Renowned for innovation and out-of-the-box thinking, this North America-based healthcare provider has been in the business for over 50 years. BUSINESS CHALLENGE The company has a rich portfolio of services including the provision of image storage technology solutions for institutions that don’t have the in-house ability to store or distribute medical images. A state-of-the-art picture archiving communication system (PACS) offers clients a full suite of capture, archiving, transmission and display capabilities. The comprehensive portfolio of services and wide variety of endpoints also present a broad attack surface for cyber criminals. The company’s chief information officer observed, “There are many sophisticated cyber challengers out there and we want to protect ourselves from being on the ‘wall-of-shame’! We cannot take any risks with the integrity of the data we handle; the reputational and financial impact would be unacceptable.” TECHNICAL CHALLENGE Alongside its traditional protection measures the company has deployed a sophisticated set of security solutions, including breach detection technologies and predictive artificial intelligence capable of discovering advanced malware. “The final piece of the puzzle was to identify an encryption solution that could work seamlessly with our existing security solutions, while providing the highest level of protection for patient data at rest in databases, applications, and log files: all at an affordable cost,” recalled the CIO. To be considered a viable contender, any potential encryption solution had to be capable of operating without disrupting the patient management system or PACS-related applications, while simultaneously meeting all HIPAA and protected health information (PHI) regulatory standards. SOLUTION The team initially explored the possibility of an application vendor-provided encryption solution but at the time the PACS and patient management system providers did not offer it. “We created a prioritized list of alternatives, and when we received approval to make the investment we conducted a trial of Vormetric Transparent Encryption from Thales,” commented the CIO. To fully evaluate the solution, test databases were created using structured patient information. The Vormetric Data Security Manager (DSM) agent was installed in monitor mode and the permissions required by PACS application users were set up (part of Vormetric Transparent Encryption, the DSM is used to manage policies and implementation). The tests evaluated encryption/decryption speed, the effect of encryption on the applications being protected, and the level of interoperability with the company’s existing security components. Impact on HIPAA and PHI governmental compliance levels were also reviewed. The trial yielded a very positive outcome. “We were really pleased with the way the Thales solution worked with our PACS application,” reported the CIO. “The DSM is designed so that encryption is almost transparent to the application. We found we could encrypt and decrypt data on the fly without disruption.” RESULTS Following successful completion of the trials, a formal decision to deploy the Thales solution was made. The team took a very structured approach to the order in which operational files would be encrypted. “The granularity of encryption made the whole process easy; we could choose a database or a specific group of files to encrypt at each step. This enabled us to immediately secure critical data without having to encrypt everything at once,” said the IT executive. He added, “This allowed us to avoid the BitLocker/ full-disc-encryption – all or nothing – scenario and definitely reduced the resource overhead. All at a price point that was within our budget.” The company currently encrypts several terabytes of structured data. The ability of Vormetric Transparent Encryption to scale volumes of data into petabyte levels ensures ongoing investment protection and provides the flexibility to adapt to evolving business requirements. Ease of use and intuitive administration also are core components of the Thales solution. “I’ve challenged my team to look for technology solutions that do the heavy lifting for us; Vormetric Transparent Encryption provides an easy interface that even a CIO can understand,” said the CIO. He concluded, “Thales has enabled us to further elevate the levels of security and integrity that we have across all of our clients’ data. The Thales solution takes care of itself: once the data is encrypted and you turn on ‘policy enforcement’, Thales just does its thing.” PEACE OF MIND With Vormetric Transparent Encryption from Thales in place, the CIO and his team have confidence that their clients’ data and trust are fully protected. The chief information officer summarized the sentiment of his CEO: “Thales is like an insurance policy – we’ll do our very best to ensure that a breach never occurs – but just in case something did happen, we’re glad we have it!” KEEPING PERSONAL DATA PERSONAL Business need Affordable encryption to secure patient health information from threats that could cause reputational and financial harm Technology need A transparent encryption solution that would not disrupt performance of the PACS and patient management system applications Support for terabytes of structured data Interoperability with existing anti-malware and breach detection security solutions HIPAA and PHI standards compliance Solution Vormetric Transparent Encryption from Thales Result Implemented a cost-effective encryption solution to secure patient data at rest Seamless interoperability with existing security solutions Able to encrypt/decrypt data on the fly without application disruption Met HIPAA and PHI compliance requirements. Peace of mind ABOUT THALES E-SECURITY Thales e-Security is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales e-Security is part of Thales Group.

