need to be revoked and all credentials re-issued. ORC also faced multiple certification and accreditation requirements including Federal Bridge, PIV/PIV-I, DoD, and FISMA and the need to support cross-certification at multiple levels, requiring a solution that could support a flexible range of assurance levels and policies. The solution also needed to be proven, and based on open systems standards to assure wide interoperability. Finally, ORC recognized the importance of providing high availability and reliability for cryptographic services in a cloud environment. The Solution: ORC PIVotal ID™ And Thales nShield HSMs In order to provide high levels of assurance for federal cloud services, ORC offers a suite of solutions called PIVotal ID™. PIVotal ID™ includes certified and accredited managed services for issuing strong identity credentials that are trusted across the federal government and able to federate globally, including the issuance of digital certificates from PKIs underpinned by high assurance Thales Hardware Security Modules (HSMs). ORC has issued and manages millions of compliant credentials enabling secure transactions for U.S. Federal Agencies (Civilian and Defense), their employees, the global contracting community, trading partners, Veterans and citizens who need to conduct business with any facet of the U.S. Government and regulated industries. PIVotal ID™ includes: Personal Identification Verification (PIV) Non-Federal Issuer PIV-Interoperable (NFI PIV-I) External Certificate Authority (ECA) Access Certificates for Electronic Services (ACES) TWIC Certificate Manufacturing Authority PIVotal Commercial™ (PIV-CIV) PIVotal Validation™ ORC recognized that the Thales nShield family of HSMs offered superior protection and cryptographic acceleration capabilities, as well as the flexibility and scalability to protect and manage root keys and all subordinate keys within its secure cloud service infrastructure. Cost-effective Solutions For Robust Cryptography Thales nShield HSMs are built on a hardened, tamper-resistant platform that safeguards and manages sensitive keys used for encryption and digital signing to support virtually any application from identity management, web services and database encryption to tokenization, PKI services and strong authentication. Thales nShield HSMs offer the most cost-effective way to establish the appropriate levels of physical and logical controls for systems where the security offered by softwarebased cryptography is considered to be inadequate. About ORC ORC, a WidePoint company and trusted partner to the U.S. Federal Government, delivers information security solutions to government and enterprise customers, thereby ensuring the fully compliant and trusted exchange and assurance of information. As an elite provider of information assurance and authentication services for business to government, government to government, and citizen to government, ORC’s solutions are interoperable with legacy systems and integrate seamlessly with all leading software applications on the market. ORC leverages Thales nShield HSMs to provide federal grade secured cloud identity management services.

How Thales HSMs Helped a Leader In Payment Solutions Secure a Revolutionary New Mobile Card Acceptance Solution. The Goal: Create The First All-In-One Solution For Secure Card Acceptance Utilizing Mobile Technology ROYALGATE, saw a tremendous market opportunity. The trend towards flexibility and mobility was clear – it wasn’t just micro-merchants, doorto-door salesmen and mobile businesses that wanted flexibility to accept card payments anywhere. Larger businesses like restaurants, retail sites and events companies were looking to add value and improve customer service by moving payment transactions away from traditional cashier scenarios and to wherever the customer wanted to pay. What these businesses lacked was an easy-to-use, all-in-one solution that could take advantage of the explosion of mobile devices and convert any smartphone or tablet into a payment terminal. There were plenty of payment service providers, terminal manufacturers and more than enough manufacturers of smartphones, but no one had yet developed an all-in-one software/hardware solution that would let businesses easily process card payments regardless of the card type in use. ROYALGATE wanted to be the first. The product they envisioned included a card reader, connecting directly or wirelessly to any smart device, to encrypt payment data as it is received from the card. It would provide strong security utilizing the DUKPT (Derived Unique Key Per Transaction) key management scheme in hardware, and also provide the mobile device application and back-end payment processing. Finally, it would read any kind of card, including magnetic stripe, chip and even contactless cards – a world’s first. A significant challenge, they knew, would be security. They not only needed an end-to-end solution that could be certified by all applicable associations, but also that provided strong protection for the over-the-air wireless and Bluetooth components that were important to the ease of use of the system. Protect your data with comprehensive, certified security specially designed for card issuing and payment processing. Speed deployment with off-the-shelf support for all major payment applications. Ensure business continuity with redundant hardware, field serviceable components, and support for clustering and failover. Reduce cost of maintenance and compliance with a choice of software options tailored for issuers, processors, and acquirers. Improve ROI - a range of scalable, high-performance models enables you to pay only for the capacity you need. The Solution: Thales PayShield 9000 To solve their security requirements around cryptographic key generation, protection and overall management, ROYALGATE selected Thales payShield 9000, a hardware security module designed specifically for payments applications. As the most widely deployed payment HSM in the world, payShield 9000 offered the high assurance protection, cryptographic functionality and superior key management features proven to meet or exceed the security audit requirements of all major international card schemes. payShield 9000, with its built-in DUKPT capabilities, enabled ROYALGATE to use it to securely generate and inject encryption keys into PayGate readers in Japan, prior to shipping them to their merchant customers. The Thales HSM provided the high assurance cryptographic security that was critical to creating an end-to-end solution that could be PCI DSS certified. ROYALGATE wanted to ensure protection for the entire chain of transactions – from the point of card data acceptance to the mobile application to the data center to the acquirer. Why Thales? Robust and proven technology. payShield 9000 offered comprehensive payments capabilities, including mature support for the DUKPT key management scheme. Speed. payShield 9000 offered a proven solution with a range of scalable, high-performance models so ROYALGATE could pay only for the capacity they required. Time to market. As the world’s leading payment HSM, payShield 9000 offered standard functionality and specifications that enabled ROYALGATE to develop their new solution more easily and get it to market faster Certifications. Because payShield 9000 has all major certifications and validations, ROYALGATE knew this would be an enabler to securing the approval of the Japan Credit Card Association. Support. Thales was able to provide support for the deployment at many levels – from technical support in the installation to critical help and education on the DUKPT protocol. Thales payShield 9000: Proven, Scalable Payment System Security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM’s design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a stateof-the-art solution that delivers an ideal combination of security and operational ease. The device is deployed as an external peripheral for mainframes and servers running card issuing and payment processing software applications for the electronic payments industry – delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

The Follett Higher Education Group Uses Thales Products And Services To Protect Credit Card Data From Breaches And Comply With PCI DSS. Secure, Compliant Encryption. Beginning as a small book store in 1873, the Follett Corporation has grown to become one of the cornerstones of the educational system within the United States. The Follett Higher Education Group (FHEG) sells more than 20 million textbooks annually in stores and online, and it operates more than 700 campus book stores for colleges and universities. For every transaction the company protects its customers’ personal data from breaches while easily and cost-effectively complying with the Payment Card Industry Data Security Standard (PCI DSS). Since it began operating stores and taking credit cards, FHEG has taken protecting its customers’ privacy seriously. To protect customer data the company has a longstanding practice of encrypting customer payment data. Encrypting data and subsequently decrypting data required following and documenting a time-consuming manual encryption key management and storage procedure, as required by PCI DSS 3.6.3. FHEG also needed to rotate encryption keys (replacing old keys with new ones, as required by PCI DSS requirement 3.6.4) at least once a year, which it did manually. FHEG found that its key management process was becoming too inefficient and labourintensive. The company decided to transition to using hardware security modules (HSMs) from Thales’s nCipher product line instead of manually tracking encryption keys. “Thales HSMs provide a secure environment for managing and storing the encryption keys that protect customer data,” says Terry Mainiero, FHEG’s director of store systems. “We wanted to use Thales HSMs as the basis for an efficient, cost-effective, and PCI DSS compliant key management process.” Secure And Flexible Key Management Frees IT Resources After deciding to implement an HSM, FHEG evaluated a number of the options on the market. The company found that while all HSMs provide security, Thales HSMs also delivered ease of use and flexibility. Irwin Gafen, director of wholesale and distribution systems at FHEG, explains, “Thales helped us to understand our choices for encryption, and to deploy a simple, secure, and compliant solution to replace our manual key management processes.” “We needed an HSM that was flexible enough to fit into our environment without disruption while making our key management more automated,” says Mr. Mainiero. “Thales met our needs perfectly. Our Thales HSMs protect our encryption keys, safeguarding customer data from breaches. Just as importantly, it helped make achieving PCI DSS compliance far easier and more cost-effective.” Benefits With Thales Making PCI DSS audit reviews easier and more efficient Managing encryption keys faster and more costeffectively Protecting customers and the business from fraud Reducing the risk of data breaches Enhanced Key Management With Thales HSMs, FHEG has replaced inefficient manual processes with a largely automated key storage and generation process. The Thales HSM is deployed in a server that safely distributes encryption keys to the company’s e-commerce and point of sale systems. When the company rotates existing encryption keys, as required under PCI DSS, the process takes a fraction of the time it took with manual processes. That’s because the process is now largely automated, making PCI DSS audit reviews easier and more efficient. “Rotating to new encryption keys is very fast. So if the PCI DSS were to require more frequent key changes, it wouldn’t be a problem for us.” notes Mr Mainiero The Encryption Experts To implement its new PCI DSS compliant key management solution, FHEG turned to Thales Professional Services. The team began by working with the company to understand their current processes and environment. They also reviewed the company’s security procedures, policies, and systems. The team then developed an implementation plan that fully supported FHEG’s needs and continued PCI DSS compliance. “It was a pleasure to work with Thales Professional Services,” says Mr. Gafen. “They took the time to listen to our needs and understand our systems and processes. They designed and implemented an effective solution. The whole project was ontime, on-budget, and bug-free.” Company Profile Headquartered in River Grove, Illinois, the Follett Corporation is a privately held, $2.3 billion company. It is the largest provider of library materials and technology to K-12 schools in the United States, and the nation’s leading campus book store operator. Recent milestones for Follett Higher Education Group include: Operating more than 700 college book stores Stocking over 100,000 titles Selling more than 20 million textbooks annually Serving more than 700 campuses with online textbook sales Mr. Gafen adds, “Encryption is highly complex, and getting it right requires expertise. Thales Professional Services has that expertise and makes very practical recommendations. They brought specialist knowledge to the project, which allowed our team to stay focused on our business needs.” Protecting Customers And The Business With effective encryption and key management FHEG is confident that its customers’ personal data is secure. This not only protects customers, it also protects the company from the bad publicity and costs that can result if credit card data is compromised. “With Thales, no one can access our encryption keys,” says Mr. Gafen. “Our keys are safe from internal and external tampering, safeguarding our encrypted data against theft or manipulation. Our customers’ personal data is protected, and we are protected from the potentially high costs of compromised data.”

How Thales Expertise And High Assurance Hardware Security Modules (HSMs) Helped One of The Nation’s Largest Utilities Provide Strong Security While Simultaneously Enabling New Customer Services. The Goal: Preparing For The Future The IT team at one of the nation’s largest utility companies set an ambitious goal for themselves and their security infrastructure. As technology in the energy sector was evolving, they were determined to remain on the leading edge. They needed to ensure they could provide continuous service to their customers while simultaneously preparing their infrastructure for new and demanding technology like Smart Metering and Smart Grid. They wanted to meet and exceed the high security requirements that their auditors and Homeland Security had established. And they wanted to enable new services, like allowing employees and customers to use tablets and smart phones to access the network. To meet these goals, the utility’s security team planned to migrate to an updated version of public key infrastructure (PKI) software and core server platforms. Their existing PKI, now almost a decade old, had worked well for authenticating internal servers and laptops. But they would need a new solution if they were going to issue certificates for these mobile devices and accommodate other new technologies while ensuring the highest levels of security. A new PKI would enable new services like code signing and time stamping to ensure the integrity and appropriate governance of their internal software development processes, as well as “bring your own device” (BYOD), where certificate enrollment would allow mobile devices and tablets to access the network in a controlled and secure manner. The Challenge: Complex and Distributed Environment The real challenge of this deployment would be in working with the utility’s unique environment. To achieve the high availability, redundancy and disaster recovery functionality they needed, the team would have to deploy the PKI in conjunction with a complex server clustering infrastructure that resided on multiple sites. If they were successful, the utility’s infrastructure would be able to easily meet the demands of the next decade. But little information was available about configuring a PKI in this demanding environment – a few experts suggested it was possible, but it was clearly a daunting task. Given their security requirements, the team knew the solution would have to include hardware security modules (HSMs). “We knew we needed a certified hardware solution,” reports the utility’s lead security analyst. “We had to ensure that all of our private keys were afforded the strongest protection available – we had read too many stories about private key theft compromising entire PKIs. Our most important priority is delivering services to the public and we had to ensure we could provide the highest assurance available.” Benefits: Availability, Security and Broader Services The Thales solution provides several critical benefits: High availability. The clustered setup and nShield’s resiliency features allow for greater redundancy, including automated failover providing more robust disaster recovery and continuous availability. Stronger security. As the company opens the network to more devices, the Thales HSMs enable stronger authentication through issuance of device certificates. The PKI can issue certificates to all devices, with personal devices having only limited access to the network. Multiple HSM form factors. Using Thales HSMs allows the company to purchase appropriately-sized hardware for laptops and servers and not be forced to “over-buy”. Smart metering support. As the company rolls out smart metering technology, the solution will ensure the integrity and confidentiality of transmitted data. The Solution: Thales nShield HSMs and Expert Advice To deploy this innovative solution, the company chose a suite of Thales solutions that included nShield Connect and nShield Edge HSMs and Thales Time Stamp Server. With a legacy of experience with Thales products and recognition of their superior combination of strong security with operational ease, the security team knew their Thales products would provide the configurability and flexibility needed to work in this demanding environment. The team also relied upon the expertise of consultants in the Thales Advanced Solutions Group to help structure the deployment. “The Thales team was amazing,” says the lead security analyst. “Remember, this had never been done before. There were whitepapers out there saying it could be done, but some of the more advanced and complex technology hadn’t been proven in an actual deployment. Thales provided the enterprise HSMs, taught us how to configure and use them correctly in our specific environment, and helped us put all the pieces together with training. Their consultants were extremely knowledgeable and experienced in PKI technology and their dedication to ensure a successful project was second to none.” The results? “Our Thales solution has had a phenomenal impact on operations. Our infrastructure can now support a host of other projects that were pending. And our PKI is doing what it was created to do: not just issuing server certificates, but truly enabling many different kinds of services. We rely on PKI for so many things. And the more you depend on it, the more you need security that is hardware-based.” Thales Hardware The products deployed in this solution include: Thales nShield Connect HSM. This high-performance network-attached HSM provides secure cryptographic services as a shared resource for distributed application instances and virtual machines. nShield Connect delivers a cost effective way to ensure appropriate levels of physical and logical control for server-based systems. With nShield Connect, organizations can: Minimize operational costs with powerful key management architecture Maximize utilization and scalability with a shared centralized platform Provide cryptographic protection for network architecture in traditional, virtualized and cloud deployments Overcome the inherent vulnerabilities of software-based cryptography Thales nShield Edge HSM. This USB-connected HSM provides a cost effective way for organizations to implement high assurance cryptography. With greater portability and USB-connectivity, nShield Edge is especially suitable for laptops and in workstation or desktop environments, and its compact design and integrated smartcard reader makes it a perfect fit for deployments with limited space or where HSMs are used only on occasion. Thales Time Stamp Server. This turnkey, network-attached appliance keeps accurate time and provides secure time stamps for record creation, filing and the timing of other events associated with electronic records and applications. Time stamp server protects time-stamping operations in independently certified, tamper-resistant hardware and offers superior time accuracy and auditability.

How Thales Time Stamp Server Enabled a Startup To Easily And Affordably Build a Web-Based Service For Non-repudiable Time Stamping. The Goal: Bring non-Repudiable Time Stamping To a New Market. Startup Australian company Veridocx wanted to offer an extremely valuable service to consumers and small businesses: secure, non-repudiable time stamping at an affordable price. While time stamping for digital documents is not a new technology, it was previously primarily deployed by larger organizations with the need for higher numbers of transactions. Veridocx knew many consumers and small businesses had reasons to use a time stamping service – from protecting intellectual property to verifying the time a contract was signed to pinpointing the moment a transaction occurred. Yet there were no easy and affordable ways for consumers and small businesses to time stamp documents. Sending items through the mail or via email wasn’t a good option – envelopes and email headers could be easily tampered with. And taking a document to a lawyer for a third party witness was expensive and inconvenient. Veridocx developed a simple business proposition: to provide an online service that lets anyone obtain a time stamp for a document and identify the document positively – for just a few dollars. The challenge would be to find the right time stamping solution. It would need to be tamperproof and reliable in order to sell the service with confidence. It would have to be affordable if Veridocx was to offer the service at rates consumers would find attractive. And it would have to integrate easily into their web application. Key Features And Benefits High-assurance hardware security. Perform highly accurate time stamping for PKI-enabled applications, electronic records, and code signing—transforming electronic records into strong evidence. Easy integration with applications. Integrate secure time stamping functionality easily with business applications to time stamp digitally signed documents (e.g. PDFs), application code, or other electronic records. Accurate, auditable time stamps. Get superior time accuracy and auditability, with time stamps auditable to UTC. Tamper-resistant hardware. Protect the electronic time stamping process and keys through independently certified, tamper-resistant hardware. The Solution: Thales Time Stamp Server After considering a variety of options – from modifying off-the-shelf equipment to building custom time stamping hardware – Veridocx discovered that Thales Time Stamp Server satisfied all their requirements for security, affordability and ease of use. The Time Stamp Server was easy to integrate into their web application – the Veridocx team had it up and running in less than a day. It was highly affordable, especially compared with the cost of a custom-built solution. With an on-board Hardware Security Module (HSM), the Time Stamp Server is tamper-resistant, supports recognized time stamping protocols such as RFC 3161 and is compliant with FIPS 140-2 Level 3. By performing the time stamping process within the HSM, the Thales Time Stamp Server allows Veridocx to assure its customers that no one outside or inside the company can tamper with the time stamping process. With Thales Time Stamp Server, Veridocx is able to offer a solution that makes it extremely easy for anyone to cost-effectively time stamp, store and verify any digital file. Users simply log onto veridocx.com, pay a small fee and upload a file. The file gets a time stamp, the user gets verification and the time stamped file can then be download or stored on the Veridocx site for safekeeping. The Thales Time Stamp Server handles all of the actual time stamping process – the Veridocx website essentially serves as a large front end to an extremely flexible time stamping technology. A Time Stamping Solution That Integrates Easily With Applications Veridocx chose Thales was because Time Stamp Server was robust, mature and easy to integrate into the Veridocx web application. This enabled Veridocx to focus on building top-notch services for their customers. It took the Veridocx team less than a day to configure and integrate the Time Stamp Server into their platform. The Thales Solution Also Offered Other Significant Benefits: Non-repudiability. This was essential to the Veridocx team. They needed to be able to promise and prove that no one could forge or tamper with a time stamp. With the time stamp keys securely protected in a hardware security module, Veridocx knew their time stamps were safe from hackers and other external threats, as well as from any internal threats. If it was necessary, they could use auditable security trails to prove that no one could have hacked into the Thales product to modify or tamper with a time stamp. Security. Unlike software-based systems in which administrators can easily manipulate time values, Time Stamp Server protects time stamping keys in independently certified, tamper-resistant hardware. Quality. The quality of the hardware made installation and operation easier and solved many of difficult security and reliability problems that arise in an implementation of this kind. Support. The Veridocx team discovered that the quality of Thales hardware was matched by the excellence in service and support they received on both the business and technical side. Reputation. Veridocx wanted to be able to market their service as having been built with the most secure and reputable time stamp technology available today, and Thales fit the bill. Affordability. Veridocx was able to implement the Thales solution at a cost that was far less than building their own system with custom software and off–the-shelf hardware. Thales Time Stamp Server Time Stamp Server from Thales eSecurity is a turnkey, networkattached appliance that keeps accurate time and creates secure time stamps to record creation time, filing time, or the timing of other events associated with electronic records and applications. By deploying a highly accurate and tamper-resistant electronic time stamping solution, organizations can verify the accuracy of time stamps used for digital records and improve the integrity and auditability of a broad range of critical processes. Ideal for organizations that need electronic document signing with proof of time for legal and compliance purposes, Time Stamp Server’s other common applications include financial transactions, lotteries and gaming, security logs, approval workflows, long-term archives, electronic lab books, and code signing. Unlike software-based systems in which administrators can easily manipulate time values, Time Stamp Server protects time stamping keys in independently certified, tamper-resistant hardware. The time stamping component is validated to FIPS 140-2 Level 3 and Common Criteria EAL 4+, and can provide highly accurate time stamps auditable to Universal Coordinated Time (UTC) for secure time traceability to independent national atomic clocks. Functional Capabilities Supports PKI-enabled applications, electronic records and code signing Facilitates long-term auditability and enforces non repudiation Highly accurate and auditable to UTC Provides secure time traceability to independent national atomic clocks Tamper-resistant time stamping component Protocols and Interfaces PKIX time stamp protocol (RFC 3161), ETSI TS 102 023 and 101 861 Support for custom applications using optional toolkit (Java and C) Authenticode for code signing applications Compatibility and Upgradeability Can be deployed with Thales Time Source Master Clock Integrates with Adobe Acrobat, LiveCycle, Microsoft Authenticode and Office Software upgradeable to latest releases