Korea-based, Beyond Platform is an internet-based financial services technology company offering an innovative platform for peer-to-peer (P2P) lending. Beyond Platform entered into a memorandum of understanding with NongHyup Bank (NH Bank) an agricultural and retail bank in South Korea, to develop a mid-level interest loan product: the 30CUT-NH Loan. The company jointly developed a credit evaluation model with NH Bank by analyzing the data of five million users of credit evaluation agencies and credit card loans, accumulated over three years. Beyond Platform was recognized for its technological capabilities on the project and obtained a venture company certification from the Technology Guaranteed Fund. It also signed a collaboration agreement with the Smart FinTech Research Center at Sogang University for the joint development of an unstructured credit evaluation model using big data. Through this project, Beyond Platform plans to combine a big data analysis engine with machine learning technology to develop a self-learning credit evaluation model. The analysis engine will be able to upgrade itself and identify correlations between diverse pieces of information. BUSINESS CHALLENGE Beyond Platform had to implement a data security strategy that placed the solution in compliance with the Personal Information Protection Act in South Korea as well as being able to pass the stringent NH Bank security review. A key component of the strategy was a solution that could effectively encrypt unstructured personal data contained in both image and sound files. The data included scanned borrower’s income verification documents and audio recordings of consent being provided verbally. With the upcoming service launch, fast and reliable implementation of the encryption solution was a major concern. Unlike other similar P2P companies, Beyond Platform needed to implement a security level commensurate with the requirements of a commercial bank, as opposed to the lesser standards for a lending company. This was critical for Beyond Platform in order to bolster its competitiveness and differentiate itself from other rapidly growing financial services technology companies. TECHNICAL CHALLENGE Beyond Platform initially decided to develop and implement an encryption solution for structured and unstructured data in accordance with NH Bank’s security policies. However, having insufficient staffing to carry out the development task, the company began researching outside alternatives that could be deployed and managed with minimal resources. In addition, the solution had to be capable of being implemented without having to make changes to existing applications or to the database schema. SOLUTION After reviewing a series of encryption solutions from foreign and domestic vendors, Beyond Platform decided to implement Vormetric Transparent Encryption from Thales. The company was impressed by the many positive references for the solution both in Korea and internationally. The Thales solution encrypts all file types, including logs, images, and database information, eliminating the need to purchase separate encryption solutions for the database and for unstructured data. The solution also delivers privileged user access control that prevents other administrators from accessing the files. Of the options Beyond Platform researched, Thales best suited the company’s needs. As a startup with a limited data security staffing, the solution is ideal because it is easy to maintain and has nominal performance impact after deployment. Beyond Platform’s decision also was influenced by the fact that the full implementation of the encryption technology could be achieved without making any changes to the existing systems, with an implementation time significantly shorter than that of other vendors. The fact that the solution has Common Criteria security certification gave the firm confidence in choosing the Thales solution. RESULTS Using Vormetric Transparent Encryption from Thales, Beyond Platform is now efficiently encrypting and managing structured and unstructured data in its enterprise application, and achieving the security level of a commercial bank. Thales encryption facilitates full compliance with the Personal Information Protection Act. The P2P application easily passed the NH Bank security audit, enabling Beyond Platform to begin developing and launching additional P2P services, in turn, further reinforcing its reputation as a creative and trustworthy financial services technology provider. As Vormetric Transparent Encryption from Thales supports the same level of encryption for unstructured and structured data, Beyond Platform has flexibility to scale the protection to include other data formats. The company plans to expand the use of the solution as it adds more servers. Now Beyond Platform can realize its vision of becoming a next generation P2P service provider without having to worry about data security. Having conducted the encryption of all target data, the promise of needing a shorter time for implementation was confirmed, as well as avoiding the need to modify applications. System performance is not impacted after encryption, creating a secure environment with no adjustments imposed on application users. Consequently, the company was able to eliminate additional maintenance and labor costs related to implementing a new solution, drastically reducing the total cost of ownership. Beyond Platform chose Roltech as a partner for the implementation of the database encryption solution. Roltech is a data encryption and network security solution provider that offers consulting, implementation, outsourcing, and maintenance service for enterprise data protection and personal data compliance. BEYOND PLATFORM CREATES A SECURE ENVIRONMENT FOR BUSINESS INFORMATION WITH THALES DATA SECURITY Business challenge Comply with the Personal Information Protection Act and implement an encryption solution that meets the personal data security level required by the banking sector Implement a reliable encryption solution in time for service launch Technical challenge Encrypt both structured and unstructured data so that separate development efforts are not required Reduce time and technology adoption costs by implementing encryption technology without having to make changes to the existing database schema Minimize maintenance and performance impact so that no additional staffing is required Solution Vormetric Transparent Encryption from Thales Results Reinforced the brand value and partnerships by safely protecting customer information in all formats Achieved simple, fast and reliable system operation and management without making changes to existing applications and systems, avoiding additional investment costs ABOUT THALES E-SECURITY Thales e-Security is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales e-Security is part of Thales Group.

How an innovative start-up leveraged Thales payment security expertise to bring mobile card acceptance to the Middle East region for the first time The challenge: increasing card acceptance in countries where cash is king The United Arab Emirates (UAE) is a highly developed market in terms of IT infrastructure as well as internet and smartphone penetration and yet, surprisingly, has a relatively low penetration level of card payments. The card acceptance network only caters to established businesses and there is a huge potential to penetrate the previously untapped SME market as well as the home delivery sector. With Dubai hosting Expo 2020 (the next World Fair), the UAE government is driving an initiative towards a cashless society with the adoption of innovative and more flexible card-based payment methods. The scheme is endorsed by the major card brands active in the region, namely American Express, MasterCard and Visa, and is planned to cover all types of contact and contactless cards. Swiftch, a nimble start-up company, saw an opportunity to be a part of this cashless society by providing innovative, simple and secure card-based acceptance solutions to all levels of merchants and acquirers. The biggest challenge was to choose an industry leading partner who would be able to assist in delivering a flexible, secure and scalable hardware infrastructure, compliant with the stringent Payment Card Industry Data Security Standard (PCI DSS) security requirements. The Solution: A Secure And Flexible Mobile Payment Gateway Solution Secured By Thales HSMs Swiftch knew that mobile connectivity would play a major role in their offering – traditional fixed point-of-sale (POS) terminals would not be suitable to address the large market opportunity to take card payments on the move, especially in places like restaurants, street markets or when making home deliveries. This led to the choice of mobile card readers linked to standard smartphones or tablets running an application that Swiftch designed and now maintains. Merchants of all sizes, especially small merchants (accepting card payments for the first time and who are difficult for large bank acquirers to reach) could now be approached directly by the Swiftch sales team in the field, facilitating secure, low cost and efficient on boarding. Thales HSMs enabled Swiftch to fast track their payment gateway solution, leveraging existing proven HSM hardware that supports the end-to-end encryption of payment data and enables a secure payment processing interface to the various bank switches through which Swiftch routes their transactions. Aditya Anand, Chief Executive Officer at Swiftch says: “Taking card payments on the move, especially in places like street markets, restaurants or when making home deliveries has always been a challenge. Our mPOS solution enables affordable on-the-go payments for merchants of any size or where home delivery drivers require payment on delivery. Hardware solutions are pivotal in making security viable in mobile environments and Thales was an obvious for choice for us, offering a best in class solution with wider support and recognition in the payments market than any other provider.” About The Solution Thales payShield 9000: proven, scalable payment system security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM design benefits from more than 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

NucleusHealth is advancing patient care through innovation in cloud-based medical image management, allowing global access to medical images by physicians, patients, and health systems, as well as healthcare companies requiring images for their products and services. NucleusHealth deploys a scalable cloud platform for medical images that is web-based. At the core of the platform is patented streaming technology, providing diagnostic workstation performance in a browser on any web-enabled device. The technology significantly improves clinical collaboration through fast access to images, reduces IT overhead, is optimized for machine learning and provides flexibility and customization through numerous RESTful APIs. The company’s state-of-the-art technologies overcome traditional obstacles and distribute diagnostic quality images at unprecedented speeds. The ability to deliver faster, accurate patient care means enhanced patient outcomes at a lower cost: A compelling achievement. BUSINESS CHALLENGE NucleusHealth relies on the speed, agility, and scalability of its cloud-based automated infrastructure to manage the onslaught of data from a diverse array of global medical imaging environments. When the company sought an encryption solution there was a mission-critical objective to identify a fully automated, enterprise-grade solution that could accommodate the enormous amounts of information. Grant Cermak, chief information and security officer at NucleusHealth recalled, “Securely managing huge volumes of patient data is a business imperative for NucleusHealth, and to achieve this goal the entire process has to be scalable and automated. On top of this, everything we do must be capable of being remotely deployed and managed.” TECHNICAL CHALLENGE To establish the company’s compliance with HIPAA for the storage of PHI, NucleusHealth needed to identify an industrial grade encryption solution capable of keeping costs under control and validated for FIPS 140-2 Level 2 and 3. Cermak elaborated, “HIPAA compliance is a great starting point but we strive to go further. We offer customers the choice of a multi-tenant environment or complete data segregation, and in each case, we have to ensure that only authorized personnel can access patient data.” To accomplish this, it was determined that enterprise-grade key management and role-based access controls (RBAC) would be required to protect information, even from an insider threat with root level access. SOLUTION NucleusHealth makes extensive use of MongoDB: a big data repository deployed by many of the world’s best known companies. Because of the existing relationship and familiarity with MongoDB, Cermak and his team decided to evaluate two different encryption approaches: MongoDB’s own professional database version that includes built-in encryption, versus Vormetric Transparent Encryption from Thales that offers highly scalable encryption and key management using the Vormetric Data Security Manager (DSM) from Thales. Each solution went through a double proof-of-concept (POC) evaluation; one testing range and facility on a full dataset within MongoDB, and a second gauging the ability to provide support automation. The first POC had a set of essential success criteria; transparent encryption of data, fast encryption/decryption, audit traceability, and support for cloud-based platforms – such as Microsoft Azure – to ensure the safety of data in the cloud. This POC also examined key management protocols, which entailed a detailed review of key storage security and access procedures; with particular attention to physical separation of key vaults as required for governmental compliance regulations. Tests were included to determine the degree of protection from unauthorized root access. Price performance also factored in as a strong consideration. The second POC assessed each encryption solution’s automation capabilities, specifically the level to which deployment, reporting, policy-setting, and regulatory compliance auditing could be automated in support of NucleusHealth’s sophisticated deployment strategy. RESULTS “Vormetric Transparent Encryption was the fit we were looking for and we quickly embarked on a full rollout,” remarked Cermak. “The Thales solution met all of our evaluation criteria at a price that was affordable, and offers the automated reporting, policy setting and auditing that was vital to our strategy. Because we leveraged Vormetric Transparent Encryption, we were able to utilize the much cheaper, free, open source release of MongoDB.” Thales provides a complete separation of administrative roles. With role-based access control, only authorized users and processes can view patient data, affording a fundamental level of security that ensures the privacy of sensitive patient data. Vormetric Transparent Encryption provides granular oversight of user access patterns – who accessed which files, with which processes, and at what time – so that any departure from policy can easily be traced. “Thales takes us to the next level,” stated Cermak. “Even someone with root access to a server machine can’t view unauthorized data or adjust policies.” Thales supports scalability to the petabyte level required in medical imaging environments. Without this scale-out capability, NucleusHealth could not adequately support the continuously growing volume of data being assimilated. STREAMING SECURELY In an industry where patient data integrity is paramount and regulated, NucleusHealth ensures that customer data is fully protected from any breach -- inside or out. Cermak concluded, “With Thales solutions deployed no one has the opportunity to do the wrong thing. It’s not just encryption that’s enabled, it’s security policy”. ENCRYPTION AND PROTECTION WITH THALES Business Need Protect patient data from zero day exploits, internal and external intrusions, and unauthorized access Provide support for client multi-tenancy and data segregation requirements in public cloud environments Technology Need An automated encryption solution with secure key management to meet HIPAA compliance and the company’s strict access control requirements Provide scalability to support cloud-based platforms and protect petabytes of data without impacting Service Level Agreements (SLA) Solution Vormetric Transparent Encryption from Thales Result Implemented cost-effective encryption solution with enterprise-grade key management that scales to keep petabytes of patient data secure from unauthorized access Enabled a sophisticated cloud-based dev-ops environment with automated reporting, policy-setting, and audit traceability ABOUT THALES E-SECURITY Thales e-Security is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales e-Security is part of Thales Group.