How a leading Global Certification Authority Moved To Assure Clients And Auditors It Could Deliver The Assurance And Reliability They Require The Goal: Delivering High Assurance Cryptographic Key Management Founded in 1999, QuoVadis is a leading global certification authority, providing managed Public Key Infrastructure (PKI) services and trusted time stamping services for international companies and organizations. Headquartered in Bermuda, QuoVadis also has operations in Switzerland, the Netherlands, and the United Kingdom. The company is accredited as a Qualified Trust Service Provider (TSP) in multiple European countries, and issues eIDs under the Swiss SuisseID and Dutch PKI Overheid programs. For QuoVadis, key management is critical to the success of their business as well as the countless client transactions driven by QuoVadis services. QuoVadis digital certificates and digital signature services are used to support high value applications that are subject to stringent security requirements and audit regimes. QuoVadis also provides a scalable trusted time stamping capability to support customers requiring a provable and auditable record of the exact time that a digital signature process took place. QuoVadis relies on the superior key management capabilities of hardware security modules (HSMs) in many of its core activities. As the company grew and service offerings were expanded, QuoVadis needed a scalable and efficient solution that could satisfy customer requirements, as well as meet evolving security standards and accreditation regimes in multiple countries. The QuoVadis team knew they needed an HSM solution that combined operational efficiency with a proven security track record – and they needed a provider that could deliver the expertise they required to deploy HSM-based solutions in an increasingly complicated business environment. The Benefits: Reliability, Ease of Use And Cost Savings The Thales solution offered a number of advantages says Barry Kilborn, head of risk management at QuoVadis: Reliability: Thales enabled QuoVadis to quickly deploy reliable and flexible solutions. “We were very interested in minimizing potential problems. Thales gave us more options from an operational perspective to minimize the risk of downtime.” Ease of use: With the Thales Security World key management architecture, QuoVadis is able to manage their HSMs with greater automation and less administrative burden. “The Thales solution was easier to use. And that’s very compelling when you’re setting up a lot of CAs. With multiple CAs, the amount of time key management takes becomes a tremendous burden. The unique Thales Security World architecture allows us to achieve a high assurance level while managing keys much more efficiently than other solutions, and to provide more efficient service to our customers. And as a commercial CA with many CAs to manage, it’s a big plus to eliminate manual, people-intensive management tasks.” Cost savings: With Thales, QuoVadis can offer nShield Edge USB-connected HSMs for their customers who carry out a lower volume of digital signing on their own premises. These economical HSMs provided a low cost solution that delivered high security for these customers. The Challenge: complex and overlapping standards for accreditation The QuoVadis team had several major requirements. “First of all we felt we needed to upgrade the reliability and resiliency capabilities of our HSMs,” says Barry Kilborn, head of risk management at QuoVadis. “As a Trusted Third Party in client transactions, we need HSMs that are optimized for a high assurance, high availability, networked environment.” And the most complicated requirement: they needed a solution that could achieve accreditation in all the countries where they provide trusted services, from a provider who understood the business and the intricacies of the regulatory environments in which the products would be deployed. For QuoVadis, the stakes were significant. “Our business is focused on creating trusted internet identities and digital signature solutions on valuable transactions. Our customers need our solutions to deliver high assurance and absolute trust, and the HSMs are fundamental to that trust.” The Solution: Thales nShield Connect, Time Stamp Server and the Advanced Solutions Group QuoVadis chose Thales nShield HSMs with the market-leading Thales Security World key management architecture, and Thales Time Stamp Server. And to design and implement their HSMs to provide secure key management and time stamping for the operation of their high volume commercial CA, QuoVadis chose the Thales Advanced Solutions Group. “With Thales, the hardware is only part of the story. For the caliber of hardware that we require, the list of qualified vendors is actually quite small. But one of our biggest priorities is to find providers who not only have in-depth knowledge of the technology but of the businesses in which the technology operates. And Thales delivers with both the dependable technology and responsive services,” says Kilborn. Thales Solutions Thales nShield Connect HSM. This high-performance network attached HSM provides secure cryptographic services as a shared resource for distributed application instances and virtual machines. nShield Connect delivers a cost effective way to ensure appropriate levels of physical and logical control for server-based systems. With nShield Connect, organizations can: Minimize operational costs with powerful key management architecture. Maximize utilization and scalability with a shared centralized platform. Provide cryptographic protection for network architectures in traditional, virtualized and cloud deployments. Overcome the inherent vulnerabilities of software- based cryptography. Thales nShield Edge HSM. This USB-connected HSM provides a cost effective way for organizations to implement high assurance cryptography. With greater portability and USB connectivity, nShield Edge is especially suitable for laptops and in workstation or desktop environments, and its compact design and integrated smart card reader makes it a perfect fit for deployments with limited space or where HSMs are used only on occasion. Thales Time Stamp Server. This turnkey, network-attached appliance keeps accurate time and creates secure time stamps for PKI-enabled applications, electronic records, and code signing – transforming electronic records into strong evidence. Unlike software-based systems in which administrators can easily manipulate time values, Time Stamp Server protects time stamping keys in independently certified, tamper-resistant hardware. Time Stamp Server offers superior time accuracy and auditability, delivering secure time traceability to national atomic clocks and Universal Coordinated time (UTC) if required. Thales Advanced Solutions Group (ASG). Thales ASG consultants offer sound practical advice on the most effective way to implement and deploy Thales cryptographic technology. Thales consultants are present throughout deployment, offering advice and transferring knowledge and experience to the organization’s staff. With assistance from ASG, organizations can: Accelerate HSM deployment. Mitigate risk associated with implementing new hardware and software into existing environments. Get detailed reporting on the implementation. Improve knowledge of best practices. Maximize return on investment in data protection solutions. Simplify key management with Thales Security World The Thales Security World architecture provides a businessfriendly methodology for securely managing Thales HSMs and using keys in real world IT environments. Security World minimizes the strain on specialist security resources and instead takes advantage of existing data management processes. This drives down the cost of ownership for HSMs while building resiliency and ensuring long term availability of keys. Thales Security World enables organizations to: Simplify the key management process. Maximize the capabilities of HSMs. Manage risks while preserving resiliency and scalability. Reduce operational cost while maintaining the highest levels of security.

How a PKI Managed Service Company Uses Thales Hardware Security Modules To Provide On-Demand Digital Certificates To Government Agencies The Goal: Expand Business By Enabling Strong Authentication For Mobile Devices – Quickly And on Demand As one of the UK’s leading authorities on public key infrastructure (PKI) and identity assurance, Trustis has provided on-demand managed PKI and identity services for a wide range of public and private organizations from a high security hosting facility since 1998. More recently, Trustis sought to launch a new service offering – the Mobile Device Certificate Service (MDCS). This would provide ondemand digital certificates for public and private organizations that wanted to give their employees secure access to their networks via smart phones, tablets and other mobile devices. Two major factors drove this business decision. First, the UK government realized they must embrace mobile devices to support reduced expenditure. So for the first time the government would permit agencies to use iPhones and iPads up to Restricted level, as long as each device was authenticated using a valid digital certificate (among other provisions). Secondly, with G-cloud – the UK government’s program that promotes the use of cloud-based IT services (similar to President Obama’s Cloud First initiative in the US) – gaining traction, Trustis could provide their innovative service directly, saving agencies much needed money. Trustis’ plan was to create a service that would allow government agencies to purchase on-demand PKI services for their mobile device users. It would also service private companies looking to reap the employee productivity benefits of Bring Your Own Device (BYOD) solutions that enable secure access to corporate networks. The service would target users that wanted to quickly and securely implement mobile technology, and wished to avoid the cost and/or effort of deploying a new or upgraded in-house PKI to support certificate issuance for mobile devices. The benefits: Security, Reliability, Speed and Costeffectiveness Robert Hann, Business Development Director at Trustis, says Thales HSMs provide a number of benefits for the Trustis service: Security. When you add a Thales HSM to your PKI you are deploying a high assurance, independently certified, tamperresistant device to secure some of the most sensitive keys and business processes within an organization. Thales HSMs enable Trustis to deliver the high level of security assurance and reliability necessary for such a widely trusted service. Resilience. Running a service at high availability, we have to have the most reliable HSMs. We have absolute confidence in the operation, security and control of Thales HSMs. Speed. With the ability to perform fast elliptic curve cryptography, Thales HSMs can provide added speed, which becomes increasingly valuable as the volume of transactions increases in very large scale managed services. Cost-efficiency. Thales HSMs provide a much more economic backup model than alternative solutions – a key differentiator when operating 24x7 managed services. Accreditation. Thales products have a long history of multiple and international certifications including, what is standard for Trustis, FIPS 140-2 Level 3. Simplicity The Thales product line is simple to understand and explain. There is an efficient backup and recovery model, which is critical for Managed Service Providers. Support. We’ve had an excellent track record with Thales support. Their support team is always available and their service staff are well trained. Partnership. Cloud services are still relatively new to government and enterprise and there can be many security issues to deal with. Having a partner like Thales that understands PKI and cloud services is vital to our shared success. Trustis knew the service could be revolutionary. It would give public and private organizations alike an easy, cloud-based process for adopting mobile technology without having to invest in new or upgraded PKI technology. It could for example allow agencies to roll out a few dozen smartphones or 100,000 iPads quickly and without a lengthy IT security project. It would provide mobile device management products with a robust and compliant PKI to underpin their security features. And it would make mobile technology easier to manage, giving administrators the ability to control all credentials on a user-to-user basis. By making strong authentication easy, cost-effective and quick to deploy, it would allow organizations to achieve all the gains in productivity and collaboration that mobile devices can offer. The challenge: Providing High Assurance And Scaling For Growth One major hurdle for Trustis was to ensure the authentication enabled by their PKI services would provide an appropriate level of assurance to meet the strict standards of UK government classification as well as private sector usage. But the technology couldn’t be too costly or it would defeat the government’s objective of achieving cost savings through cloud-based services. It also couldn’t be too slow or too cumbersome – speed and ease-of-use were critical to delivering the value that would draw customers to the solution. And finally it needed to be in a position to scale to accommodate rapid growth. From their long history and experience implementing PKI best practices, Trustis recognized the importance of using hardware security modules (HSMs) to protect private signing keys and signing operations for root and issuing certificate authorities (CAs) – even though their operations are operated in a highly secure ex-military facility. Combining dedicated hardware-based cryptography with proper procedures and processes, Trustis could offer a provable, auditable, high-assurance PKI foundation. But to meet the remaining requirements in their managed service environment, Trustis would need to deploy HSMs that could provide the type of operational efficiencies that do not often go handin-hand with high levels of security. The Solution: Thales HSMs Trustis chose to build its Mobile Device Certificate Service solution using Thales nShield Connect HSMs. nShield HSMs provide a hardened, tamper-resistant environment to protect private PKI signing keys and associated cryptographic operations from vulnerabilities such as key theft that could undermine the trust of the entire system. The Thales HSMs not only enabled Trustis to comply with the government’s exacting security standards and the assurance needs of private enterprises, but also to achieve the reliability, scalability and high availability it would need for a cloud service. “It wasn’t a difficult decision,” says Robert Hann, Business Development Director at Trustis. “We provide managed service PKIs for a wide variety of organizations, and all of our managed PKI solutions rely on Thales HSMs because of their unique combination of strong security and operational ease for critical functions like key backup. They are also interoperable with multiple PKI products, highly reliable, and the company provides excellent customer service – which all combines to make them the most cost-effective choice for us.” Thales Solutions nShield Connect, the device deployed for this solution, is a highperformance network-attached hardware security module (HSM). nShield Connect delivers highly secure cryptographic services that provide a cost-effective way to establish appropriate levels of physical and logical controls for PKIs and many other business applications. Fully supporting the unique Thales Security World architecture, nShield Connect provides an ideal combination of high assurance and operational ease, which is critical in a managed service environment. The benefits for both in-house and managed service PKI deployments include: Easily deployed and independently certified security for high assurance key management and certificate issuance processes Accelerated cryptographic signing processes to boost performance and enable application and process scalability Tightly enforced key management policies to simplify compliance demonstration and responses to audit requests Choice from a range of form factors and performance ratings to meet deployment scenarios ranging from low volume, offline root CAs to high volume, redundant, network-attached CAs

Thales Hardware Security Modules Ensure The Authenticity Of Finland’s E-Passports With Fingerprints Secured By Digital Certificates With one of the world’s most electronically enabled populations, Finland has long been a leader in delivering online government services that take advantage of effective identity and access management. The country’s Population Register Centre (PRC) provides a clear example. It operates national public key infrastructures (PKIs) and Certification Authorities (CAs) secured with Thales hardware security modules (HSMs) to issue unique and verifiable digital identities, called Citizen Certificates, to all residents. Residents can use their Citizen Certificates to access secure online government services efficiently and cost effectively. So when Finland needed the PRC to use similar technology to issue new e-passports to comply with the latest European Union (EU) directives on electronic ID issuance, the PRC knew from experience where to turn to ensure the integrity of the process—Thales. According to Jan Partanen, development manager for the Population Register Centre of Finland, “The EU’s new e-passports are the most secure in the world because they are protected by tamper-proof digital certificates. However, the system will only work if countries secure—without fail— the signing keys that guarantee the authenticity of the digital certificates. With Thales HSMs protecting the signing keys for Finland’s CAs, PKI, and electronic ID issuance, we are confident in our ability to ensure the integrity of Finland’s e-passports and online government services.” Benefits With Thales Enabling the electronic verification of identity Protecting the integrity of e-passports and the privacy of citizens Preventing passport fraud, counterfeiting, and misuse Securing the delivery of online government services Ensuring Security And Privacy Every person’s fingerprint is uniquely their own. The EU is taking advantage of this simple fact to ensure that only the correct person can use a passport to travel. How? Based on the Extended Access Control (EAC) standard, the EU’s second generation of e-passports allows governments to leverage a stronger biometric (typically a fingerprint or iris scan) that is more difficult to impersonate. EAC e-passports will protect the passport holder’s privacy while ensuring the validity of passports. Once the new e-passport process is fully implemented it will become virtually impossible for anyone to travel under an assumed identity with a fake EU passport. The EAC scheme requires European Union Member States to add fingerprint data to machinereadable travel documents (MRTDs). Whether they are used to protect e-passports, PKIs, or electronic IDs, digital certificates are secure because they are issued by a trusted CA using its unique signing key. However, if a signing key were ever compromised or stolen, someone could issue a seemingly valid digital certificate. Because HSMs provide a tamper-resistant environment that is significantly more secure than software, the EU mandates their use to generate, store, and protect the CA signing keys for e-passports. A History Of Success Historically, the Finnish government has relied on Thales HSMs to protect its national CAs and PKIs, so from the beginning the PRC knew that it would prefer to use Thales HSMs to protect the integrity of its e-passports. Thales HSMs have proved to be secure and trouble free, integrating seamlessly with the country’s CAs for issuing certificates. Thales HSMs are certified to Federal Information Processing Standard (FIPS) 140-2 level 3, which is the most widely adopted security benchmark for cryptographic solutions in government and commercial enterprises, and is mandated by the EU EAC e-passport standard. Just as crucially, the Thales Professional Services team offered expertise in both e-passports and key management to help the PRC establish an efficient—and cost-effective—e-passport issuance process. “The PRC is very experienced in delivering online government services through PKI deployment and the issuing and use of digital certificates,” notes Mr. Partanen. “In our opinion, Thales HSMs are an excellent solution to protect signing keys. Of course, key management is also important. Thales Advanced Solutions Group has excellent key management expertise, together with a record of delivering trusted solutions. We did not hesitate in choosing Thales Advanced Solutions Group and Thales HSMs to secure our e-passports.” The E-Passport Process Working with Thales eSecurity’s Advanced Solutions Group, the PRC has developed and implemented a new e-passport issuance process that complies with EU standards and protects the privacy of its citizens. The new e-passports contain a chip embedded with a digital certificate and the passport holder’s fingerprint. The country’s root CA issues each certificate using signing keys securely generated and protected within a Thales HSM. As the signing keys never leave the security of the HSM, they are never exposed to misuse. At border crossings, a passport reader will be able to verify the identity of the passport holder. Only devices authorized by digital certificates will be able to read the passports, protecting the passport holder’s privacy as well as ensuring the validity of the passport. ORGANIZATION PROFILE Founded in 1969, the Population Register Centre of Finland maintains population and identification information relating to the people and buildings in Finland. It is dedicated to serving the people of Finland by delivering high-quality identification solutions for online and other services. To learn more about the PRC, visit www.vrk.fi and www.fineid.fi Cost-Effective And Highly Available The PRC opted to use the network-attached Thales nShield HSM in its e-passport process rather than an HSM that works with a single server. By networking its HSMs, PRC saw two important advantages; firstly, because the nShield serves multiple servers, the PRC did not need to purchase one HSM for every server in its e-passport PKI, reducing hardware costs. The second advantage was that the HSM efficiently supported high availability and scalability, with automated failover allowing seamless switching between HSMs. “The Thales nShield offered a definite cost and availability advantage because one device can support several servers and applications at the same time,” explains Mr. Partanen. “It also delivers all the security features we would expect from an HSM, including separation of duties in administration to protect devices from internal manipulation.” Protecting Processes And Citizens As Finland issues e-passports that include fingerprints protected by digital certificates, Mr. Partanen points to the potential consequences of errors as the driving force behind the value of HSMs. He says, “In the case of e-passports, compromised signing keys would mean that criminals or terrorists could issue counterfeit passports. Or if keys were used to unlock the e-passport itself, citizens’ privacy could be irrevocably damaged. By deploying Thales HSMs, our signing keys never leave the security of the hardware module, so they are never exposed to misuse. HSMs and digital certificates can seem complex, but the result of using them is simple for us. They ensure the integrity of Finland’s e-passports, CAs, PKIs, and online government services.”