As America’s oldest and largest healthcare services company, McKesson Corporation provides a broad range of pharmaceuticals, medical supplies and information technologies to customers in every segment of the industry. The publicly traded company achieved sales of $191 billion in 2016, making it the 5th largest company in the U.S. BUSINESS CHALLENGE McKesson is subjected to an enormous number of regulatory standards for securing data found in every one of the segments in which it operates. Sabastian High, senior manager for Product Development Standards and Innovation at McKesson, commented, “We needed to identify an enterprise-wide solution for encryption and key management that could be easily deployed across our business units without impacting operations or security. “An aspect that is of utmost importance to us is the responsiveness of a vendor’s tier-2 phone support and the resulting speed of escalation to engineering. Our requirements for resolving issues are pretty unique: If we’re doing encryption of data at rest for an application that is involved with supporting critical care activities, the notion of having a non- operational system is just unacceptable. It literally can be a life or death situation.” TECHNICAL CHALLENGE McKesson has grown both organically and through acquisitions for 180 years. This very successful strategy has led to an accumulation of multiple disparate environments, technologies and data repositories spread through-out the company. High and his colleagues created a detailed set of criteria to identify and select the optimal solution for the McKesson environment. “We had a large number of technical specifications for our key management and encryption solution; the top factors were ease of deployment, the performance impact of doing encryption, the strength of key domain capabilities across disparate file systems and file system agnosticism.” SOLUTION Following a multi-month research and evaluation period, High and his team selected Thales e-Security’s healthcare solutions. High noted, “Thales e-Security’s implementation – especially the total separation of roles within a domain model and the ability to consistently provide robust key management across disparate file systems – was the best we saw. “ “The Vormetric Data Security Platform also exceeded all of our acceptance criteria for problem identification and resolution responsiveness,” High continued. “Performance is a very critical factor for us. We conducted a proof of concept with several vendors’ solutions configured in parallel. We created a wide variety of scenarios, involving data warehousing, analytics, and informatics platforms: Thales e-Security consistently scored the highest marks. Every other encryption solution increased the file IO and data IO latency by a factor of 50 to 100. There was a really significant performance advantage using Thales e-Security when compared to the degradation we experienced with the other competitors. “I also appreciated Thales e-Security’s approach to encryption; I was never satisfied with the competitors’ strategies of encrypting individual tables or columns, both of which made no sense to us.” Technology solution provider, Williams & Garcia, was tasked to help refine the overall implementation and support models, as well as to coordinate the massive deployment across the McKesson environment. The Atlanta, Georgia-based company is responsible for actively managing key domain for each business unit and providing ongoing operational maintenance and support. RESULTS Since beginning the enterprise-wide deployment, reliability of the Thales e-Security solutions has been impeccable. High described, “We’ve never had a Vormetric Data Security Manager appliance fail, or even falter. Agent reliability has been equally flawless.” He continued, “The separation of key operators, key creator, policy, administrator, access controls, and the separation of duties model are all truly military grade; and I have a lot of experience in this field!” The Thales e-Security solution provides full coverage of all regulated data throughout the McKesson infrastructure, including facilitating compliance with the HIPAA HITECH Act, PCI DSS, FDA and EPCS (Electronic Prescriptions for Controlled Substances) mandates. “The flexibility of our Thales e-Security solution gives us an enterprisewide capability that enables business units to implement a service and support model that exactly works for them. We’ve been able use the Vormetric platform as the vehicle to implement robust key management practices that support corporate policies across the company, no other vendor can compete with the Thales e-Security model; we love the technology,” concluded High. BUSINESS NEED Identify enterprise-wide solution for encryption and key management Zero permissible impact on operations, security and service delivery TECHNOLOGY NEED Nominal performance impact ofdoing encryption Industry-leading key domain capabilities File system agnosticism SOLUTION Healthcare Solutions from Thales e-Security Vormetric Transparent Data Encryption Vormetric Key Management Vormetric Data Security Manager RESULT Impeccable reliability and performance Policy and regulatory mandates implemented across diverse infrastructure Military grade key management capabilities ABOUT THALES E-SECURITY Thales e-Security is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales e-Security is part of Thales Group.

Long known for being a pioneer in medical devices, today BD (Becton, Dickinson and Company) manufactures and sells a wide range of medical devices, instrument systems and reagents. Founded in 1897 and headquartered in Franklin Lakes, New Jersey, it employs associates in more than 50 countries worldwide and is divided into segments: BD Medical and BD Life Sciences. Three years ago, to enable quicker decision making and improve the agility of its business in a highly competitive marketplace, BD consolidated its operations onto a US-based single global instance of SAP with an Oracle database. The company transferred and consolidated data from multiple countries that required strict adherence to many regulations covering data control and security. Business Challenge Damian McDonald, vice president of Global Information Security for BD recalled, “The security solution had to be transparent, meet our encryption requirements, and also support advanced logging and monitoring. Because this was a global consolidation, we also had to fulfill all of the data privacy and security requirements for each region in which we do business.” Technical Challenge Controlling access to data was a critical component of the consolidated environment. “We’re always very concerned about the possibility of intellectual property theft. And because we outsource some of our support, we knew we needed the flexibility to give approved third-party providers operating system- and file subsystem-level privileges, but simultaneously restrict access to the core data,” stated McDonald. Solution Vormetric Data Security Manager was selected because it works at the operating system level and is transparent to the application, which was critical to McDonald and staff because SAP does not support any changes to the database. “Our requirements for file level access control, simple key management, as well as being able to encrypt backup tapes made Vormetric the perfect fit for our needs,” he reflected. “Vormetric is our standard. Whenever an encryption solution is needed, the answer is always, ‘let’s start with Vormetric.’” He continued, “A problem that we all face in the security world is the ‘urban sprawl’ of technology. Where possible, we strive to standardize and streamline controls to reduce our management overhead. Vormetric has enabled us to do that because we can use it across all of our environments including our service provider infrastructure for cloud services.” Results Today, BD’s single global instance of SAP is composed of more than 30 individual SAP modules running on premise as well as in the cloud on Microsoft Azure. “We’ve expanded the use of Vormetric Data Security Manager to address a critical need in cloud security by leveraging Vormetric Key Management to maintain custody of keys, as well as managing the data,” explained McDonald. “We’ve had a lot of help from Vormetric’s consultants with architecture and execution; now our IT teams have all the access and flexibility they need but not down to the data level. “Vormetric has been there whenever we’ve needed help: The support is excellent. It’s a true partnership; we have very close engagement with senior leaders in Vormetric and we witness their desire to see us succeed.” Encryption Is No Longer a ‘Nice To Have’ McDonald observed, “Encryption is a fundamental requirement in the evolving threat scape. The new reality is that it’s virtually impossible to keep all threats out. Vormetric Encryption and other technologies like security analytics are essential elements of a properly engineered, multi-layered, defensive strategy: If a hacker eventually does succeed in getting through to the data they will also have to break the encryption in order to access the contents.” To ensure business operations remain unimpeded, the company’s IT and security organization attaches great importance to the user experience. “The challenge with typical information security groups is that when they get involved, from a user perspective, it normally equates to whole new levels of restrictions and delays,” noted McDonald. “We’re very focused on ensuring that security is as transparent as possible to minimize the impact on each user’s experience. Vormetric Transparent Encryption enables us to apply security in a way that is invisible to the end user; in fact, it’s pretty much transparent from an administrative viewpoint too.” He concluded, “Vormetric is a primary control against insider threats. The situation of someone hacking into the data is less of a worry because Vormetric’s preventative controls make a world of difference.” About Vormetric Vormetric (@Vormetric) is the industry leader in data security solutions that span physical, virtual and cloud environments. Data is the new currency and Vormetric helps over 1,600 customers, including 17 of the Fortune 30 and many of the world’s most security conscious government organizations, to meet compliance requirements and protect what matters—their sensitive data—from both internal and external threats. The company’s scalable Vormetric Data Security Platform protects any file, any database and any application—anywhere it resides—with a high performance, market-leading data security platform that incorporates application transparent encryption, privileged user access controls, automation and security intelligence. For more information, please visit: www.thalesesecurity.com.

Teleperformance is a globally recognized outsourced CRM services, contact center solutions, debt collection and social media company. With revenues approaching $3 billion, the Paris-headquartered group’s 135,000 employees operate over 260 contact centers spread across 49 countries. BUSINESS CHALLENGE The large number of diverse applications and associated data – including call recording systems and CRM packages from multiple vendors, as well as Oracle and Microsoft SQL Server repositories – created significant obstacles in many areas, including data integrity and security. Christian Muus, director of security for Teleperformance EMEA, commented, “We considered using the native encryption capabilities included in each of our applications but quickly saw that this would be unreasonably expensive and too complicated to manage given the number of different servers and applications. The result would have been added complexity and administration overhead requiring us to hire new people with the appropriate expertise, or greatly extend the training for our existing application teams to create internal experts in each area.” TECHNICAL CHALLENGE “The need for robust encryption was being driven by our clients and also regulatory standards like HIPAA-HITECH, PCI DSS, ISO 27001 as well as European Union and country specific data protection requirements,” recalled Muus. “Sensitive end-user data, such as but not limited to credit card details and personal identifiable information, are collected in so many of our applications that we made a decision to encrypt all of our clients’ applications and databases.” The scale and pace of Teleperformance’s operations dictated the need for an easy-to-manage, agile encryption and key management solution. Teleperformance originally used the native encryption capabilities available from its Microsoft SQL Server and Oracle Enterprise environments but the overhead associated with implementations – including data structure considerations, defining key and certificate management strategies, setting administrative rights, etc. – was becoming unacceptable. Every new instance required additional design and operational discussions. SOLUTION Following a detailed analysis of viable options, Muus and his team made the decision to implement Encryption and Key Management solutions from Vormetric, purchased though Vormetric channel partner SHI International Corporation. He stated, “We were excited when we found the Vormetric solution; it gives us a consistent view of all encryption across the company, and allows us to encrypt information without having to be concerned about the application associated with the data or change business processes. “We are continually rolling out new servers and applications, so ease of deployment is very important. It turned out that implementing Vormetric was simple, and since the solution is transparent to applications, installation was easy and straightforward.” RESULTS Cost justification for the investment in Vormetric proved to be equally clear-cut. Muus reflected,” We did a cost comparison for just one system – a call recording package – and found that if we had purchased the application-specific encryption add-on from the vendor, it would have been more expensive than buying Vormetric for our whole environment. So, not only did we save money by buying Vormetric to protect that single application, we can use it to protect everything else too! “We’ve also saved money and increased reliability by reducing the overall complexity of encryption and key management, and by being able to administer the whole environment centrally. The interface is so intuitive that it is extremely easy to quickly become proficient.” Teleperformance takes great pride in ensuring that its infrastructure exceeds stringent regulatory and information security management system requirements. The Vormetric solution provides the company with a critical capability to secure and protect its massive amount of diverse data. Muus stated, “Our external regulatory auditors are big fans of Vormetric; they always are impressed with the comprehensive access control-based separation of duties that Vormetric provides. Across the whole company we only have three people with access to our encryption keys; even application administrators cannot access the application’s data despite having administrative rights for the whole server. And furthermore, the three people that are sanctioned to access our encryption keys don’t have access to the systems or applications. This is exactly the separation of duties required by standards like PCI DSS.” Encryption technologies have traditionally imposed a discernible load on system performance. Muus initially shared this concern but when asked to quantify the impact of implementing Vormetric his succinct reply was, “None!” He elaborated, “From a performance perspective, our users are completely unaware that encryption is taking place. This was our biggest concern, and in the end, it turned out to not even be an issue.” Teleperformance’s IT environment is structured to provide each country with unified central services as well as country-specific decentralized local services. “The Vormetric solution is flexible enough to allow us to have one centrally managed Vormetric system and still meet each country’s specific requirement for protecting applications and data. Vormetric enables encryption to run smoothly,” explained Muus. “The Vormetric solution is so impressive that in addition to client and customer data we now use it to encrypt our own critical internal data.” He concluded, “Vormetric gives us the performance, scalability and flexibility we need to stay ahead of our competition.”