Using Thales Solutions, Certicamara Helps The Colombian Government Prevent Fraud And Corruption With Auditable Digital Time Stamps. Established in 2004, Certicamara provides secure online transaction processing solutions to businesses and government organizations within Colombia. Its customers have increasingly found that they needed a solution that not only verified the identities of servers and organizations in electronic interactions. They also wanted to be able to verify—using a tamper-proof method—when an interaction took place and that data within the transaction was not modified. In response to its customers’ needs, Certicamara developed a time stamping service that uses the Thales Time Stamp Server, part of the nCipher product line, to attest the time and origin of electronic records. “For many types of electronic transactions, processes, and submissions, it is important to know the exact time that they occurred,” says Leonardo Maldonado, system administrator for Certicamara. “This is especially true for digitally signed electronic documents. Time stamping is the answer. The Thales Time Stamp Server provides the secure time stamping that enables our business and government customers to protect their processes from fraud and manipulation.” The Advantage of Tamper-Proof Appliances Many business and official government processes are time-sensitive. With fines and fees, governments usually impose a deadline for payment. In traditional paper-based transactions, signatures and physical time stamps serve to authenticate when processes occurred. Electronic processes rely on a similar method, wherein a software application or a hardware appliance digitally signs electronic records with a time. Not all digital time stamping methods are equally secure and easy to integrate. With software-based methods, digital stamps are issued by a server using a time source within the server. Both the stamp and time could be manipulated by a hacker or an insider. Appliance-based time-stamping is far more secure because stamp issuance and timekeeping take place within a protected, tamper-resistant environment that is validated to Common Criteria EAL 4+ and FIPS 140-2 Level 3 for security. Neither insiders nor hackers can interfere with the digital signing process. Benefits with Thales Providing auditable time stamping for electronic records Enabling efficient, cost-effective electronic processes Helping to prevent fraud and corruption Integrating time stamping with applications quickly and easily Performance Matters Certicamara tested a number of hardware-based time stamping solutions before selecting the Thales Time Stamping Server and the Thales Time Source Master Clock. Two factors convinced the company to select the Thales solution. The primary reason was performance. In addition, Certicamara has a long—and highly successful— history of using Thales hardware security modules (HSMs). Chacon explains, “You don’t want a stamping process that slows a transaction. The Thales Time Stamp Server stamps electronic records with a digital signature in about 10 milliseconds. Our other options could not match that, and slower processing would have negatively impacted the number of simultaneous users the system could efficiently support. Plus, we have used Thales HSMs to protect our user authentication processes for more than five years. They have provided problem-free security.” Easy Implementation To implement the Thales Time Stamp Server, Certicamara used the Thales TSS Toolkit. The toolkit provided a Java and C language development framework for integrating time stamping into Certicamara’s existing application environment. The Thales Time Source Master Clock supplies auditable and accurate time to the server. Now, customers that use Certicamara’s secure network for processing transactions and other electronic records can take advantage of time stamping too. “We were very impressed with the TSS Toolkit,” notes Chacon. “It made integrating time stamping with our business applications easy. It also allowed for flexible implementation. Today, our customers have the option of adding secure, auditable time stamping to all their processes or to specific transactions.” Stamping Out Corruption Many of Certicamara’s customers immediately saw the benefit of securely verifying electronic records with auditable time stamps. For instance, Colombia’s Ministry of Transportation, a longtime Certicamara customer, added secure time stamping to its online vehicle registration process, and the Ministry of Finance opted to include secure time stamps on the online transactions it facilitates for Colombian financial institutions. Time stamping is also enabling new processes. The government of Colombia is currently implementing a purchasing process that will use time stamps to help prevent corruption. Government contractors will need to submit bids to supply goods and services through the Certicamara system. The Thales Time Stamp Server will digitally sign each bid, making it impossible to bribe anyone to look at competing bids early or to fraudulently submit a bid after the official deadline. “The Thales Time Stamp Server will sign bids with a digital certificate showing the exact time they are submitted,” explains Maldonado. “No one will be able to manipulate the bidding rules. It’s a simple way to protect against corruption while enabling more efficient electronic processes.” Company Profile Based in Bogotá, Colombia, Certicamara enables government and business customers to secure their transactions, communications, and applications with digital certificates. More than 10,000 subscribers and 200 websites in Colombia rely on Certicamara to help protect their business processes. More Services, More Security With its Thales-powered time stamping services, Certicamara believes that it is better positioned to fulfill the need for accurate, auditable electronic records in Colombia. “Time stamping is a simple way to verify many legally important aspects of electronic processes,” says Chacon. “It allows our customers to confidently move away from inefficient paper-based ways of doing business even for processes that must be auditable and verifiable. In fact, we believe that digital signatures and time stamps are actually more secure than paper and physical signatures. Handwriting can be forged, but the Thales Time Stamp Server protects our signing process from forgery, manipulation, and tampering.”

BACS (Bankers Automated Clearing System), the UK ACH service, Is One of The Largest And Most Successful Money Transfer Organisations Worldwide. Its Direct Debit and Direct Credit Services Process Over 60m Payment Items In a Busy Day, On Behalf of Over 100,000 UK Businesses. BACSTEL is the access mechanism used for submission of all of these payment instructions. It has been operating for over 20 years with superb reliability and efficiency, consistently exceeding all operation targets. However, the infrastructure of BACSTEL is now aging rapidly, proving more expensive than more modern alternatives to operate and lacking the flexibility to support new, innovative services. As the first phase of its ambitious 5 year technology renewal programme, NewBACS, BACS has introduced a replacement for this access network, called BACSTEL-IP. Rather than opting for a conservative, direct replacement strategy, BACS has devloped a truly innovative solution, using state of the art security technology to deliver a platform for dramatic improvements in the services offered to business users, substantial cost savings and, perhaps most important of all, the delivery of advanced new payment services to keep the UK at the forefront of electronic commerce developments. BACSTEL-IP required a comprehensive security solution to strongly authenticate users, ensure traceability of all transactions and provide a robust audit trail. Users access the system using a cryptographic smartcard issued by any of the member banks. The same smartcard is used to digitally sign all payment instructions, tying them to the signer and ensuring that they cannot be accidentally or deliberately altered. Each bank has the flexibility to select its own Public Key Infrastructure (PKI) for the issuing of the digital certificates used on this card. Building a Secure National Payments Infrastructure The solution had to scale to over 500,000 users, support over 100 million payment items per day and interoperate with 12 banks, operating 7 different PKI systems with 5 different smartcard manufacturers. After lengthy evaluation, BACS selected Thales SafeSign Service Centre to authenticate users, ensure traceability of all transactions and provide a robust audit trail. n order to support the simultaneous connection to 12 banks required by BACSTEL-IP, Thales developed a unique multi-channel validation capability for SafeSign. This removes the complexity of support for multiple PKIs from the BACS application, and ensures compatibility with all relevant PKI standards. Benefits for Business Users: Strong, smartcard security gives protection from unauthorised transactions Near real-time payment status reporting Reduced processing costs resulting from 100% electronic reports Faster payment submission using IP technology Enhanced control over payment authority and delegation Tighter risk management through individual authorisation and real-time checking Strong audit trail reduces risk of transaction disputes Strong protection of customer data in transit and in processing Substantial process cost savings through reduction of paper and manual intervention Near 100% straight through processing, as data quality is guaranteed SafeSign is used to authenticate the holder of the smartcard, by generating a random challenge to be signed using the smartcard and PIN and verifying this cryptographically against the users Public Key Certificate. SafeSign also digitally signs the reports sent by BACS to users, and verifies the signatures on all incoming payment instructions. All digital certificates used are verified in real time against the issuing bank, ensuring that lost or stolen cards cannot be used to sign transactions, and that changes in employee status are reflected in the system as soon as the bank is made aware of them. This substantially reduces the risk of fraud compared to the old system. To minimise time to market and reduce project risk, the Thales project team worked closely with the other vendors involved in the project, and fully involved the BACS technical design and implementation teams throughout the development cycle. This approach contributed significantly to the successful ontime delivery of the overall solution. Innovation on a National Scale Early customer reaction to the new BACSTEL-IP service has been very positive, with over 75% of users expressing the intention to migrate to the new solution as soon as it is available to them. In the same survey, users rated the enhanced security of the new system the number one benefit to their business. Users particularly value the ability to tightly define payment permissions for individuals in the business, allowing delegation of signing responsibility to specific cardholders within subsidiaries or departments whilst retaining full control at a corporate level. BACSTEL-IP is a world-leading project, providing the UK with the most advanced, flexible and cost effective system for electronic payment submission anywhere in the world. It provides a platform for the integration of payments into electronic supply chain and business re-engineering solutions, and will encourage the deployment of end-to-end ecommerce solutions. It gives the UK financial services industry an internet-age solution to the delivery of corporate and business payment services, and a platform to compete in European and global payment clearing markets. BACSTEL-IP positions the UK financial institutions to offer new, innovative payment services for UK businesses, which will substantially improve the competitiveness of the UK economy. Company Profile Bacs Corporate Bacs is a not for profit, membership based, industry body, which in 2009 was responsible for processing more than 5.6 billion UK payments with a total value of £3.83 trillion GBP. It is owned by 16 of the leading banks and building societies in the UK and Europe. It has been at the heart of the payments industry for over 40 years and is responsible for the schemes behind the clearing and settlement of automated payments in the UK and maintaining the integrity of payment related services. At the core of the BACSTEL-IP solution are the digital signature verification and strong authentication services provided by Thales SafeSign. The unique capability of SafeSign Service Centre to integrate seamlessly and transparently to multiple PKI systems has enabled BACS to deliver this stateof-the-art solution in record time, and with minimum additional application programming. From agreement of the functional requirements in March 2002, the complete security solution was designed, developed and tested in just 6 months, going into “controlled deployment” (the first stage of production roll out) on schedule at the end of October 2002. For more information, visit the BACS web site at www.bacs.co.uk and follow link to BACSTEL-IP.

Protecting government has never been more of a challenge: The demand for online, transparent access to services and records is rapidly increasing, meanwhile the corresponding attack surface grows exponentially. The State of Hawaii tackled this situation head on. Todd Nacapuy, chief innovation officer for the State of Hawaii, oversees the Office of Enterprise Technology Services (ETS), which is tasked with providing governance for information technology programs, projects and services across the state’s executive branch. He explained, “We have defined seven CIO priorities for ETS to ensure an effective, efficient and open government: IT Workforce Development, IT Governance, Services-Oriented Infrastructure, Enterprise Projects and Programs, Open Government, Cyber Security, and IT Cost Transparency.” Business Challenge As the State of Hawaii tries to make more and more of its data accessible to the public under the open government initiative, it is ETS’ duty to mitigate the inherent new risks. Much of the data that the State holds is considered personally identifiable information (PII), and regulations – such as the Payment Card Industry Data Security Standard (PCI-DSS), Health Insurance Portability and Accountability Act (HIPAA), Fair Information Practice Principles (FIPPs), and Federal Information Security Management Act (FISMA) – require the data to be protected by encryption. Michael Otsuji, the State’s IT development officer, noted, “We are constantly making our organization aware of the potential cost of a breach, as well as what would happen if data was exposed; including the effort of clean-up that would have to be undertaken.” “Our goal was to implement data access on a just-in-time basis: only enabling an entrée to information as and when an authorized user really needs it,” recalled Nacapuy. “We wanted to deploy an encryption solution for our enterprise projects, and at the same time extend an ‘encryption-as-a-service’ offering to all of the State of Hawaii departments that wish to more tightly secure their data.” Technical Challenge Deploying encryption as a last line of defense became a key initiative for ETS particularly when it implemented a second data center – to serve as a back up to the primary site – that was located in a shared facility. “Even though the center is physically secure, we don’t have exclusive control of the space,” explained Nacapuy, “And we wanted the data to be unreadable if our other defenses were breached – for example, if someone stole a server – we needed the data to be useless to them.” Solution ETS evaluated vendors with encryption solutions, assessing them to find the optimal solution to meet its needs. Having reduced the options to a shortlist of contenders, a proof-of-concept with each was undertaken to determine individual speed, cost, ease of - use, and overall capabilities. Nacapuy recounted, “Vormetric Data Security (DSM) by Thales stood out because of Vormetric Transparent Encryption with its support for a wide variety of file formats and data states – such as data at rest – combined with Vormetric Key Management handling the rolling keys. It also demonstrated impressive speed at processing the encryption and decryption of files.” Having made the decision to standardize on the Thales solution, rollout began with ETS educating the various departments about the new encryption service. ETS took on a consultative role to fully understand the specific compliance regulations that needed to be achieved by each group and to ensure the appropriate information became secured by Vormetric Transparent Encryption. Otsuji stated, “The response to ETS offering the encryption service has been very enthusiastic because it’s not just a nice to - have it’s now a requirement for many departments, and with Thales we make it so easy and efficient.” Results Nacapuy concurred, “It’s very efficient for us because management of the Vormetric Transparent Encryption is so simple. It enables us to accomplish more with less because of the flexibility it offers in terms of spanning all of the data types across the business entities that we service.” “Thales has been a wonderful partner,” recounted Otsuji, “Putting on presentations for the departments and being extremely involved in the successful adoption of encryption by them.” Just-in-Time Data Access “We’ve listened to the operational needs of our colleagues and are able to take a business-centric approach to the capabilities we offer,” observed Nacapuy. “And Thales has become a critical offering within our services-oriented infrastructure for end-to-end encryption as well as data at rest.” He concluded, “Our move into the new paradigm of only enabling access to data as and when authorized users really need it is one of the primary catalysts behind our investments in leading-edge security solutions like Thales. DSMs is a key contributor to delivering just-in-time access conveniently and efficiently.” Keeping Everything Secure In The Aloha State Business need Identify encryption solution to achieve Compliance with a broad range of regulations Data only accessible on a just-in-time basis Technology need Secure multiple data types and states Support dual data center operations Solution Vormetric Data Security Manager by Thales Results Cross-departmental, cross-facility security Major regulatory compliance requirements addressed easily and effectively Protection for data from cyber and physical breaches Encryption now offered as a component of services-oriented infrastructure Move to just-in-time information access About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

As one of the Asia-Pacific region’s recognized Stock Exchanges, this organization was challenged by its Government to bring transparency to the country’s capital market. Taking on the challenge, the exchange set up a modern, fully automated screen-based trading system with national reach and has brought about greater transparency, speed & efficiency, safety and market integrity. Business Challenge The exchange makes a point to showcase its best-in-class information security solutions. The exchange’s solution architect explained, “The executive management and business teams look to us to set the standard for security. It is for this reason that we have always gone above and beyond what the mandatory regulations require of us; we wanted robust encryption for our personally identifiable information.” Technical Challenge With the country’s capital market totally dependent on uninterrupted operations, the spokesperson reflected, “We needed powerful encryption from an effective, mature product that has been developed and tested for several software generations. We also wanted a flexible solution that supports a variety of file types. “From the beginning of the search process we knew we needed to invest in encryption that would not cause any application-level changes or performance degradation.” Solution The exchange examined all of the levels at which it could implement encryption and – after zeroing in on the options that also supported data at rest – put all of the possible solutions through a stringent two-phase evaluation process. The architect reported, “We knew Thales is very highly rated but we looked at several other products as well. When we did a head-to-head commercial evaluation of the possible solutions, we found many to be unrealistically expensive for what they offered. “Only two solutions graduated to the technical proof of concept and Vormetric Data Security Manager (DSM) by Thales with Vormetric Transparent Encryption was the clear leader. It was faster in terms of the actual encryption, we did not see any lag in applications’ performance, and it was completely stable. This was definitely not the case for the other product we looked at.” Determined to prevent any interruption to its production operations, the exchange rolled out Vormetric DSM in a test environment to fully define policies and key management configurations. The solutions architect recounted, “We ran exhaustive tests in our simulations and then brought in Thales consultants for the production deployment: We were well prepared and the implementation went perfectly to plan, without incident.” Results The exchange’s staff is pleased with the outcome: “The internal audit team – from IT risk and compliance – was involved in the entire process,” the solutions architect noted. “After the proof of concept was complete and we moved into planning the production deployment, we reconnected with them, and they were completely satisfied with the strength of the Thales solution. “To the delight of my management, Vormetric Transparent Encryption works as promised and the exchange has met its encryption goals with no performance impact or change of any kind; in fact no one on the user side even knows they are accessing encrypted information!” Thales more than meets the exchange’s reliability requirements, the spokesperson stated, “For failover we have a business continuity, fully redundant, mirrored infrastructure in place with Thales seamlessly deployed and protecting our backups too.” It also is important to the exchange that it can rely on Thales as it expands and scales in the future the architect noted, “We chose Thales because it delivers the latest in encryption technology in a mature product that has proven compatible with every file format we have or may someday implement. We are secure in our future with Thales.” Recommending Thales To Peers The exchange is so satisfied with the performance of Thales that the security team has been recommending it to peer organizations. The solutions architect concluded, “Since realizing Vormetric Transparent Encryption’s success in our own environment we have been advocating for it in both across our industry and beyond.” Cutting-Edge Technology, Stable, Scalable Solution Business need Setting the standard for information security in country’s financial industry Exceed mandatory compliance requirements Technology need Experience no change in application performance Deploy a mature, scalable encryption solution, employing cutting-edge technology Solution Vormetric Data Security Manager by Thales Vormetric Transparent Encryption by Thales Results: Exchange management and internal audit team acknowledge speed, reliability, and quality of encryption Secure encryption extends to the business continuity environment Thales’ flexibility will enable the exchange to scale in the future Exchange has initiated plans to rollout Vormetric Encryption in other critical applications on a wider scale About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Kareo is the only cloud-based, medical office software and services platform that has been purpose-built for independent practices. The company’s mission is to help medical providers spend their time focused on patients, not paperwork. Consequently, these providers rely on Kareo’s platform 24/7. Key to the value of its platform is the document management and object storage system, which requires encryption to protect sensitive patient information. Business Challenge One of Kareo’s key advantages is the balance it strikes between providing innovative functionality and achieving a compelling price point. The company’s legacy encryption mechanism was a critical component of the Kareo offerings, but it had begun to impose unacceptable levels of overhead and a decision was taken to search for an alternative. Jerry Miller, director of network operations at Kareo recalled, “We needed to integrate encryption into our workflow to simplify our security administration but at an affordable cost for the independent medical practice market.” To best serve its customers, Kareo strives to deliver a highly intuitive platform. Miller explained, “We assume our customers do not have an IT background or IT staff on site, so we offer simple-to-use, intuitive software. And therefore any third-party solutions we leverage also have to be hassle-free in every way.” Technical Challenge The company wanted a solution that could encrypt the terabytes of data in its document management system without causing any network downtime or performance issues for file accesses. In order to comply with audit requirements, Kareo also needed an encryption solution that logged details of whenever the Document Management System (DMS) was accessed. With aggressive plans for continued expansion, the encryption solution needed to be capable of integrating and scaling with the company’s anticipated growth. Jesse Salmon, security architect for Kareo stated, “We’ve deployed a fast-moving, adaptable architecture that utilizes hundreds of micro services that all talk to each other; we needed an encryption solution that could keep in step with us.” Solution The Kareo team looked at several possible approaches and invited select vendors to participate in a proof-of-concept (POC). Salmon described the process, “We had each vendor attempt to encrypt 12 terabytes of data. During this process some of the factors we considered were if we could encrypt the data in place, at what speed it would run, the impact it had on the overall system, and the caliber of administrative tools provided to perform activities like changing encryption keys. “Vormetric Transparent Encryption by Thales ended up scoring the highest because of its powerful administrative features, ease-of-integration, and outright performance.” Results Even with terabytes of information being encrypted during the rollout, Kareo’s customers did not experience a moment of downtime. Salmon noted, “Because we could select individual groups of files, we were able to encrypt tens of terabytes of data without interruption. One of the differentiators with Vormetric Transparent Encryption is that you can specify folder identifiers – called guard points – at the system level via the central manager. With other solutions we lost track of which folders were encrypted and their status.” Kareo’s deployment of Vormetric Transparent Encryption was invisible to users. Miller stated, “Customer impact during the transition was another area where other solutions would have given us a lot of pain. With Thales however, encryption took around three months to fully deploy, and we were able to keep our systems operating around the clock. None of our customers were affected, there was no impact on performance of our servers, we didn’t receive a single complaint or service desk ticket, and we haven’t had any since deploying. Our end users aren’t even aware of the improved encryption protecting their files.” Salmon added, “Another benefit with Thales is that we can now audit all accesses of our DMS. We have visibility into which services are accessing which files, with which processes, at what time. This is paramount to ensuring our data is protected.” “To remain nimble, we have implemented an agile microservices architecture,” explained Miller. “Vormetric Transparent Encryption is able to support this easily and with minimum disruption – both in its deployment and in ongoing operations.” Above And Beyond Kareo can assure its customers that uploaded patient data is fully protected. Salmon concluded, “From a HIPAA (Health Insurance Portability and Accountability Act) compliance perspective, encryption may not be explicitly required for these files, but we at Kareo view this as necessary to providing the proper level of security for our customers. Vormetric Transparent Encryption is key to doing this.” Brand and business Protection With Thales Business need Enable independent medical practices to focus on care while protecting patient information Provide scalability to support business growth objectives Technology need Enable DMS access logging Support agile micro-services architecture Encrypt terabytes of data with minimal downtime or system performance degradation Solution Vormetric Transparent Encryption by Thales Results Deployed encryption across entire portfolio with zero service interruptions or disturbances to end users Implemented cost-effective solution that removed encryption from being an impediment to company growth Retained architectural agility while providing industryleading protection About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Molina Healthcare (Molina) provides services for individuals who qualify for government-sponsored health care. Dr. C. David Molina founded the company in 1980 as a provider organization serving low-income families in Southern California. Today, the FORTUNE 500 enterprise operates health plans in 12 states across the nation and in the Commonwealth of Puerto Rico; serving a total of over 4.3 million members. Business Challenge Given the nature of its activities, Molina must adhere to both the Payment Card Industry Data Security Standard (PCI DSS) and Health Insurance Portability and Accountability Act (HIPAA) regulations for the protection of members’ information. Bharani Krish, associate vice president of enterprise infrastructure, explained, “When it comes to security, we always strive to exceed the standards required by the governing regulations and mandates that apply to us. Encryption is a core component of our security architecture but we were always concerned that implementing a sophisticated solution might adversely impact the performance of our infrastructure and subsequently impede our ability to scale as we continued to grow.” Technical Challenge To ensure pervasive protection, Molina wanted to implement a standard operating procedure for encrypting all sensitive data, regardless of file formats and whether the data is in use or at rest. To adequately protect the information, Krish’s team developed precise requirements for encryption – including the need to protect encryption keys – with the aim that even with server access, a threat actor could not retrieve the data in a way that could lead to compromise. The solution also would need to facilitate the separation of roles, to comply with regulations preventing misuse by valid system users who were not authorized for data-level access to specific information. Solution Molina narrowed the field to a shortlist of solutions and conducted proof-of-concept (POC) trials; deploying each option on servers running Microsoft SQL, Cisco UCS, and Oracle SPARC. Applications were benchmarked on each solution/server combination to test for performance degradation. Of particular note was that throughout the evaluation, Krish’s team detected no performance impact with Vormetric Transparent Encryption in the Vormetric Data Security Manager (DSM) solution by Thales. A stark contrast to some of the other candidates. In addition, Krish was impressed by the seamless key management and powerful security enabled by Vormetric Key Management. Molina discovered the other solutions frequently had lengthy deployment processes that typically required an audit of all production-related data to specifically identify high-risk information to encrypt. Krish described, “The Thales solution really was in a class of its own; Vormetric Transparent Encryption is so efficient that we calculated from the POC that we would be able to encrypt all of our production databases in less time than it would have taken the team to manually sift through the data to categorize the sensitive information required by the other solutions just to start!” Krish leveraged Thales Professional Services to encrypt the first database and demonstrate how to optimally implement Transparent Encryption in the Molina environment. He recounted, “The support was excellent; Thales had an engineer standing by every weekend in case the deployment ran into complications.” The team elected to encrypt subsequent databases each weekend; planning for completion of each one by Sunday morning, then spending the rest of the day running extensive tests to identify any potential problems. At the conclusion of the project the team successfully encrypted 650 terabytes of data with zero issues. Results Molina has developed a standard procedure for scaling security as its business expands. Krish outlined, “Our encryption process is now very clearly defined: Whether we acquire a company or expand through organic growth, all of our new production data is encrypted using Vormetric Transparent Encryption.” The company also has prioritized training for all of its employees to elevate awareness and knowledge of securityrelated topics. The roles of the network administrators and users with access to encrypted data are now completely separated; administrators can manipulate and move files but cannot decrypt their contents. Krish noted, “Vormetric Key Management totally locks down the keys: There is no way they can be used in manner that puts data at risk.” Delivering Above-And-Beyond Vormetric Transparent Encryption satisfies all mandates for data-at-rest and active file protection, least privileged access, monitoring, and key management. The solution is optimized for low latency and has overcome Molina’s concern about the possibility of degrading application performance. Users have been unaware of the specific date of each database rollout and no negative feedback has been received about any aspects of the deployment. Krish concluded, “Encrypting all of our production databases perfectly fits with our mission of going above-and-beyond what is required for compliance: Vormetric DSM made that possible.” About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Headquartered in New South Wales, Australia, The Information Management Group (TIMG) was originally formed to provide secure storage of backup tapes using a series of underground vaults. By 2004 – when it was purchased by Freightways – the company had expanded its range of services to embrace physical, digital, and cloud-based assets. With eight facilities in Australia and an additional three in New Zealand, TIMG personalizes its offerings to the individual needs of each client. TIMG’s information security manager commented, “We are an information management company, but are also very people focused. We offer our clients tailored storage solutions that always place an emphasis on security: We take the confidentiality of data extremely seriously.” Business Challenge Sensitive to the security of payment card information (PCI) and personally identifiable information (PII) online – and to comply with regulations such as the PCI Data Security Standards (DSS) – TIMG embarked on an initiative to identify and implement file-level encryption. The IS manager noted, “Clients trust us with their data and our duty is to ensure the proper processes are always in place. We decided that enhancing our security posture by deploying a best-in-class encryption solution would help us to deliver on these expectations.” Technical Challenge With millions of records in its care, TIMG wanted an enterprise-level encryption solution. The manager elaborated, “We looked for an approach that could handle the scope of our operations and scale as we continued to grow. In addition, we wanted it to be easy to implement and manage; able to encompass both files in motion as well as those at rest; and cover log files too. The flexibility to include all data types was another critical decision criterion.” The IS manager also needed a security solution that could prevent a single individual from having full access to any of the data entrusted to TIMG. He stated, “We wanted to eliminate the ‘Edward Snowden’ effect where one person has the keys to everything; we needed administrators to be able to manipulate files but not access the contents.” Solution In its evaluation of encryption solutions, The Information Management Group discovered an unexpected differentiator for Vormetric Data Security Manager (DSM) by Thales; “Thales is the only solution that enabled us to isolate and segment individual domains,” the manager recalled, “and with our diverse clientele this is extremely important. “We ran a proof-of-concept using the Thales solution, with one administrator tasked with encrypting the data and another trying to access it; and the files were always secured perfectly. Users of the test application were completely unaware that file encryption was in place, and when the administrator tried to access the data it was gibberish.” The company also found that the Thales team demonstrated a quicker response to questions than its competitors, as well as having both a technical and commercial awareness that supported TIMG’s goal of coming up with additional innovative services for its customers. Deployment of the solution into the production environment proved to be simple: the IS manager recalled, “The implementation process is very straightforward, even with some of the more sophisticated activities like setting up logging and role management rules.” Results TIMG’s internal audit team verified the environment to be in full compliance with all of the applicable standards. The manager shared, “An independent compliance manager verified everything and Thales helped us pass with flying colors. Encryption is one of the key components that have enabled us to meet and exceed the ISO/IEC 27001 standards, a core mandate for information security management systems.” He continued, “We were able to implement Vormetric Transparent Encryption by Thales without changing any of our existing application code. Now securing additional datasets is as simple as utilizing the same infrastructure and installing an extra Thales agent. “We’ve split the system administrators from the users authorized to access specific data and are leveraging the ability to set up separate domains. This enables us to create better data segregation and eliminated the risk of any one person having access to the entire system.” Only The Best For Timg’s Customers The IS manager concluded, “Cryptography is hard; doing it correctly, efficiently and flexibly is even harder. By leveraging Vormetric DSM – and the millions of dollars of research and countless resources that have gone into developing it – we are protecting our clients’ data with the best-in-class solution. We could not be happier.” Thales opens the door to new possibilities Business need

As one of the world’s best-known airlines, this carrier operates an extensive international and domestic route network. The company is publicly traded and enjoys a market capitalization in excess of $10 billion. Like many enterprise clients, the airline had made widespread use of the RSA Data Protection Manager (DPM) solution for administering encryption and key management across its globally distributed environment. RSA’s 2016 end-of-primarysupport (EOPS) announcement signaled the start of a major initiative to identify and deploy a fitting replacement. Business Challenge The pervasive use of RSA DPM across multiple layers of the air carrier’s IT stack created an urgency and a dawning realization of the magnitude of the challenge. With DPM entrenched in most of the company’s business-critical applications, the risks were high: The original implementation of RSA DPM was notoriously complex and continuing to use the application without factory support was unacceptable. The security team’s directive was to avoid any form of negative operational impact, making it imperative to ensure that all risks were appropriately managed and mitigated. Technical Challenge The airline team considered two primary types of approach to removing the reliance on DPM: One was a“ rip and replace” procedure, where all elements of the RSA solution would be simultaneously swapped with new code modules; the second was a strategy that utilized a more orderly phased approach to the transition, removing the requirement to rewrite and test all of the affected applications. RSA DPM code had been extensively utilized across the airline’ s application portfolio, including its customer - facing ticketing, loyalty and merchandizing functions.Without the necessary inhouse technical knowledge or bandwidth to tackle the project, it became critical to quickly identify a partner that had the track record and the solutions in place to ensure a smooth transition. Solution After exhaustively researching its options the airline elected to partner with Thales eSecurity. The Thales reputation across the airline industry, and the combination of proven solutions, backed by the renowned Thales Advanced Solutions Group, provided a high-level of confidence that a successful outcome could be achieved. The Thales approach utilizes a dedicated translation server to capture existing RSA DPM calls that are collated into an emulation library to facilitate conversion to equivalent API instructions before being routed to a series of dedicated Thales Vormetric Data Security Manager (DSM) appliances. To achieve this, the translation server includes modules to simulate the DPM and interact with a Vormetric Application Encryption engine before passing the translated calls to the new DSM devices. Key preservation is a major consideration for any company considering a DPM replacement. With substantial volumes of encrypted data that had been archived, being able to retrieve any of these records – even a decade into the future – is imperative. The disadvantages of the rip-and-replace approach include the length of time required to design and implement the replacement encryption and key management environment. An inherent drawback is that all data must be migrated and an entirely new set of keys has to be created. A primary differentiator of the Thales phased approach is that keys are migrated, not replaced: This enables the continued use of existing keys to access live, and/or previously archived, encrypted data. Results Intercepting HTTP traffic containing key management calls from RSA client modules enables the full range of the airline’s DPM calls to be translated and the keys rapidly migrated to corresponding Vormetric DSM commands. Because applications and databases think they are still communicating with the RSA DPM there is nominal impact to operations. The airline was fully operational and compliant throughout the entire transition. Completion of the second phase culminates in the utilization of a newly created library of emulated calls and a Vormetric Application Encryption client that completely replaces all RSA DPM components located in individual applications. The Thales Advanced Solutions Group was intimately involved with every step of the project. The consultants’ expertise and experience, combined with their approach and tools, made the whole project feel very straightforward, despite the complexity, and at times highly convoluted nature of what needed to be done. Added Benefits Although the primary focus of the project was the RSA DPM replacement, the availability of new features and capabilities from the Thales solution provided further benefits to the airline. Thales’s Vormetric Data Security Manager is FIPS 140-2 certified and utilizes NIST-approved encryption keys. The Vormetric DSM provides the ability to import keys from any source and facilitates multi-tenancy key management across the airline’s entire infrastructure, including cloud and on-premises domains. The Thales solution delivers world-class security and great performance with almost infinite scalability enabling the capabilities to be further leveraged as new applications are added. With the complex project coming in on-time and within budget, the combination of the Thales Vormetric Data Security Manager and the expertise of the Thales Advanced Solutions Group, proved to be the optimal choice for the airline. About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