Headquartered in Houston, Texas, BMC Software is a global leader in enterprise IT management software and services. The company delivers innovative IT management solutions that enable customers to fully leverage complex technologies, ranging from cloud to mainframe to mobile. BMC serves one hundred percent of the Forbes Global 100 and 82 percent of Fortune 500 companies. Offerings include IT service management (ITSM), data center automation, performance management, virtualization lifecycle and cloud computing management. Business Challenge Across the globe, the IT industry is becoming acutely more sensitized to cyber-based threats and the commensurate need for heightened security precautions. Audley Dean, senior director of Information Security at BMC, commented, “Our customers are deeply interested in how we handle their data. They want to know what measures we take to protect the assets they entrust to us. Many of our clients also must align to federal and industry regulations concerning how sensitive information is safeguarded.” Technical Challenge The BMC team looked at a variety of options to cover encryption of the company’s mixed Oracle and Microsoft SQL environment. Joel Bruesch, BMC’s senior manager of Information Security, recalled, “We are very aware of the risks associated with advanced persistent threats [APTs] and felt that we needed an approach that gave us granular control of protecting our information. At BMC, everything we do is grounded in best-in-class solutions and processes. It was imperative to choose an encryption and key management strategy that could stand up to the demands of the marketplace and our own expectations.” Solution One of the options considered by BMC was the use of database-level encryption. “Deploying security at the repository level turned out to be very cost prohibitive to implement and manage,” stated Bruesch. “We did extensive research and ultimately decided on Vormetric Encryption and Vormetric Key Management: The way the Thales e-Security solutions are structured gives us the protection we need and enables us to automatically address the majority of standards-driven controls with no manual intervention.” The Thales e-Security solutions provide encryption and management of both structured and unstructured data across BMC’s distributed environment. Encryption includes data access controls, integrated key management and data access reporting. If needed, keys can be managed and securely stored for use with Transparent Data Encryption (TDE) for both Oracle and Microsoft SQL Server databases. Results “Some of our customers are now coming onsite to perform audits or assessments of our security measures. The Thales e-Security solution provides us with file auditing capabilities that comprehensively address any possible concerns,” noted Bruesch. “We’re also leveraging Thales e-Security to negate a lot of the complexities in the implementation of controls for industry standards, such as simplified quarterly key rotation. “The Thales e-Security solution has been extremely easy to implement; it only took about a day to get our infrastructure configured and running. From a performance perspective, our users really aren’t aware that encryption is taking place at all, which is great.” Peace of Mind Dean concluded, “The decision to implement Thales e-Security was one that everybody was very comfortable with. Our clients actively acknowledge that the solutions’ capabilities significantly minimize risk and are definitely key elements of our infrastructure.”

Founded in 1988, Cadence Design Systems is one of the most recognizable names in the electronic design automation (EDA) industry. The Nasdaq-listed company provides software, hardware, IP and services that are used prolifically throughout the $300 billion global semiconductor marketplace. The San Jose, California-based company has 4,700 employees and in 2010 generated revenues of $936 million. Business Challenge “Everything we do involves a lot of data sharing,” explained David Vargas, Cadence Information Security Architect. “We get very specific details about planned new products, as well as problems clients need solved. Much of the information is so sensitive that the repercussions of inadvertently allowing unsanctioned access could be catastrophic. The need for tight security is obviously a very critical part of our business.” Technical Challenge “Our customers need to know when they entrust us with their data, it is completely secure,” Vargas Elaborated. “They want assurances that it has been encrypted and that nothing inappropriate has occurred. It is not uncommon to be asked to provide log files documenting which users have accessed specific files and what actions they took.” Solution To address varied client requirements, Cadence offers project environments with tiered categories of security. Vargas recalled, “When originally creating the different project security profiles we looked for best-in-class security products. We quickly determined that the integrated encryption, access control and key management components of the Vormetric Data Security solution would provide exactly what we needed. “Our clients know the excellent reputation of Vormetric solutions and most are aware that the products are heavily used by the government: This provides instant credibility, and confidence in how we ensure the ongoing integrity of all project-related data.” Cadence performs a large number of customer engagements and all are typically very diverse. “Vormetric gives us the flexibility and granularity we need to quickly generate the appropriate security characteristics for any given project. We can set up multiple clients and efficiently provide each one the desired levels of protection, including logging, access rights and encryption,” noted Vargas. Results Extensive use is made of a load-balanced server farm to place resources in a cloud configuration. “We create what are essentially private clouds in our environment and then use Vormetric to provide the ongoing security. This approach enables a dramatic reduction in the number of machines required to handle the workload, and the flexibility of the Vormetric solution directly supports this without compromising security,” stated Vargas. “The Vormetric management console allows remote deployment of access controls and facilitates precise customization of individual data security policies.” The cadence environment is predominantly VMware, utilizing Red Hat Enterprise Linux, and a smaller number of Citrix, Solaris and SUSE Linus components. Vargas commented, “Our business is extremely dynamic and Vormetric handles reconfiguration of clusters with zero impact to ongoing projects. Security policies are enforced throughout our global network. We’ve had up to 400 discrete virtual environments simultaneously protected, and the encryption process overhead is so low that it is completely unnoticeable. I’m very happy with the performance of all of our Vormetric components.” Vormetric Data Security’s integrated key management is used to centrally manage the distribution, backup and recovery of encryption keys, as well asto provide capabilities to conduct a centralized audit of related security operations. Vargas stated, “This application is really excellent: I have not yet found an equal in the industry.” “Trust is hugely important to the way we do business, and showing clients the Vormetric implementation immediately creates a sense of confidence,” concluded Vargas. Vormetric Data Security The Vormetric Data Security product family provides a single, manageable and scalable solution to manage any key and encrypt any file, any database, any application, anywhere it resides- without sacrificing application performance and avoiding key management complexity.