London-based Kashing Ltd. offers small merchants a broad range of digital payment services that previously have only been available to mid- and large-scale businesses. Established to empower small independent companies, Kashing’s solutions provide options for online, face-to-face, and mobile payment transactions. With its omnichannel portfolio, Kashing presents a uniform way to accept and manage payments, removing the barriers traditionally found with banks and other finance companies. Business Challenge As a relative newcomer to the massive financial services marketplace, Kashing is heavily focused on establishing a robust foundation for its rapidly expanding business. Gert Horne, chief security officer and Kashing co-founder, observed, “Security is at the very core of our business: Just about everything we do revolves around ensuring the ongoing integrity of the data we hold.” He continued, “Our commitment to protecting sensitive data goes much deeper than just attaining compliance but being certified is certainly tangible, objective proof that we are serious about security.” Kashing’s business objectives for growth dictated the need for an architecture capable of scaling to support expanding transaction volumes, accompanied by requirements for highavailability and elevated throughput capabilities. Technical Challenge To safeguard the integrity of each transaction, Kashing created an architecture that utilizes point-to-point encryption of all sensitive information. The payer, payee and all transaction details remain protected from the original point-of-sale (POS) through to back-end processing. Hein de Kock, a senior developer for Kashing, elaborated, “We needed to identify a solution that could handle encryption of all our data in motion but additionally, in order to provide comprehensive coverage across our entire infrastructure, we also wanted to protect the static data that we hold.” The small, and even micro-sized businesses targeted by Kashing are frequently run by entrepreneurs with minimal technical knowledge. “We’re all about ease-of-use and bringing simplicity to what is already an overly complicated world, so whatever encryption methods we selected must be completely transparent to our users,” noted de Kock. Neil Osborne, digital marketing account executive at Kashing, concurred, “Our approach is that we are ‘Secure by Default’ – we really don’t want our clients to have to become security experts. Our subscribers are like family to us and by identifying best-in-class solutions we’re able to ensure that all personal information is secure.” Solution Kashing selected the Thales payShield 9000 HSM to facilitate transaction encryption and remote key injection into the company’s POS card reader which is used typically by their small merchant customers to accept face-to-face card payments in conjunction with the Kashing app on their smartphone or tablet. “Throughout our evaluation period we were continually impressed by the HSM’s performance and the excellent technical support we received, especially the Thales team’s willingness to work with us to accomplish our goals,” noted Horne. He added, “We were given access to a virtual device that allowed us to accurately simulate the operational scenarios that we were planning and to begin development before having our physical device. This really confirmed that payShield is the right choice for us.” Result Originally focused on encrypting transaction-related traffic, the broad capabilities of the Thales HSM creates an expanded role in the Kashing architecture: “It transpired that payShield is a great fit for encrypting our static data,” observed de Kock. “We’re able to apply all of the benefits of the HSM to our archived records too.” Horne commented, “Thales has been extremely instrumental in Kashing attaining PCI DSS compliance: The ability to perform end-to-end encryption and key management across all inmotion and at-rest data addresses significant components of the standard. In fact, we’re one of only a handful of companies that are a payments company and designated by PCI as a qualified security assessor [QSA].” The Kashing team includes a number of members located outside of its London headquarters, placing emphasis on the ability to remotely manipulate code and perform administration tasks. “We need to have hands-on control of the devices from anywhere, and Thales has done a fantastic job in the hardware design,” stated de Kock. “The flexibility to log into payShield from my laptop at home and make changes to the HSM is just amazing.” Horne summarized, “I’ve had in-depth exposure to payShield – the way it’s designed, the layout, the construction, the way that it operates, and it’s a natural choice for Kashing. From many perspectives – especially any involving integrity, availability, scalability and quality of service – Thales inspires me in the design and creation of our own environment. “I strongly recommend Thales.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Slovakia - based Regional Card Processing Centre, s.r.o. (RPC) is a member of Raiffeisen International A.G., a leading banking group in the central and eastern European region. RPC’s team handles credit and debit card issuing and processing, merchant sign - up, and fraud risk monitoring for the group, earning the company $17M in revenue. RPC’s clients include Tatra Bank as well as Raiffeisen Banks from Albania, Bulgaria, Czech Republic, Croatia, Romania, Serbia and Kosovo. Business Challenge RPC wanted to extend its services portfolio to provide cardholders with the option to perform in-store purchases using a smartphone. Ľudovít Kuruc, RPC’s project manager, described, “We wanted to offer the convenience of smartphone transactions but had to ensure that we had end-to-end security to protect the sensitive data at all times. Additionally, because the market is evolving extremely quickly and is so unpredictable, the greatest challenge was to select a security solution that was flexible, scalable and offered long-term viability.” Technical Challenge The RPC infrastructure is very complex, spanning four countries and involving banks, card processing centers, and provisioning service vendors. “Our primary technical requirements were to provide security, high availability, and interoperability across our diverse environment,” recounted Kuruc. “We became very interested in Host Card Emulation (HCE), an alternative approach to mobile payment security.” HCE is expected to deliver a simplified, lower cost approach for contactless mobile payments and digital secure remote e-commerce payments over the internet, removing much of the technical and business complexity associated with the alternative secure element implementation model. However, HCE introduces new security challenges and risk models that mean banks require security enhancements to their existing card issuing and transaction processing infrastructures. Limited-use credentials are delivered to the phone in advance to enable contactless transactions to take place. Although this method enables banks to maintain control, it has a different profile of security and risk challenges that need to be addressed, resulting in numerous technical approaches that can be taken. RPC moved forward with the development of its digital payment application that enables contactless mobile payments via HCEprepped Android smartphones at point of sale terminals. “Given the criticality of this offering to RPC, my team was focused on finding the optimal HCE security solution in the shortest possible timeframe,” Kuruc recalled. Solution RPC has been utilizing Thales hardware security modules (HSMs) in its main data centers for some years. However, Thales HSMs also can be used to secure HCE-based solutions: payment credentials are securely generated by the issuer and stored centrally using HSMs. As an integral part of the overall risk profile, the card issuers also have the flexibility to decide how many keys are saved on each phone to cover situations where authorization without handset data connectivity is needed. This exactly matched RPC’s requirements. Kuruc observed, “In our evaluation of possible HCE security solutions we found all other vendors were quickly excluded once we learned that the Thales payShield 9000 HSM had the required critical functionality – such as industry-compliant cryptography, key management and transaction processing – already integrated into the module and was already proven in the field with leading mobile payment solution providers. The alternatives would have added unnecessary complexity to an already very complicated project.” He added, “The integration of payShield 9000 was very smooth; the HSM worked exactly as described in the preliminary specifications we received, complying with all of the various payment card scheme specifications we needed to meet.” Thales has been at the forefront of offering HCE support in its HSM software, working closely with the major card schemes since the initial HCE proprietary specifications were first made available to the vendor community in 2014 and therefore RPC was able to quickly benefit from this expertise. The payShield 9000 HSMs already deployed by RPC only needed software license upgrades (which can be performed remotely using the payShield Manager remote management tool) to support HCE. This was more cost effective than having to buy additional HSMs or being forced to migrate to a totally different HSM model. Thales has more than 25 years of experience with payment system security solutions. The payShield 9000 is the most widely implemented payment HSM in the world, used in an estimated 80% of all payment card transactions. Results Despite its sophistication, the solution is extremely easy to use: RPC customers simply install the application from Google Play Store, enroll, and are then completely ready to make purchases. Behind the scenes, the payShield 9000 HSM keeps transactions protected. Kuruc noted, “When we compared the price of another vendor’s device – plus its maintenance fees, hosting, testing and upgrades, implementation of new interfaces, and the extra networking complexity, etc. – it would have added in the order of €50,000-100,000. In comparison, the Thales solution is very compelling and enabled us to standardize on payShield 9000 throughout our infrastructure!” The Perfect Security Solution Kuruc summarized, “payShield9000 has proven to be the perfect match for our digital payment application requirements because it is robust, reliable, rich in functionality, and complies with all the payments regulations, including the independent PCI HSM certification, reinforcing its security pedigree.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

A-Trust is a qualified trusted service provider based in Austria that issues digital certificates for the country’s citizens and economy to use in a variety of electronic transactions. As one of only three authorized providers in Austria, A-Trust provides certificates for individual users, developers and corporations, as well as consulting services for the development of signature-related applications. Business Challenge As of April 2017, a regulation known as RKSV (Registrierkassensicherheitsverordnung, or Cash Registers Security Regulation) went into effect in Austria. The regulation requires that receipts originating from businesses in the retail, hospitality and service sectors be digitally signed and stored using a unique private key assigned to each business owner. Merchants also must provide records of sales transactions that conform to specific technical standards. A-Trust saw an opportunity to support businesses in their efforts to become RKSV compliant by creating cost-effective solutions capable of automatically fulfilling all necessary requirements. To be attractive to its target market, the products had to be fully secure, be simple to use and be offered at consumer-level pricing. Technical Challenge The digital signing requirements of the solutions also subjected it to the European Union’s Electronic Identification and Trust Services (eIDAS) regulation. eIDAS regulates electronic transactions and signatures, with the goal of providing a secure and consistent way for users to conduct business online. Any viable A-Trust solution needed to ensure that end-to-end eIDAS compliance was maintained throughout the entire transaction lifecycle. Solution A-Trust and Thales have a long history of working together in creating solutions for secure digital signatures. The two companies had previously collaborated at the time when A-Trust searched for the optimal back-end solution (HSM) for the mobile phone signature. The so called “Handy-Signature” enables individuals to use a digital signature in place of a conventional handwritten equivalent to complete transactions throughout the European Union. This was an important product as it gave A-Trust a strong eIDAS-compliant solution that they could market across dozens of countries. The collaboration was so successful that the A-Trust technical team again turned to Thales to support them with the optimal hardware solution. A-Trust had previously used Thales nShield Solo hardware security modules (HSMs) as they provided the optimal combination of price, performance and features, and they elected to use this same solution again. The nShield Solo HSM is a hardened, tamper-resistant platform that supports encryption and digital signing along with key generation and protection. Thales has earned the Common Criteria (CC) certification which recognizes nShield HSMs as Secure Signature Creation Devices (SSCDs). This means that nShield Solo provides the digital signatures, time stamps and other transactional data necessary to enable A-Trust to comply with RKSV and the cross-border standards mandated by eIDAS. Benefits Julia Wolkerstorfer, marketing manager at A-Trust, commented, “We’ve used Thales nShield Solo HSMs in several A-Trust solutions and our engineering staff have always found it to be easy to use and highly flexible in each implementation we’ve undertaken.” Thales HSMs are integrated into end-user environments and are also used for the back-end processing in A-Trust’s data center. “The unit cost and performance of nShield HSMs enable us to offer a commodity-priced device that is simple enough for even the most technically-adverse merchant to understand and operate,” commented Wolkerstorfer. “This saves business owners both time and money, and makes our solutions very compelling in the markets we serve.” While the HSM solution was initially sold particularly in Austria, A-Trust is rapidly expanding to a growing number of other European countries. “The Thales HSM can effortlessly scale to handle high volumes. The ease of deployment – coupled with the features and functionality – actively support our ambitious growth objectives,” stated Wolkerstorfer. The growing prominence of A-Trust across Europe has created a huge demand for the company’s products. “For very good reasons, this has been a very intense year for us and Thales has been wonderful in its support and in responding to our requests,” noted Wolkerstorfer. “We view the relationship as a first-rate partnership and one that is critical to helping A-Trust provide the absolute highest levels of security to our customers.” She concluded, “Trust, integrity and security are the foundations of our company, and Thales helps us to achieve those goals.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Cryptocurrencies are coming! Be it Bitcoin, Ethereum or BitConnect, the dramatic increase in digital currencies is just the beginning of a new way of conducting business that will ultimately touch every aspect of our lives. However, the learning curve required to manage and trade the currencies can be steep, even for technically competent individuals. Licensed as a payment institution in the Czech Republic, Saifu was created specifically to make cryptocurrencies as accessible and easily managed as traditional currencies. When opening an account, Saifu’s customers can select from conventional currencies or cryptocurrencies, and they can also associate prepaid cards with their deposited funds. Business Challenge While it’s possible for informed individuals to take responsibility for holding and administering their own cryptocurrencies, there are several significant hurdles that must be overcome. Evgeny Vigovsky, Saifu’s COO and CTO, described, “One approach is for the person to create their own personal wallet, but they then have the burden of securing and protecting the wallet and associated cryptographic keys themselves.” He continued, “Another alternative is for an individual to sign up for an online wallet service where a private key gives access to all their funds. But if they lose the key, they lose all their money. As most people don’t really understand how cryptography and keys work, they don’t want to take this kind of responsibility. Without a better solution, the uptake of cryptocurrencies would stall out.” Vigovsky reflected, “From the very outset, ease-of-use was one of our core design tenets. We wanted to eradicate the assumption that a user must have specialized security, technical or banking skills to be involved with cryptocurrency. Our goal from the very beginning has been that anyone capable of using online consumer banking services or mobile banking apps should be very comfortable using Saifu. We offer accounts to consumers and to companies; there’s a big demand for companies who want to be able to buy, sell and exchange cryptocurrencies with regular currencies.” Technical Challenge In order to shield end users from the inherent complexity of securing cryptocurrency transactions, certain crucial functions – like ensuring end-to-end integrity, confidentiality and accuracy – are performed elsewhere in the process chain. Although not a bank in the conventional sense, Saifu is subjected to the same industry and governmental requirements that apply to its more traditional peers, including all relevant data privacy and personal identifiable information (PII) mandates or regulations. Vigovsky stated, “We are licensed and regulated like any other bank, but handling both fiat and cryptocurrencies dramatically increases the challenges of attaining compliance--any viable security solution had to streamline these processes.” Saifu’s aggressive growth objectives and pan-European expansion plans also elevated scalability, design flexibility and remote configuration and ongoing management to being key selection criteria. Solution To identify a solution capable of fulfilling its architectural requirements Vigovsky consulted with the vendor that installed Saifu’s core banking software and it unequivocally recommended Thales. He recounted, “The partner was so confident in Thales that it didn’t even provide any alternative suggestions!” After performing due diligence, Vigovsky installed the Thales nShield Connect hardware security module (HSM), a solution designed to deliver cryptographic services in an enterprise environment. The nShield Connect provides a robust, tamperresistant platform that performs encryption and digital signing along with key generation and protection. It also can support an extensive range of applications or services such as certificate authorities, code signing and more. The asymmetric and symmetric performance of the nShield series, including one of the industry’s highest elliptic curve cryptography (ECC) transaction rates, supported Vigovsky’s goals for throughput and an enhanced end-user experience. Results “Given its sophistication, I was surprised how easy the nShield HSM is to set up. I was also really impressed by the beauty of the architecture and the way the solution is designed to work. We have absolutely no problems using it across our diverse mix of platforms,” Vigovsky remarked. Thales nShield Connect provides many features that are critical in meeting Saifu’s business and technical requirements, including supporting multiple account types and remote access to the appliance. “We have found Thales nShield HSMs to be far more secure and user friendly than competing solutions. It perfectly meets our needs,” Vigovsky explained. “Thales gives us the ability to bring big bank security to the cryptocurrency world by creating and storing all our customers’ keys in the HSM.” He continued, “Even if the infrastructure is hacked and criminals gain access to our servers, they still can’t do anything malicious. We’ve architected the system so that even if bad things do happen we can guarantee that our customers are well protected by the Thales security technology. Already being FIPS compliant definitely speeds up regulatory audits and other tests we’re required to meet. The combination of remote administration, trusted verification devices and smart cards is just fantastic.” Delivering the Dream Thales nShield Connect enables Saifu to deliver on the promise of its business model. “The Thales HSM empowers us to take ownership of the security and cryptography of accounts, virtually eliminating any worry or risk for our members,” Vigovsky concluded. “Thales has given us a beautiful solution around which we’ve developed our own software, equipping us with the ability to offer our customers a truly compelling value proposition.” About Thales nShield Connect Thales nShield Connect HSMs integrate with Thales Security World architecture. This proven technology enables the combination of different nShield HSM models and builds a unified ecosystem that provides scalability, load balancing and seamless failover. The nShield Connect+ series performance makes it ideal for enterprise, retail, internet of things and other environments where throughput is critical.

How Thales helped a leading bank quickly and securely implement mobile wallet technology to secure cloud-based payments in the banking sector – ahead of its competitors. The Challenge: Deploying the First Live Host card Emulation Solution in the Belarus Market As one of the largest banks in the fast-growing economy of Belarus, MTBank wanted to enhance its leadership position by introducing mobile wallet services before any of its competitors. Offering contactless mobile payments is difficult for banks – the need to support a broad range of phones owned by their customers, that not all phones have secure elements, and developing an in-house solution usually demands complex new skills. Host card emulation (HCE) may help address some of these issues since it helps turn Android smartphones into contactless payment devices, allowing users to make payments at point-ofsale terminals using a smartphone instead of a payment card. Customers benefit from increased flexibility and convenience including the ability to consolidate multiple payment cards into a single mobile device if desired. Issuers typically see benefits in terms of easier provisioning, reduced ongoing maintenance costs and easy scalability – things that often have proved elusive with the secure element alternative. However additional security and risk management techniques are required to deliver such benefits. Security is possibly the most critical hurdle when using HCE technology. The standards set by international payment networks require every HCE solution to implement cryptographic functions using hardware security modules (HSMs) for encryption key storage and management. To succeed in its goal of allowing more than 300,000 bank cardholders to use cloud-based payments – and do this as quickly as possible, before the competition – MTBank needed HCE technology with timetested and proven cryptographic hardware that could integrate into its existing IT infrastructure and a partner who could make it happen fast. The Solution: an in-House HCE Solution With Built-in Tokenization and Authorization Services MTBank chose D8 Corporation, a proven long-term partner that specializes in the development, integration and support of IT solutions for the banking and finance sectors, to implement this project. D8’s HCE Payments platform integrates with Thales payShield 9000 HSM and its cloud-based payments functionality. The Thales HSM enhances the security of the critical tokenization solution – a process that substitutes the actual payment account data with encrypted surrogate values called ‘tokens’ that represent a fully functional digital copy of a payment ‘card account’ in the customer’s phone, without needing to store the actual data (that would be used for a companion chipbased credit or debit card) on the phone. The Thales solution securely stores the tokens and manages the separate set of keys for creating and validating token-based transactions. Thales payShield HSMs ensure that cryptographic keys are stored using a secure and tamper-resistant mechanism for maximum security, while satisfying requirements for obtaining MasterCard Cloud Based Payments (MCBP) certification. Using Thales payShield HSMs enabled MTBank to implement its HCE payment platform quickly, as the solution required no changes to the bank’s existing processing infrastructure. It also ensured maximum security of all token-based transactions and full compliance with the requirements set by international payment networks. MTBank completed the project on schedule and became the first bank in Belarus to implement HCE technology, helping to earn a “Bank of the Year” award and strengthening its reputation as a key innovator in the region. Why Thales? D8 evaluated several HSM manufacturers on behalf of MTBank and choose Thales for three critical reasons: Proven performance. With a very aggressive 90-day schedule for design and implementation, MTBank wanted a solution with an unmatched record of performance, as the bank could not afford any missteps or bugs with its HSM technology Product reputation. MTBank and D8 knew that Thales products had the highest reputation for quality and that payShield 9000 technology was used in roughly 80% of all payment transactions worldwide Exceptional support. D8 knew that the Thales customer support team could provide invaluable and highly responsive support, working quickly to fulfill requests and providing deep expertise in the implementation of HSMs in a wide variety of applications About the Solution Designed specifically for payments applications, payShield 9000 from Thales is a proven hardware security module (HSM) that performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. payShield 9000 is the most widely deployed payment HSM in the world, used in an estimated 80% of all payment card transactions. The payShield 9000 design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The payShield 9000 device is deployed as an external peripheral for mainframes and servers running card issuing, mobile provisioning and payment processing software applications for the electronic payments industry—delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card and mobile transactions. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, UnionPay, and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM v1.0 specification as published by the PCI Security Standards Council. Key Benefits: Achieve comprehensive, certified security with a solution specially designed for card issuing, mobile provisioning and payment processing Secure keys within carefully designed cryptographic boundaries with robust access control mechanisms, so keys are only used for their authorized purpose Ensure key availability with sophisticated management, storage, and redundancy features to guarantee keys are always accessible when needed by the HCE Payments server Prevent reverse engineering of cryptographic keys and algorithms Add additional encryption layer on top of the Token vault to ensure maximum safety of data from the real payment card Maximize business continuity with redundant hardware, field serviceable components, and support for clustering and failover Streamline deployment and maintenance and reduce the cost of compliance with a choice of software options tailored for issuers, processors, and acquirers About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group. About D8 Corporation D8 Corporation is an international company that specializes in the development, integration and support of IT solutions for banking and finance sectors. Their main business focus is the development and integration of payment and loyalty cards processing solutions, mobile payments systems, fraud prevention systems, AML/CTF process automation solutions, as well as associated post-project support and SLA.

Headquartered in Budapest, Hungary, Microsec is the largest Hungarian certificate authority and a Trust Service Provider (TSP) for electronic signatures and eIDAS-certified solutions. Founded in 1984, Microsec delivers a wide array of next-generation public key infrastructure (PKI) solutions and services that include e-Passport, e-ID card security technology, transaction authorization, and mobile PKI. A highly popular solution is Microsec PassBy[ME] Mobile ID, a PKI-based mobile ID system providing future-proof user authentication, transaction signing and mobile electronic signatures – creating a seamless end-to-end digital process for users. The solution is designed to equip smartphone users with a secure mobile identity which can be used for online banking access, ATM cash withdrawals, e-government services such as e-health or tax services, or by cloud service providers for secure remote access. The patented PassBy[ME] Mobile ID leverages eIDAS-compliant certificates to deliver future proof strong customer authentication; legal traceability and non-repudiation; and trusted messaging with signed receipts of messages as proof of delivery. Electronic Identification and Trust Services (eIDAS) is a European regulation designed to create consistency and standards across the European Union (EU) for electronic identities and trust services supporting authentication and signatures. eIDAS ensures that electronic transactions are secure, no matter where they take place. Business Challenge A fundamental design goal of Microsec PassBy[ME] Mobile ID was to establish the very same guarantees that exist in the physical world – such as in a bank branch office – replicated in an online model to facilitate legally-binding transaction authorization and signatures from any type of mobile device. Dr. Sándor Szőke, Microsec’s deputy director of eIDAS Trust Services, explained the major use cases for PassBy[ME] Mobile ID, “For the financial sector our solution facilitates online banking and ecommerce, ATM transactions and point of sale usage. For government entities, it can deliver services for e-health, tax, and a range of amenities for citizens. Government departments can also use the solution to securely access information and sensitive data. It also provides remote access services for cloud environments.” Technical Challenge The primary technology-related requirement for PassBy[ME] Mobile ID was the use of PKI with corresponding keys and eIDAS-compliant certificates. “With the critical nature of the transactions we support, we need to implement state-of-theart technology with the highest security solution components available to protect the private signing keys used in the system. These requirements can only be fulfilled by leveraging certified hardware security modules,” Dr. Szőke described. Solution Microsec has over a decade of experience utilizing hardware security modules (HSMs) from Thales, finding that the devices deliver a hardened environment for secure cryptographic processing, key protection, and key management, while enabling optimal operational efficiency. Dr. Szőke reported, “We selected Thales nShield Solo HSMs to be integrated into Microsec PassBy[ME] Mobile ID to provide comprehensive protection of the PKI private keys. The integration enables customers and service providers to meet EU cross-border standards; generate and manage sensitive cryptographic keys in a certified, tamper-resistant hardware environment; and deliver a source of trust for all derived digital services.” Specifically, Thales nShield Solo is used to secure keys within a carefully designed cryptographic boundary that leverages a robust access control mechanism, ensuring that keys are only utilized for their authorized purpose. The Thales HSM certifies key availability by using sophisticated management, storage, and redundancy features to guarantee they are always accessible when needed. Key information such as service logs and receipts of messages – as proof of delivery – are stored within Thales HSM. Thales nShield HSMs are certified to Common Criteria Evaluation Assurance Level (EAL) 4+ and by way of this certification are recognized as Secure Signature Creation Devices (SSCDs) which earns them eIDAS compliance (Article 51, Transitional Measures). They are also certified to FIPS 140-2 Level 3, the most widely adopted security benchmark for cryptographic solutions in government and commercial enterprises. In addition nShield HSMs support interfacing options with applications using industry standard APIs such as PKCS#11, OpenSSL, JCE, CAPI and CNG. Results “While the current concept specifically targets the European marketplace we believe it is applicable outside of the European Union because of its inherent security features and compliance with global standards,” noted Dr. Szőke. Best Of The Best “Cryptographic private keys handled outside the protected boundary of a certified HSM are significantly more vulnerable to attacks, consequently our selection of Thales nShield Solo gives us peace of mind that we have a best-in-class hardware solution embedded within PassBy[ME] Mobile ID,” summarized Dr. Szőke. EMBEDDING A BEST-IN-CLASS HSM Business need Facilitate legally-binding online transaction authorization and signatures Replicate physical guarantee process inside a protected digital environment Technology need Protect private signing keys used within PassBy[ME] Mobile ID solution Identify method to deliver hardened cryptographic processing Ensure compliance with rigorous industry and governmental standards Solution Thales nShield Solo HSM for the management of sensitive cryptographic keys in a certified, tamperresistant hardware environment Result Delivering a source of trust across broad range of mobile digital services Able to bring secure eIDAS-compliant mobile ID solution to market Compliance with FIPS and Common Criteria standards Full compatibility with industry-standard APIs About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Case Study by the Industrial Internet Consortium Executive Summary The name “Polycom” has long been synonymous with telecommunications and Voice over Internet Protocol (VoIP) equipment from the desktop to the conference room. The ability to distribute these connected devices across geographies offers valuable functionality but also exposes organizations to new security vulnerabilities introduced by rapidly expanding network connections. In order to enhance its VoIP security, Polycom turned to Thales nShield hardware security modules (HSMs) to provide PKI-based IoT device security functionality -- giving their phones a unique identity, making it easier to identify them on customer and service providers’ networks while thwarting would-be counterfeiters and fraudsters. The Challenge While the advances in Voice over Internet Protocol (VoIP) have had many positive impacts and offer many options in terms of communications for far flung business operations, the threats posed to those who utilize these services have grown more sophisticated as well. Like today’s device-level threats in the IoT, those threats start with the phones themselves, where without adequate protection, phones can be counterfeited or spoofed. Traditional means of VoIP identification/authentication like passwords clearly lack adequate strength, and add to setup time for end users and service providers as well. The challenge is to embed something in the device at the time of manufacture that provides the device producer with the right level of security and process control, and provides the eventual end user a trustworthy means by which the device can be verified as authentic prior to use. And, as many IoT device manufacturers must face as the industry grows, scalability to large numbers of devices is a critical consideration. In order to build a secure and scalable system, it was determined that outside help would be required. The Solution Polycom explored several options to improve the security of its VoIP devices, soliciting advice from a number of companies with expertise in the field. Their goal was to find security technology that was already proven to be effective, rather than developing an entirely new system. It was also desired that the company providing the new security system have knowledge about the secure generation of cryptographic keys and creation of a supporting public key infrastructure (PKI) to create and distribute digital certificates as part of the device manufacturing process as a whole. Polycom eventually decided that they would employ Thales eSecurity due to their previous experience with design and implementation of digital certificate systems. As a result, the newly manufactured VoIP devices have distinct advantages over their predecessors. The unique key and associated digital certificate for each device is created within the certified secure confines of a Thales hardware security module (HSM), and protected with encryption until they are placed into the new device. An authorized number of keys and certificates are created in an encrypted “package” at the Polycom North America data center, and transmitted overseas to one of Polycom’s manufacturing facilities. This embedded root of trust provides a customer who eventually purchases the devices with assurance that they are authentic when they bring the device online, thereafter providing secure VoIP services. This type of protection against counterfeiting is a critical security service as new types of devices proliferate in the IoT. Results Polycom and its customers benefit from the integration of unique digital identities into its new VoIP devices, protected by the use of HSMs during the creation and signing of the unique digital identity. Customers are assured that that their devices are highly secure and can be connected with greatly reduced risk of fraud or counterfeit. Polycom has a secured manufacturing process which has scaled across multiple manufacturing facilities, and helps them drive sales of devices to security-conscious customers. About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group. About the Industrial Internet Consortium Thales has been a member of the Industrial Internet Consortium since May, 2017. The Industrial Internet Consortium is a global, member supported organization of over 250 members that promotes the accelerated growth of the Industrial Internet of Things by coordinating ecosystem initiatives to securely connect, control and integrate assets and systems of assets with people, processes and data using common architectures, interoperability and open standards to deliver transformational business and societal outcomes across industries and public infrastructure. Founded by AT&T, Cisco, General Electric, IBM and Intel in March 2014, the Industrial Internet Consortium catalyzes and coordinates the priorities and enabling technologies of the Industrial Internet. Visit www.iiconsortium.org. © 2017 The Industrial Internet Consortium logo is a registered trademark of Object Management Group®. Other logos, products and company names referenced in this document are property of their respective companies.

With a belief that everyone should have the opportunity to participate and thrive in the economy, San Franciscobased Square, Inc. is on a mission to build tools that make commerce easier and more accessible to all. Square was founded in 2009, with offices in the United States, Canada, Japan, Australia, Ireland, and the UK. It offers sellers a broad range of payment acceptance options, complemented by reporting and analytics, next-day settlement, and chargeback protection. The company’s point-of-sale (POS) software and associated business services are designed to help sellers succeed. For example, significant innovation through the use of Square-designed readers for smartphones and tablets enables merchants to accept card payments in a secure manner without the complexity and cost of managing traditional fixed POS devices. The origin of the now substantial global mobile POS (mPOS) card acceptance market can legitimately be traced back to Square. As with all companies, data integrity and the security of transactions are mission-critical factors. However, Square has a rather unique philosophy in the way it approaches its security architecture. Most attackers try to exfiltrate data so that they can work in the seclusion of their own systems. Square’s environment was architected from the very outset to prevent that from happening, incorporating hardware security modules (HSMs) as a required element. Business Challenge The numerous regulatory bodies in Square’s sector dictated the need for the selected HSM to be compliant with a wide range of governmental and payment industry mandates that meet stringent security requirements. Square conforms to multiple standards, including the Payment Card Industry Data Security Standard (PCI DSS). In addition to making reliability a primary objective, the Square team closely focused on the selection of any component in its architecture capable of compromising data integrity, performance or the seller experience. Technical Challenge The uniqueness and value proposition of Square’s offerings have made the company a resounding success and this has influenced the design criteria for the infrastructure. Square opted to handle scalability at the application layer and this created the need to be able to conveniently move keys between HSMs. A key factor for selecting the optimal HSM for the Square implementation was a module’s ability to process vast amounts of data. Square profiled its software to understand how many authentication code operations and how many encryption calls were taking place, and replicated this to test HSM performance. Solution Square’s technical team performed a rigorous evaluation of multiple vendors and selected the Thales nShield Solo HSM because of its compelling performance across the full suite of tests. The Thales solution’s inherent ability to scale – enabled by the seamless sharing of keys across HSMs without user intervention or complex key cloning activities – was another of the many standout features. The success of the Thales nShield Solo HSM in the cryptoanchor role has since paved the way for their use in injecting keys into Square’s readers to authenticate the devices. Every hardware product has its own unique key and the Thales products are a critical part of that process. Results The fundamental value of the HSM-centric crypto-anchor approach has remained sound over an extended period of time. Several years since Square decided to use Thales nShield HSMs, the choice of Thales as a partner continues to hold valid. The requirement to regularly conduct both internal and external audits can frequently be very labor-intensive and time consuming. However, the presence of the FIPS-certified Thales HSM can contribute to streamlining the process. During its DSS audit, for example, Square specifically highlighted that its data is protected by an encryption key, located in the Thales hardware security module. The inclusion adds to the volume of evidence provided to the auditors to demonstrate that any potential issues are being handled in a robust and compliant manner. About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

North York General Hospital (NYGH) is one of Canada’s leading community academic hospitals, offering a wide range of acute, ambulatory and long-term care services across its three facilities. Established in 1968 in the north central region of Toronto, the hospital currently has over 5,000 staff, physicians and volunteers. NYGH is the first acute care hospital in Canada to be presented with the prestigious Davies Award of Excellence, in recognition for its eCare initiative; an innovative hospital-wide information technology transformation project. NYGH joins an elite group of only 50 hospitals in the world to receive the coveted award since its creation in 1994 by the renowned Health Information Management Systems Society (HIMSS). TECHNOLOGY AS AN ENABLER The use of leading-edge technology to advance its excellence in integrated patient-centered care is further demonstrated by a recent initiative to facilitate the secure exchange of information between physicians, healthcare staff and patients. Given the highly sensitive nature of the communications, the project includes a foundational layer that utilizes cryptography – and the secure management of cryptographic keys – to ensure that all interactions remain confidential and completely unintelligible for everyone other than the message sender and legitimate recipient. The initiative focused on bringing medical staff and patients closer together through the deployment of enhanced online communications. In-person consultations would be supplemented with exchanges using PCs and mobile devices; enabling more timely and convenient interactions. The hospital’s traditional way of securing its infrastructure had been through the use of firewalls to create rigid division between internal and external traffic. The need to embrace users located outside of the hospital’s boundaries – as required by the new project – dictated an enhancement of NYGH’s traditional security measures. DESIGNING FOR GROWTH, FLEXIBILITY AND PRIVACY The underlying design principle was that all communications, from any device or location, had to be completely private and secure. It also was imperative that the chosen security strategy didn’t restrict the growth of participants in the program as it gained popularity. In addition to providing robust protection, the architecture had to inherently ensure that there was sufficient flexibility to enable the use of a wide range of devices – including patient-owned mobile phones, medical appliances and ultimately IoT components – without locking the hospital into a narrow security paradigm. As an important part of its due diligence, the hospital researched the best practices of other highly respected healthcare organizations. Having evaluated many different approaches, a decision was taken to implement an encryption-based strategy with a robust root of trust. PARTNERING TO PROTECT NYGH selected IDENTOS, a global provider of encryption services and solutions, and a Thales technology partner, to provide the security platform needed to run the service. The IDENTOS encryption as a service subscription platform is integrated with Thales nShield Connect hardware security modules (HSMs) to protect and manage the cryptographic keys within a hardened device. NYGH utilizes the IDENTOS and Thales solution to ensure data is protected both in motion and at rest. As information is exchanged between clinicians and patients, nShield HSMs maintain a root of trust for the encryption keys used by the IDENTOS solution in a secure hardware environment – as required by industry security best practices. The nShield HSM enhances the security of the software-based solution. nShield is fully compliant with the FIPS 140-2 standard defined by the U.S. National Institute of Standards and Technology (NIST) and the Canadian Security Establishment (CSE). Applicable in both the United States and Canada, FIPS 140 is the most widely adopted security benchmark for cryptographic solutions in government and commercial enterprises. The Thales HSM generates the NIST required Advanced Encryption Standard (AES) keys utilized by the IDENTOS data encryption platform. The IDENTOS solution enables additional features and functionality to be added to the hospital’s environment without requiring changes to the underlying encryption solution, irrespective of the volumes of data being transferred. The automation of many administrative tasks, such as compliance reporting and key back-ups, enabled by the IDENTOS/Thales solution minimizes operational costs and reduces human error. Sumon Acharjee, NYGH’s CIO and driving force behind the project, summarized, “Behind the scenes technology platforms are enabling healthcare providers to achieve significant improvements in patient care, efficiency, and safety delivering care. The IDENTOS and Thales security platform is a key part of our growing mobile strategy, enabling us to offer the convenience demanded by today’s mobile-savvy users and simultaneously further expand our admired culture of patientcentered care.” THALES AND IDENTOS PROVIDE PLATFORM FOR GROWTH Business need Provide secure connectivity for external users Utilize technology to help drive patient-centered culture Implement solution that doesn’t restrict growth and flexibility Technology need End-to-end protection of traffic Identify encryption solution that adheres to multiple compliance standards Utilize hardware-based encryption rather than a software-oriented approach Solution IDENTOS Encryption as a Service integrated with Thales nShield HSMs Result Traffic that is leveraging the platform – including PII and PHI – is always secure Effective application of technology brings staff and patients closer together Foundation created for future growth and feature expansion ABOUT THALES eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Renowned for innovation and out-of-the-box thinking, this North America-based healthcare provider has been in the business for over 50 years. Business Challenge The company has a rich portfolio of services including the provision of image storage technology solutions for institutions that don’t have the in-house ability to store or distribute medical images. A state-of-the-art picture archiving communication system (PACS) offers clients a full suite of capture, archiving, transmission and display capabilities. The comprehensive portfolio of services and wide variety of endpoints also present a broad attack surface for cyber criminals. The company’s chief information officer observed, “There are many sophisticated cyber challengers out there and we want to protect ourselves from being on the ‘wall-of-shame’! We cannot take any risks with the integrity of the data we handle; the reputational and financial impact would be unacceptable.” Technical Challenge Alongside its traditional protection measures the company has deployed a sophisticated set of security solutions, including breach detection technologies and predictive artificial intelligence capable of discovering advanced malware. “The final piece of the puzzle was to identify an encryption solution that could work seamlessly with our existing security solutions, while providing the highest level of protection for patient data at rest in databases, applications, and log files: all at an affordable cost,” recalled the CIO. To be considered a viable contender, any potential encryption solution had to be capable of operating without disrupting the patient management system or PACS-related applications, while simultaneously meeting all HIPAA and protected health information (PHI) regulatory standards. Solution The team initially explored the possibility of an application vendor-provided encryption solution but at the time the PACS and patient management system providers did not offer it. “We created a prioritized list of alternatives, and when we received approval to make the investment we conducted a trial of Vormetric Transparent Encryption from Thales,” commented the CIO. To fully evaluate the solution, test databases were created using structured patient information. The Vormetric Data Security Manager (DSM) agent was installed in monitor mode and the permissions required by PACS application users were set up (part of Vormetric Transparent Encryption, the DSM is used to manage policies and implementation). The tests evaluated encryption/decryption speed, the effect of encryption on the applications being protected, and the level of interoperability with the company’s existing security components. Impact on HIPAA and PHI governmental compliance levels were also reviewed. The trial yielded a very positive outcome. “We were really pleased with the way the Thales solution worked with our PACS application,” reported the CIO. “The DSM is designed so that encryption is almost transparent to the application. We found we could encrypt and decrypt data on the fly without disruption.” Results Following successful completion of the trials, a formal decision to deploy the Thales solution was made. The team took a very structured approach to the order in which operational files would be encrypted. “The granularity of encryption made the whole process easy; we could choose a database or a specific group of files to encrypt at each step. This enabled us to immediately secure critical data without having to encrypt everything at once,” said the IT executive. He added, “This allowed us to avoid the BitLocker/ full-disc-encryption – all or nothing – scenario and definitely reduced the resource overhead. All at a price point that was within our budget.” The company currently encrypts several terabytes of structured data. The ability of Vormetric Transparent Encryption to scale volumes of data into petabyte levels ensures ongoing investment protection and provides the flexibility to adapt to evolving business requirements. Ease of use and intuitive administration also are core components of the Thales solution. “I’ve challenged my team to look for technology solutions that do the heavy lifting for us; Vormetric Transparent Encryption provides an easy interface that even a CIO can understand,” said the CIO. He concluded, “Thales has enabled us to further elevate the levels of security and integrity that we have across all of our clients’ data. The Thales solution takes care of itself: once the data is encrypted and you turn on ‘policy enforcement’, Thales just does its thing.” Peace oF Mind With Vormetric Transparent Encryption from Thales in place, the CIO and his team have confidence that their clients’ data and trust are fully protected. The chief information officer summarized the sentiment of his CEO: “Thales is like an insurance policy – we’ll do our very best to ensure that a breach never occurs – but just in case something did happen, we’re glad we have it!” Keeping Personal Data Personal Business need Affordable encryption to secure patient health information from threats that could cause reputational and financial harm Technology need A transparent encryption solution that would not disrupt performance of the PACS and patient management system applications Support for terabytes of structured data Interoperability with existing anti-malware and breach detection security solutions HIPAA and PHI standards compliance Solution