Delta Dental of Missouri – a member of the nation’s leading dental benefits organization, Delta Dental Plans Association – offers dental and vision benefits in the states of Missouri and South Carolina. It is the carrier of choice for over 2,000 companies and has more than 1.5 million members. The company places a strong focus on prevention and evidence-based oral health quality measures, which has earned it the participation of 96 percent of all practicing dentists in Missouri. Business Challenge Delta Dental of Missouri stores many terabytes of information in its claims system – member demographics and eligibility, claims, provider information, contracts, payment information, notices of benefits, statements, etc. – approaching “big data” classification. Bound by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) standards for electronic health care transactions, all data must be encrypted both while in transit and at rest. Karl Mudra, Delta Dental of Missouri’s CIO, stated, “One of our corporate values is to be good stewards of the data we care for on behalf of patients, providers and the groups we serve. In our view, it was a sound practice – irrespective of the HIPAA mandates – to find a best-in-class security solution. With data encryption, I believe it’s essential to be prepared ahead of time, instead of trying to react after there’s been a data breach.” Technical Challenge Database-level encryption proved challenging: “When we first started looking, not all of the alternatives to encrypt our SQL data were viable,” recalled Mudra. “Because of our database version, many of the products necessitated rewriting our whole application, changing user-level processes and procedures, creating new reporting routines, and making modifications to our production and back-up environments.” Mudra had additional criteria for any viable encryption technology. He noted, “We wanted a policy-based encryption solution, so we could grant permissions at both the user and/or application levels according to pre-defined rules, similar to how most firewall products are configured. We also needed comprehensive key management, centralized administration, and the ability to leverage the solution across both the production and disaster recovery environments. Finally, the option we selected had to be invisible to our users, with zero impact on productivity.” Solution After rejecting multiple vendors, Mudra’s team brought in Thales e-Security to demonstrate the Vormetric Data Security Platform. “We were very impressed,” he recalled. “The Vormetric Platform gave us the policy-based approach we needed, and it didn’t matter if we were running Microsoft Windows® or Linux, handling files or folders, storing data in a SQL database or dealing with a storage area network. The data-centric approach took care of all our issues and didn’t require users to do anything different, which was a huge positive for us.” Delta Dental of Missouri has a lean IT infrastructure team, and one of Mudra’s concerns was the burden of an overly demanding installation process. The staff spent about half a day doing pre-installation planning and opted to deploy file-level encryption. A Thales e-Security consultant was engaged for two days to train the team onsite, while completing encryption of the development environment. Installation was staged over three weekends, and the team was able to handle the last two installations without assistance. Mudra observed, “You define everything and set it up, and it does what you need without any headache. As always, we planned for the worst, but this time got the best. It was one of the easiest implementations from decision to production that I’ve experienced. I expected a painful install; thank goodness it was painless.” Results After originally struggling to find a solution to support HIPAA compliance, Mudra has been pleased with Thales e-Security’s healthcare solutions. He commented; “The encryption overhead is pretty close to zero. Backup windows increased a little, however as that isn’t part of the user experience, it’s a good tradeoff for the protection. Most importantly, our users have no idea that each data request is coming and going to an encrypted source. My team is impressed with how self-sufficient the Vormetric appliances are: If we ever need to take one offline, we have automatic failover to the other. The management of those devices is very straightforward too, as the appliances handle the majority of activities for us. The Vormetric Data Security Platform has supported everything we’ve wanted it to do. We’re all very happy with the choice.” Thales e-Security’s Healthcare Solutions Make Encryption Easy Mudra concluded, “For us, the protection we now have is definitely worth the investment. By comparison, a single fine for failing to be HIPAA compliant would be much greater per occurrence than our total investment to date. With the Vormetric platform, it’s so nice to be able to set-it-and-forget-it and be assured of our compliance. It’s perfect for us because it is platform agnostic, so I have no worries that as our infrastructure evolves, it will scale with us.”

Con-way, Inc. is a leader in the transportation and logistics industry. With over 28,500 employees, this publicly-traded company generated $5.6 billion in freight and logistics service revenues in 2012. Headquartered in Ann Arbor, Michigan, it has over 500 operating locations spread across North America and another 20 countries spanning five continents. Within its market segment, Con-way has been named as a Fortune magazine “Most Admired Company.” Business Challenge The company handles a large volume of personally identifiable information (PII) for customers around the world. However, its role as a provider of transportation services gives the company some unique and valuable perspectives. Praveen Sharabu, senior director of Con-way’s IT Infrastructure and Vendor Management Office, explained, “In addition to a customer’s PII our systems may contain information that is deemed confidential by our customers. “It’s imperative for us to be able to secure all the information with which we’ve been entrusted: Without this trust, we don’t have a business. We’ve always had very stringent security measures in place – with best-in-class solutions for gateways, firewalls and anti-virus protection – but we knew we needed to stay ahead of increasingly sophisticated threats and malware attacks.” Technical Challenge The company’s IT infrastructure utilizes several operating systems, including Linux, AIX® and Windows®. “Our IT solutions utilize Oracle, SQL Server and other database platforms,” commented Sharabu. “In addition to the databases we also hold large amounts of data in unstructured formats, including a variety of log files and data transmitted through event processing and integration platforms. The environment is further complicated by our use of multiple partners, managed services, cloud services, etc. Our customers are sufficiently knowledgeable to appreciate the importance of encrypting their information – both at rest and in motion – everywhere across our infrastructure.” Solution Sharabu continued, “We did look at storage-level, operating system-level, and native database encryption for our infrastructure but these point products only addressed a limited part of our list of requirements, and would have created performance and operational inefficiencies.” Con-way also evaluated key management options, assessing a variety of proprietary and homegrown tools. The shortcomings of these ad-hoc solutions quickly became very apparent, motivating Sharabu and his team to focus on identifying a consistent way to manage keys and establish a standard workflow to securely deposit and retrieve the keys as needed. “Ultimately our analysis pointed to Vormetric as being the optimal answer for us. We felt that the Vormetric Data Security solution – which encompasses Vormetric Encryption and Vormetric Key Management – would give us more sophisticated and comprehensive capabilities than a combination of competing products,” recalled Sharabu. “Another significant factor was the way that Vormetric avoids us having to make any changes to our applications, storage or internal processes. We really liked being able use a single integrated solution for data encryption and key management to secure our diverse set of structured and unstructured data across the environment.” Results Deployment throughout the Con-way infrastructure was very straightforward. The company used Vormetric professional services to assist in the implementation and the subsequent transition to becoming fully operational. Sharabu noted, “It only took an hour or two per server, depending on the number and size of files to be encrypted. “The Vormetric solution’s lightweight footprint is clearly structured to minimize the effect on transactional throughput. The encryption appliances don’t impose any noticeable latency on application performance; we knew how important this is because, as we saw with some of the other products we evaluated, if you get it wrong you can compromise your whole environment. The Vormetric solution really is transparent to users.” Security Delivered Sharabu concluded, “All the internal reviews we’ve conducted have been positive. What we really appreciate – beyond the advanced features and level of protection we’ve been able to deploy – is Vormetric integrating everything into a very intuitive package that met our goals for data-level security, operational simplicity and user transparency.”