Korea-based, Beyond Platform is an internet-based financial services technology company offering an innovative platform for peer-to-peer (P2P) lending. Beyond Platform entered into a memorandum of understanding with NongHyup Bank (NH Bank) an agricultural and retail bank in South Korea, to develop a mid-level interest loan product: the 30CUT-NH Loan. The company jointly developed a credit evaluation model with NH Bank by analyzing the data of five million users of credit evaluation agencies and credit card loans, accumulated over three years. Beyond Platform was recognized for its technological capabilities on the project and obtained a venture company certification from the Technology Guaranteed Fund. It also signed a collaboration agreement with the Smart FinTech Research Center at Sogang University for the joint development of an unstructured credit evaluation model using big data. Through this project, Beyond Platform plans to combine a big data analysis engine with machine learning technology to develop a self-learning credit evaluation model. The analysis engine will be able to upgrade itself and identify correlations between diverse pieces of information. Business Challenge Beyond Platform had to implement a data security strategy that placed the solution in compliance with the Personal Information Protection Act in South Korea as well as being able to pass the stringent NH Bank security review. A key component of the strategy was a solution that could effectively encrypt unstructured personal data contained in both image and sound files. The data included scanned borrower’s income verification documents and audio recordings of consent being provided verbally. With the upcoming service launch, fast and reliable implementation of the encryption solution was a major concern. Unlike other similar P2P companies, Beyond Platform needed to implement a security level commensurate with the requirements of a commercial bank, as opposed to the lesser standards for a lending company. This was critical for Beyond Platform in order to bolster its competitiveness and differentiate itself from other rapidly growing financial services technology companies. Technical Challenge Beyond Platform initially decided to develop and implement an encryption solution for structured and unstructured data in accordance with NH Bank’s security policies. However, having insufficient staffing to carry out the development task, the company began researching outside alternatives that could be deployed and managed with minimal resources. In addition, the solution had to be capable of being implemented without having to make changes to existing applications or to the database schema. Solution After reviewing a series of encryption solutions from foreign and domestic vendors, Beyond Platform decided to implement Vormetric Transparent Encryption from Thales. The company was impressed by the many positive references for the solution both in Korea and internationally. The Thales solution encrypts all file types, including logs, images, and database information, eliminating the need to purchase separate encryption solutions for the database and for unstructured data. The solution also delivers privileged user access control that prevents other administrators from accessing the files. Of the options Beyond Platform researched, Thales best suited the company’s needs. As a startup with a limited data security staffing, the solution is ideal because it is easy to maintain and has nominal performance impact after deployment. Beyond Platform’s decision also was influenced by the fact that the full implementation of the encryption technology could be achieved without making any changes to the existing systems, with an implementation time significantly shorter than that of other vendors. The fact that the solution has Common Criteria security certification gave the firm confidence in choosing the Thales solution. Results Using Vormetric Transparent Encryption from Thales, Beyond Platform is now efficiently encrypting and managing structured and unstructured data in its enterprise application, and achieving the security level of a commercial bank. Thales encryption facilitates full compliance with the Personal Information Protection Act. The P2P application easily passed the NH Bank security audit, enabling Beyond Platform to begin developing and launching additional P2P services, in turn, further reinforcing its reputation as a creative and trustworthy financial services technology provider. As Vormetric Transparent Encryption from Thales supports the same level of encryption for unstructured and structured data, Beyond Platform has flexibility to scale the protection to include other data formats. The company plans to expand the use of the solution as it adds more servers. Now Beyond Platform can realize its vision of becoming a next generation P2P service provider without having to worry about data security. Having conducted the encryption of all target data, the promise of needing a shorter time for implementation was confirmed, as well as avoiding the need to modify applications. System performance is not impacted after encryption, creating a secure environment with no adjustments imposed on application users. Consequently, the company was able to eliminate additional maintenance and labor costs related to implementing a new solution, drastically reducing the total cost of ownership. Beyond Platform chose Roltech as a partner for the implementation of the database encryption solution. Roltech is a data encryption and network security solution provider that offers consulting, implementation, outsourcing, and maintenance service for enterprise data protection and personal data compliance. BEYOND PLATFORM CREATES A SECURE ENVIRONMENT FOR BUSINESS INFORMATION WITH THALES DATA SECURITY Business challenge Comply with the Personal Information Protection Act and implement an encryption solution that meets the personal data security level required by the banking sector Implement a reliable encryption solution in time for service launch Technical challenge Encrypt both structured and unstructured data so that separate development efforts are not required Reduce time and technology adoption costs by implementing encryption technology without having to make changes to the existing database schema Minimize maintenance and performance impact so that no additional staffing is required Solution Vormetric Transparent Encryption from Thales Results Reinforced the brand value and partnerships by safely protecting customer information in all formats Achieved simple, fast and reliable system operation and management without making changes to existing applications and systems, avoiding additional investment costs About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

How an innovative start-up leveraged Thales payment security expertise to bring mobile card acceptance to the Middle East region for the first time The challenge: increasing card acceptance in countries where cash is king The United Arab Emirates (UAE) is a highly developed market in terms of IT infrastructure as well as internet and smartphone penetration and yet, surprisingly, has a relatively low penetration level of card payments. The card acceptance network only caters to established businesses and there is a huge potential to penetrate the previously untapped SME market as well as the home delivery sector. With Dubai hosting Expo 2020 (the next World Fair), the UAE government is driving an initiative towards a cashless society with the adoption of innovative and more flexible card-based payment methods. The scheme is endorsed by the major card brands active in the region, namely American Express, MasterCard and Visa, and is planned to cover all types of contact and contactless cards. Swiftch, a nimble start-up company, saw an opportunity to be a part of this cashless society by providing innovative, simple and secure card-based acceptance solutions to all levels of merchants and acquirers. The biggest challenge was to choose an industry leading partner who would be able to assist in delivering a flexible, secure and scalable hardware infrastructure, compliant with the stringent Payment Card Industry Data Security Standard (PCI DSS) security requirements. The Solution: A Secure And Flexible Mobile Payment Gateway Solution Secured By Thales HSMs Swiftch knew that mobile connectivity would play a major role in their offering – traditional fixed point-of-sale (POS) terminals would not be suitable to address the large market opportunity to take card payments on the move, especially in places like restaurants, street markets or when making home deliveries. This led to the choice of mobile card readers linked to standard smartphones or tablets running an application that Swiftch designed and now maintains. Merchants of all sizes, especially small merchants (accepting card payments for the first time and who are difficult for large bank acquirers to reach) could now be approached directly by the Swiftch sales team in the field, facilitating secure, low cost and efficient on boarding. Thales HSMs enabled Swiftch to fast track their payment gateway solution, leveraging existing proven HSM hardware that supports the end-to-end encryption of payment data and enables a secure payment processing interface to the various bank switches through which Swiftch routes their transactions. Aditya Anand, Chief Executive Officer at Swiftch says: “Taking card payments on the move, especially in places like street markets, restaurants or when making home deliveries has always been a challenge. Our mPOS solution enables affordable on-the-go payments for merchants of any size or where home delivery drivers require payment on delivery. Hardware solutions are pivotal in making security viable in mobile environments and Thales was an obvious for choice for us, offering a best in class solution with wider support and recognition in the payments market than any other provider.” About The Solution Thales payShield 9000: proven, scalable payment system security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM design benefits from more than 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

NucleusHealth is advancing patient care through innovation in cloud-based medical image management, allowing global access to medical images by physicians, patients, and health systems, as well as healthcare companies requiring images for their products and services. NucleusHealth deploys a scalable cloud platform for medical images that is web-based. At the core of the platform is patented streaming technology, providing diagnostic workstation performance in a browser on any web-enabled device. The technology significantly improves clinical collaboration through fast access to images, reduces IT overhead, is optimized for machine learning and provides flexibility and customization through numerous RESTful APIs. The company’s state-of-the-art technologies overcome traditional obstacles and distribute diagnostic quality images at unprecedented speeds. The ability to deliver faster, accurate patient care means enhanced patient outcomes at a lower cost: A compelling achievement. Business Challenge NucleusHealth relies on the speed, agility, and scalability of its cloud-based automated infrastructure to manage the onslaught of data from a diverse array of global medical imaging environments. When the company sought an encryption solution there was a mission-critical objective to identify a fully automated, enterprise-grade solution that could accommodate the enormous amounts of information. Grant Cermak, chief information and security officer at NucleusHealth recalled, “Securely managing huge volumes of patient data is a business imperative for NucleusHealth, and to achieve this goal the entire process has to be scalable and automated. On top of this, everything we do must be capable of being remotely deployed and managed.” Technical Challenge To establish the company’s compliance with HIPAA for the storage of PHI, NucleusHealth needed to identify an industrial grade encryption solution capable of keeping costs under control and validated for FIPS 140-2 Level 2 and 3. Cermak elaborated, “HIPAA compliance is a great starting point but we strive to go further. We offer customers the choice of a multi-tenant environment or complete data segregation, and in each case, we have to ensure that only authorized personnel can access patient data.” To accomplish this, it was determined that enterprise-grade key management and role-based access controls (RBAC) would be required to protect information, even from an insider threat with root level access. Solution NucleusHealth makes extensive use of MongoDB: a big data repository deployed by many of the world’s best known companies. Because of the existing relationship and familiarity with MongoDB, Cermak and his team decided to evaluate two different encryption approaches: MongoDB’s own professional database version that includes built-in encryption, versus Vormetric Transparent Encryption from Thales that offers highly scalable encryption and key management using the Vormetric Data Security Manager (DSM) from Thales. Each solution went through a double proof-of-concept (POC) evaluation; one testing range and facility on a full dataset within MongoDB, and a second gauging the ability to provide support automation. The first POC had a set of essential success criteria; transparent encryption of data, fast encryption/decryption, audit traceability, and support for cloud-based platforms – such as Microsoft Azure – to ensure the safety of data in the cloud. This POC also examined key management protocols, which entailed a detailed review of key storage security and access procedures; with particular attention to physical separation of key vaults as required for governmental compliance regulations. Tests were included to determine the degree of protection from unauthorized root access. Price performance also factored in as a strong consideration. The second POC assessed each encryption solution’s automation capabilities, specifically the level to which deployment, reporting, policy-setting, and regulatory compliance auditing could be automated in support of NucleusHealth’s sophisticated deployment strategy. Results “Vormetric Transparent Encryption was the fit we were looking for and we quickly embarked on a full rollout,” remarked Cermak. “The Thales solution met all of our evaluation criteria at a price that was affordable, and offers the automated reporting, policy setting and auditing that was vital to our strategy. Because we leveraged Vormetric Transparent Encryption, we were able to utilize the much cheaper, free, open source release of MongoDB.” Thales provides a complete separation of administrative roles. With role-based access control, only authorized users and processes can view patient data, affording a fundamental level of security that ensures the privacy of sensitive patient data. Vormetric Transparent Encryption provides granular oversight of user access patterns – who accessed which files, with which processes, and at what time – so that any departure from policy can easily be traced. “Thales takes us to the next level,” stated Cermak. “Even someone with root access to a server machine can’t view unauthorized data or adjust policies.” Thales supports scalability to the petabyte level required in medical imaging environments. Without this scale-out capability, NucleusHealth could not adequately support the continuously growing volume of data being assimilated. STREAMING SECURELY In an industry where patient data integrity is paramount and regulated, NucleusHealth ensures that customer data is fully protected from any breach -- inside or out. Cermak concluded, “With Thales solutions deployed no one has the opportunity to do the wrong thing. It’s not just encryption that’s enabled, it’s security policy”. Encryption and protection with thales Business Need Protect patient data from zero day exploits, internal and external intrusions, and unauthorized access Provide support for client multi-tenancy and data segregation requirements in public cloud environments Technology Need An automated encryption solution with secure key management to meet HIPAA compliance and the company’s strict access control requirements Provide scalability to support cloud-based platforms and protect petabytes of data without impacting Service Level Agreements (SLA) Solution Vormetric Transparent Encryption from Thales Result Implemented cost-effective encryption solution with enterprise-grade key management that scales to keep petabytes of patient data secure from unauthorized access Enabled a sophisticated cloud-based dev-ops environment with automated reporting, policy-setting, and audit traceability About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Long known for being a pioneer in medical devices, today BD (Becton, Dickinson and Company) manufactures and sells a wide range of medical devices, instrument systems and reagents. Founded in 1897 and headquartered in Franklin Lakes, New Jersey, it employs associates in more than 50 countries worldwide and is divided into segments: BD Medical and BD Life Sciences. Three years ago, to enable quicker decision making and improve the agility of its business in a highly competitive marketplace, BD consolidated its operations onto a US-based single global instance of SAP with an Oracle database. The company transferred and consolidated data from multiple countries that required strict adherence to many regulations covering data control and security. Business Challenge Damian McDonald, vice president of Global Information Security for BD recalled, “The security solution had to be transparent, meet our encryption requirements, and also support advanced logging and monitoring. Because this was a global consolidation, we also had to fulfill all of the data privacy and security requirements for each region in which we do business.” Technical Challenge Controlling access to data was a critical component of the consolidated environment. “We’re always very concerned about the possibility of intellectual property theft. And because we outsource some of our support, we knew we needed the flexibility to give approved third-party providers operating system- and file subsystem-level privileges, but simultaneously restrict access to the core data,” stated McDonald. Solution Vormetric Data Security Manager was selected because it works at the operating system level and is transparent to the application, which was critical to McDonald and staff because SAP does not support any changes to the database. “Our requirements for file level access control, simple key management, as well as being able to encrypt backup tapes made Vormetric the perfect fit for our needs,” he reflected. “Vormetric is our standard. Whenever an encryption solution is needed, the answer is always, ‘let’s start with Vormetric.’” He continued, “A problem that we all face in the security world is the ‘urban sprawl’ of technology. Where possible, we strive to standardize and streamline controls to reduce our management overhead. Vormetric has enabled us to do that because we can use it across all of our environments including our service provider infrastructure for cloud services.” Results Today, BD’s single global instance of SAP is composed of more than 30 individual SAP modules running on premise as well as in the cloud on Microsoft Azure. “We’ve expanded the use of Vormetric Data Security Manager to address a critical need in cloud security by leveraging Vormetric Key Management to maintain custody of keys, as well as managing the data,” explained McDonald. “We’ve had a lot of help from Vormetric’s consultants with architecture and execution; now our IT teams have all the access and flexibility they need but not down to the data level. “Vormetric has been there whenever we’ve needed help: The support is excellent. It’s a true partnership; we have very close engagement with senior leaders in Vormetric and we witness their desire to see us succeed.” Encryption Is No Longer a ‘Nice To Have’ McDonald observed, “Encryption is a fundamental requirement in the evolving threat scape. The new reality is that it’s virtually impossible to keep all threats out. Vormetric Encryption and other technologies like security analytics are essential elements of a properly engineered, multi-layered, defensive strategy: If a hacker eventually does succeed in getting through to the data they will also have to break the encryption in order to access the contents.” To ensure business operations remain unimpeded, the company’s IT and security organization attaches great importance to the user experience. “The challenge with typical information security groups is that when they get involved, from a user perspective, it normally equates to whole new levels of restrictions and delays,” noted McDonald. “We’re very focused on ensuring that security is as transparent as possible to minimize the impact on each user’s experience. Vormetric Transparent Encryption enables us to apply security in a way that is invisible to the end user; in fact, it’s pretty much transparent from an administrative viewpoint too.” He concluded, “Vormetric is a primary control against insider threats. The situation of someone hacking into the data is less of a worry because Vormetric’s preventative controls make a world of difference.” About Vormetric Vormetric (@Vormetric) is the industry leader in data security solutions that span physical, virtual and cloud environments. Data is the new currency and Vormetric helps over 1,600 customers, including 17 of the Fortune 30 and many of the world’s most security conscious government organizations, to meet compliance requirements and protect what matters—their sensitive data—from both internal and external threats. The company’s scalable Vormetric Data Security Platform protects any file, any database and any application—anywhere it resides—with a high performance, market-leading data security platform that incorporates application transparent encryption, privileged user access controls, automation and security intelligence. For more information, please visit: www.thalesesecurity.com.

Teleperformance is a globally recognized outsourced CRM services, contact center solutions, debt collection and social media company. With revenues approaching $3 billion, the Paris-headquartered group’s 135,000 employees operate over 260 contact centers spread across 49 countries. BUSINESS CHALLENGE The large number of diverse applications and associated data – including call recording systems and CRM packages from multiple vendors, as well as Oracle and Microsoft SQL Server repositories – created significant obstacles in many areas, including data integrity and security. Christian Muus, director of security for Teleperformance EMEA, commented, “We considered using the native encryption capabilities included in each of our applications but quickly saw that this would be unreasonably expensive and too complicated to manage given the number of different servers and applications. The result would have been added complexity and administration overhead requiring us to hire new people with the appropriate expertise, or greatly extend the training for our existing application teams to create internal experts in each area.” TECHNICAL CHALLENGE “The need for robust encryption was being driven by our clients and also regulatory standards like HIPAA-HITECH, PCI DSS, ISO 27001 as well as European Union and country specific data protection requirements,” recalled Muus. “Sensitive end-user data, such as but not limited to credit card details and personal identifiable information, are collected in so many of our applications that we made a decision to encrypt all of our clients’ applications and databases.” The scale and pace of Teleperformance’s operations dictated the need for an easy-to-manage, agile encryption and key management solution. Teleperformance originally used the native encryption capabilities available from its Microsoft SQL Server and Oracle Enterprise environments but the overhead associated with implementations – including data structure considerations, defining key and certificate management strategies, setting administrative rights, etc. – was becoming unacceptable. Every new instance required additional design and operational discussions. SOLUTION Following a detailed analysis of viable options, Muus and his team made the decision to implement Encryption and Key Management solutions from Vormetric, purchased though Vormetric channel partner SHI International Corporation. He stated, “We were excited when we found the Vormetric solution; it gives us a consistent view of all encryption across the company, and allows us to encrypt information without having to be concerned about the application associated with the data or change business processes. “We are continually rolling out new servers and applications, so ease of deployment is very important. It turned out that implementing Vormetric was simple, and since the solution is transparent to applications, installation was easy and straightforward.” RESULTS Cost justification for the investment in Vormetric proved to be equally clear-cut. Muus reflected,” We did a cost comparison for just one system – a call recording package – and found that if we had purchased the application-specific encryption add-on from the vendor, it would have been more expensive than buying Vormetric for our whole environment. So, not only did we save money by buying Vormetric to protect that single application, we can use it to protect everything else too! “We’ve also saved money and increased reliability by reducing the overall complexity of encryption and key management, and by being able to administer the whole environment centrally. The interface is so intuitive that it is extremely easy to quickly become proficient.” Teleperformance takes great pride in ensuring that its infrastructure exceeds stringent regulatory and information security management system requirements. The Vormetric solution provides the company with a critical capability to secure and protect its massive amount of diverse data. Muus stated, “Our external regulatory auditors are big fans of Vormetric; they always are impressed with the comprehensive access control-based separation of duties that Vormetric provides. Across the whole company we only have three people with access to our encryption keys; even application administrators cannot access the application’s data despite having administrative rights for the whole server. And furthermore, the three people that are sanctioned to access our encryption keys don’t have access to the systems or applications. This is exactly the separation of duties required by standards like PCI DSS.” Encryption technologies have traditionally imposed a discernible load on system performance. Muus initially shared this concern but when asked to quantify the impact of implementing Vormetric his succinct reply was, “None!” He elaborated, “From a performance perspective, our users are completely unaware that encryption is taking place. This was our biggest concern, and in the end, it turned out to not even be an issue.” Teleperformance’s IT environment is structured to provide each country with unified central services as well as country-specific decentralized local services. “The Vormetric solution is flexible enough to allow us to have one centrally managed Vormetric system and still meet each country’s specific requirement for protecting applications and data. Vormetric enables encryption to run smoothly,” explained Muus. “The Vormetric solution is so impressive that in addition to client and customer data we now use it to encrypt our own critical internal data.” He concluded, “Vormetric gives us the performance, scalability and flexibility we need to stay ahead of our competition.”

Headquartered in Houston, Texas, BMC Software is a global leader in enterprise IT management software and services. The company delivers innovative IT management solutions that enable customers to fully leverage complex technologies, ranging from cloud to mainframe to mobile. BMC serves one hundred percent of the Forbes Global 100 and 82 percent of Fortune 500 companies. Offerings include IT service management (ITSM), data center automation, performance management, virtualization lifecycle and cloud computing management. Business Challenge Across the globe, the IT industry is becoming acutely more sensitized to cyber-based threats and the commensurate need for heightened security precautions. Audley Dean, senior director of Information Security at BMC, commented, “Our customers are deeply interested in how we handle their data. They want to know what measures we take to protect the assets they entrust to us. Many of our clients also must align to federal and industry regulations concerning how sensitive information is safeguarded.” Technical Challenge The BMC team looked at a variety of options to cover encryption of the company’s mixed Oracle and Microsoft SQL environment. Joel Bruesch, BMC’s senior manager of Information Security, recalled, “We are very aware of the risks associated with advanced persistent threats [APTs] and felt that we needed an approach that gave us granular control of protecting our information. At BMC, everything we do is grounded in best-in-class solutions and processes. It was imperative to choose an encryption and key management strategy that could stand up to the demands of the marketplace and our own expectations.” Solution One of the options considered by BMC was the use of database-level encryption. “Deploying security at the repository level turned out to be very cost prohibitive to implement and manage,” stated Bruesch. “We did extensive research and ultimately decided on Vormetric Encryption and Vormetric Key Management: The way the Thales eSecurity solutions are structured gives us the protection we need and enables us to automatically address the majority of standards-driven controls with no manual intervention.” The Thales eSecurity solutions provide encryption and management of both structured and unstructured data across BMC’s distributed environment. Encryption includes data access controls, integrated key management and data access reporting. If needed, keys can be managed and securely stored for use with Transparent Data Encryption (TDE) for both Oracle and Microsoft SQL Server databases. Results “Some of our customers are now coming onsite to perform audits or assessments of our security measures. The Thales eSecurity solution provides us with file auditing capabilities that comprehensively address any possible concerns,” noted Bruesch. “We’re also leveraging Thales eSecurity to negate a lot of the complexities in the implementation of controls for industry standards, such as simplified quarterly key rotation. “The Thales eSecurity solution has been extremely easy to implement; it only took about a day to get our infrastructure configured and running. From a performance perspective, our users really aren’t aware that encryption is taking place at all, which is great.” Peace of Mind Dean concluded, “The decision to implement Thales eSecurity was one that everybody was very comfortable with. Our clients actively acknowledge that the solutions’ capabilities significantly minimize risk and are definitely key elements of our infrastructure.”

Founded in 1988, Cadence Design Systems is one of the most recognizable names in the electronic design automation (EDA) industry. The Nasdaq-listed company provides software, hardware, IP and services that are used prolifically throughout the $300 billion global semiconductor marketplace. The San Jose, California-based company has 4,700 employees and in 2010 generated revenues of $936 million. Business Challenge “Everything we do involves a lot of data sharing,” explained David Vargas, Cadence Information Security Architect. “We get very specific details about planned new products, as well as problems clients need solved. Much of the information is so sensitive that the repercussions of inadvertently allowing unsanctioned access could be catastrophic. The need for tight security is obviously a very critical part of our business.” Technical Challenge “Our customers need to know when they entrust us with their data, it is completely secure,” Vargas Elaborated. “They want assurances that it has been encrypted and that nothing inappropriate has occurred. It is not uncommon to be asked to provide log files documenting which users have accessed specific files and what actions they took.” Solution To address varied client requirements, Cadence offers project environments with tiered categories of security. Vargas recalled, “When originally creating the different project security profiles we looked for best-in-class security products. We quickly determined that the integrated encryption, access control and key management components of the Vormetric Data Security solution would provide exactly what we needed. “Our clients know the excellent reputation of Vormetric solutions and most are aware that the products are heavily used by the government: This provides instant credibility, and confidence in how we ensure the ongoing integrity of all project-related data.” Cadence performs a large number of customer engagements and all are typically very diverse. “Vormetric gives us the flexibility and granularity we need to quickly generate the appropriate security characteristics for any given project. We can set up multiple clients and efficiently provide each one the desired levels of protection, including logging, access rights and encryption,” noted Vargas. Results Extensive use is made of a load-balanced server farm to place resources in a cloud configuration. “We create what are essentially private clouds in our environment and then use Vormetric to provide the ongoing security. This approach enables a dramatic reduction in the number of machines required to handle the workload, and the flexibility of the Vormetric solution directly supports this without compromising security,” stated Vargas. “The Vormetric management console allows remote deployment of access controls and facilitates precise customization of individual data security policies.” The cadence environment is predominantly VMware, utilizing Red Hat Enterprise Linux, and a smaller number of Citrix, Solaris and SUSE Linus components. Vargas commented, “Our business is extremely dynamic and Vormetric handles reconfiguration of clusters with zero impact to ongoing projects. Security policies are enforced throughout our global network. We’ve had up to 400 discrete virtual environments simultaneously protected, and the encryption process overhead is so low that it is completely unnoticeable. I’m very happy with the performance of all of our Vormetric components.” Vormetric Data Security’s integrated key management is used to centrally manage the distribution, backup and recovery of encryption keys, as well asto provide capabilities to conduct a centralized audit of related security operations. Vargas stated, “This application is really excellent: I have not yet found an equal in the industry.” “Trust is hugely important to the way we do business, and showing clients the Vormetric implementation immediately creates a sense of confidence,” concluded Vargas. Vormetric Data Security The Vormetric Data Security product family provides a single, manageable and scalable solution to manage any key and encrypt any file, any database, any application, anywhere it resides- without sacrificing application performance and avoiding key management complexity.

Delta Dental of Missouri – a member of the nation’s leading dental benefits organization, Delta Dental Plans Association – offers dental and vision benefits in the states of Missouri and South Carolina. It is the carrier of choice for over 2,000 companies and has more than 1.5 million members. The company places a strong focus on prevention and evidence-based oral health quality measures, which has earned it the participation of 96 percent of all practicing dentists in Missouri. Business Challenge Delta Dental of Missouri stores many terabytes of information in its claims system – member demographics and eligibility, claims, provider information, contracts, payment information, notices of benefits, statements, etc. – approaching “big data” classification. Bound by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) standards for electronic health care transactions, all data must be encrypted both while in transit and at rest. Karl Mudra, Delta Dental of Missouri’s CIO, stated, “One of our corporate values is to be good stewards of the data we care for on behalf of patients, providers and the groups we serve. In our view, it was a sound practice – irrespective of the HIPAA mandates – to find a best-in-class security solution. With data encryption, I believe it’s essential to be prepared ahead of time, instead of trying to react after there’s been a data breach.” Technical Challenge Database-level encryption proved challenging: “When we first started looking, not all of the alternatives to encrypt our SQL data were viable,” recalled Mudra. “Because of our database version, many of the products necessitated rewriting our whole application, changing user-level processes and procedures, creating new reporting routines, and making modifications to our production and back-up environments.” Mudra had additional criteria for any viable encryption technology. He noted, “We wanted a policy-based encryption solution, so we could grant permissions at both the user and/or application levels according to pre-defined rules, similar to how most firewall products are configured. We also needed comprehensive key management, centralized administration, and the ability to leverage the solution across both the production and disaster recovery environments. Finally, the option we selected had to be invisible to our users, with zero impact on productivity.” Solution After rejecting multiple vendors, Mudra’s team brought in Thales eSecurity to demonstrate the Vormetric Data Security Platform. “We were very impressed,” he recalled. “The Vormetric Platform gave us the policy-based approach we needed, and it didn’t matter if we were running Microsoft Windows® or Linux, handling files or folders, storing data in a SQL database or dealing with a storage area network. The data-centric approach took care of all our issues and didn’t require users to do anything different, which was a huge positive for us.” Delta Dental of Missouri has a lean IT infrastructure team, and one of Mudra’s concerns was the burden of an overly demanding installation process. The staff spent about half a day doing pre-installation planning and opted to deploy file-level encryption. A Thales eSecurity consultant was engaged for two days to train the team onsite, while completing encryption of the development environment. Installation was staged over three weekends, and the team was able to handle the last two installations without assistance. Mudra observed, “You define everything and set it up, and it does what you need without any headache. As always, we planned for the worst, but this time got the best. It was one of the easiest implementations from decision to production that I’ve experienced. I expected a painful install; thank goodness it was painless.” Results After originally struggling to find a solution to support HIPAA compliance, Mudra has been pleased with Thales eSecurity’s healthcare solutions. He commented; “The encryption overhead is pretty close to zero. Backup windows increased a little, however as that isn’t part of the user experience, it’s a good tradeoff for the protection. Most importantly, our users have no idea that each data request is coming and going to an encrypted source. My team is impressed with how self-sufficient the Vormetric appliances are: If we ever need to take one offline, we have automatic failover to the other. The management of those devices is very straightforward too, as the appliances handle the majority of activities for us. The Vormetric Data Security Platform has supported everything we’ve wanted it to do. We’re all very happy with the choice.” Thales eSecurity’s Healthcare Solutions Make Encryption Easy Mudra concluded, “For us, the protection we now have is definitely worth the investment. By comparison, a single fine for failing to be HIPAA compliant would be much greater per occurrence than our total investment to date. With the Vormetric platform, it’s so nice to be able to set-it-and-forget-it and be assured of our compliance. It’s perfect for us because it is platform agnostic, so I have no worries that as our infrastructure evolves, it will scale with us.”

Con-way, Inc. is a leader in the transportation and logistics industry. With over 28,500 employees, this publicly-traded company generated $5.6 billion in freight and logistics service revenues in 2012. Headquartered in Ann Arbor, Michigan, it has over 500 operating locations spread across North America and another 20 countries spanning five continents. Within its market segment, Con-way has been named as a Fortune magazine “Most Admired Company.” Business Challenge The company handles a large volume of personally identifiable information (PII) for customers around the world. However, its role as a provider of transportation services gives the company some unique and valuable perspectives. Praveen Sharabu, senior director of Con-way’s IT Infrastructure and Vendor Management Office, explained, “In addition to a customer’s PII our systems may contain information that is deemed confidential by our customers. “It’s imperative for us to be able to secure all the information with which we’ve been entrusted: Without this trust, we don’t have a business. We’ve always had very stringent security measures in place – with best-in-class solutions for gateways, firewalls and anti-virus protection – but we knew we needed to stay ahead of increasingly sophisticated threats and malware attacks.” Technical Challenge The company’s IT infrastructure utilizes several operating systems, including Linux, AIX® and Windows®. “Our IT solutions utilize Oracle, SQL Server and other database platforms,” commented Sharabu. “In addition to the databases we also hold large amounts of data in unstructured formats, including a variety of log files and data transmitted through event processing and integration platforms. The environment is further complicated by our use of multiple partners, managed services, cloud services, etc. Our customers are sufficiently knowledgeable to appreciate the importance of encrypting their information – both at rest and in motion – everywhere across our infrastructure.” Solution Sharabu continued, “We did look at storage-level, operating system-level, and native database encryption for our infrastructure but these point products only addressed a limited part of our list of requirements, and would have created performance and operational inefficiencies.” Con-way also evaluated key management options, assessing a variety of proprietary and homegrown tools. The shortcomings of these ad-hoc solutions quickly became very apparent, motivating Sharabu and his team to focus on identifying a consistent way to manage keys and establish a standard workflow to securely deposit and retrieve the keys as needed. “Ultimately our analysis pointed to Vormetric as being the optimal answer for us. We felt that the Vormetric Data Security solution – which encompasses Vormetric Encryption and Vormetric Key Management – would give us more sophisticated and comprehensive capabilities than a combination of competing products,” recalled Sharabu. “Another significant factor was the way that Vormetric avoids us having to make any changes to our applications, storage or internal processes. We really liked being able use a single integrated solution for data encryption and key management to secure our diverse set of structured and unstructured data across the environment.” Results Deployment throughout the Con-way infrastructure was very straightforward. The company used Vormetric professional services to assist in the implementation and the subsequent transition to becoming fully operational. Sharabu noted, “It only took an hour or two per server, depending on the number and size of files to be encrypted. “The Vormetric solution’s lightweight footprint is clearly structured to minimize the effect on transactional throughput. The encryption appliances don’t impose any noticeable latency on application performance; we knew how important this is because, as we saw with some of the other products we evaluated, if you get it wrong you can compromise your whole environment. The Vormetric solution really is transparent to users.” Security Delivered Sharabu concluded, “All the internal reviews we’ve conducted have been positive. What we really appreciate – beyond the advanced features and level of protection we’ve been able to deploy – is Vormetric integrating everything into a very intuitive package that met our goals for data-level security, operational simplicity and user transparency.”

How a leader in secure electronic POS solutions ensures protection of cardholder data from acceptance to processing in a demanding environment. The Challenge: Maximize security for credit card transactions without slowing performance. As a leader in trusted and secure payment solutions, Verifone understood that retailers needed a better way to secure credit card transactions and reduce the risk of compromise of their customers’ data. Major, well-publicized data breaches have continued to cost retailers millions of dollars each year in damage to reputation and depressed sales. But any solution that provides increased protection for cardholder data needs to do so while maintaining the highest levels of performance -- up to millions of transactions per day -- for users like processors and retailers. The Solution: End-to-end encryption powered by Thales HSMs Verifone turned to Thales hardware security modules (HSMs) to provide high assurance encryption and key management functionality as a critical component of their VeriShield Total Protect solution. VeriShield encrypts cardholder data from the precise moment of acceptance on through to the point of processing, where transactions are decrypted and sent to the payment networks. Thales HSMs are used to perform secure key exchanges and secure key derivations that produce a unique key to protect each and every payment transaction. Taking advantage of capabilities unique to the Thales Security World architecture, Verifone built redundancy so that multiple servers and multiple HSMs, deployed at multiple data centers, can combine seamlessly to service very high transaction volumes with automated load balancing and failover. Additionally, Thales provides Verifone the ability to offer their customers the option to host their HSMs either on site (the typical choice) or as part of a managed service hosted by Verifone. With this solution, Verifone provides a unique combination of strong security and risk mitigation against malicious capture of cardholder data, while at the same time ensuring performance and availability for transactions – a win-win for retailers. Additionally, by deploying endto-end encryption (sometimes referred to as point-to-point encryption or P2PE), intermediate systems that sit between the POS (point of acceptance) and the point of decryption at the processor are removed from the scope of most PCI DSS compliance requirements, since the data passing through them is encrypted. The Verifone solution is specifically designed to enable retailers to provide security that goes well beyond the requirements of PCI DSS. Key Benefits Perform high assurance encryption of critical data and ensure full lifecycle key management without sacrificing performance or availability Service high transaction volumes with automated balancing and failover Provide security that goes well beyond PCI DSS requirements Reduce operational and compliance reporting costs with a powerful key management architecture Automate burdensome and risk-prone administrative tasks and eliminate single points of failure and expensive, manually-intensive backup processes About the Solution Thales HSMs Thales HSMs provide a hardened, tamper-resistant environment for performing secure cryptographic processing, key protection, and key management. With these devices you can deploy high assurance security solutions that satisfy widely established and emerging standards of due care for cryptographic systems and practices – while also maintaining high levels of operational efficiency The Thales nShield Connect+ HSM isolates and secures cryptographic operations and associated keys for an organization’s most critical applications. nShield Connect performs encryption, digital signing and key management on behalf of an extensive range of commercial and custom-built applications including public key infrastructures (PKIs), identity management systems, application-level encryption and tokenization, SSL/TLS and code signing. A high assurance alternative to software-based cryptography libraries, nShield Connect+ features certified implementations of all leading algorithms, as well as the world’s fastest ECC performance. With Thales HSMs you can: Deliver certified protection for cryptographic keys and operations within tamper-resistant hardware to significantly enhance security for critical applications. Achieve cost-effective cryptographic acceleration and unmatched operational flexibility in traditional data center and cloud environments. Overcome the security vulnerabilities and performance challenges of software-only cryptography. Reduce the cost of regulatory compliance and day-to-day key management tasks including backup and remote management. With HSMs from Thales, you buy only the capacity you need and can scale your solution easily as your requirements evolve.