How a leader in secure electronic POS solutions ensures protection of cardholder data from acceptance to processing in a demanding environment. The Challenge: Maximize security for credit card transactions without slowing performance. As a leader in trusted and secure payment solutions, Verifone understood that retailers needed a better way to secure credit card transactions and reduce the risk of compromise of their customers’ data. Major, well-publicized data breaches have continued to cost retailers millions of dollars each year in damage to reputation and depressed sales. But any solution that provides increased protection for cardholder data needs to do so while maintaining the highest levels of performance -- up to millions of transactions per day -- for users like processors and retailers. The Solution: End-to-end encryption powered by Thales HSMs Verifone turned to Thales hardware security modules (HSMs) to provide high assurance encryption and key management functionality as a critical component of their VeriShield Total Protect solution. VeriShield encrypts cardholder data from the precise moment of acceptance on through to the point of processing, where transactions are decrypted and sent to the payment networks. Thales HSMs are used to perform secure key exchanges and secure key derivations that produce a unique key to protect each and every payment transaction. Taking advantage of capabilities unique to the Thales Security World architecture, Verifone built redundancy so that multiple servers and multiple HSMs, deployed at multiple data centers, can combine seamlessly to service very high transaction volumes with automated load balancing and failover. Additionally, Thales provides Verifone the ability to offer their customers the option to host their HSMs either on site (the typical choice) or as part of a managed service hosted by Verifone. With this solution, Verifone provides a unique combination of strong security and risk mitigation against malicious capture of cardholder data, while at the same time ensuring performance and availability for transactions – a win-win for retailers. Additionally, by deploying endto-end encryption (sometimes referred to as point-to-point encryption or P2PE), intermediate systems that sit between the POS (point of acceptance) and the point of decryption at the processor are removed from the scope of most PCI DSS compliance requirements, since the data passing through them is encrypted. The Verifone solution is specifically designed to enable retailers to provide security that goes well beyond the requirements of PCI DSS. Key Benefits Perform high assurance encryption of critical data and ensure full lifecycle key management without sacrificing performance or availability Service high transaction volumes with automated balancing and failover Provide security that goes well beyond PCI DSS requirements Reduce operational and compliance reporting costs with a powerful key management architecture Automate burdensome and risk-prone administrative tasks and eliminate single points of failure and expensive, manually-intensive backup processes About the Solution Thales HSMs Thales HSMs provide a hardened, tamper-resistant environment for performing secure cryptographic processing, key protection, and key management. With these devices you can deploy high assurance security solutions that satisfy widely established and emerging standards of due care for cryptographic systems and practices – while also maintaining high levels of operational efficiency The Thales nShield Connect+ HSM isolates and secures cryptographic operations and associated keys for an organization’s most critical applications. nShield Connect performs encryption, digital signing and key management on behalf of an extensive range of commercial and custom-built applications including public key infrastructures (PKIs), identity management systems, application-level encryption and tokenization, SSL/TLS and code signing. A high assurance alternative to software-based cryptography libraries, nShield Connect+ features certified implementations of all leading algorithms, as well as the world’s fastest ECC performance. With Thales HSMs you can: Deliver certified protection for cryptographic keys and operations within tamper-resistant hardware to significantly enhance security for critical applications. Achieve cost-effective cryptographic acceleration and unmatched operational flexibility in traditional data center and cloud environments. Overcome the security vulnerabilities and performance challenges of software-only cryptography. Reduce the cost of regulatory compliance and day-to-day key management tasks including backup and remote management. With HSMs from Thales, you buy only the capacity you need and can scale your solution easily as your requirements evolve.

Polycom turns to Thales Professional Services and Thales HSMs to enhance VoIP Security. Best known for its iconic triangular-shaped conference phones, Polycom transformed business communication in the early 1990s, making it easier, more efficient, and more pleasant to collaborate with colleagues and partners around the globe. The company’s brand continues to be synonymous with quality, clarity, and convenience among IT buyers. With the market for Voice over Internet Protocol (VoIP) devices growing and a portfolio of VoIP phones spanning from the desktop to the conference room, Polycom decided to enhance its phones by giving them a unique identity, making it easier to identify them on customer and service providers’ networks while thwarting would-be counterfeiters and fraudsters. How? With digital certificates and encryption keys generated and secured by Thales hardware security modules (HSMs) from the nCipher product line. “Our VoIP devices can authenticate themselves on a network using digital certificates,” says Marek Dutkiewicz, director of product management for Polycom. “Because the certificates are issued as part of the manufacturing process, it’s easy for our customers and partners to authenticate themselves while also stopping potential counterfeiters or ‘spoofers.’ Our success is built on Thales HSMs deployed by Thales Professional Services.” Securing VoIP VoIP has two key advantages over traditional telecommunications technology: lower costs and the potential for integration with other IP applications. However, as with other forms of Internet-based communication, there are security concerns, such as the uncertain identity of devices and persons on the network. Traditionally, VoIP phones used passwords for identification purposes, making definite identity verification difficult and adding to setup time for end users or service providers. Moreover, this password-based process did not protect phone manufacturers from counterfeit devices. Digital certificates overcome some of the challenges of password-based security. Unlike passwords, digital certificates are unique identifiers that allow devices to authenticate themselves and the networks they join. For example, a device with a valid certificate can verify that it is connected to an authorized server and the authorized server can check the authenticity of the device. If digital certificates are generated and distributed securely, they cannot be forged, making spoofed or counterfeit devices easy to identify. “If phones can be ‘spoofed,’ you run the risk of fraudulently placed and inaccurately billed calls,” explains Dutkiewicz. “Polycom is committed to delivering solutions that meet the needs of our customer and partners, and security is no exception. Using digital certificates to identify phones, we can significantly reduce security risks. We realized we needed a solution that would allow us to generate certificates and a corresponding private key, place them in the phones, and maintain the system across our manufacturing process.” Benefits with Thales Professional Services: Accelerated project completion Secured process to prevent spoofing and counterfeiting Tailored solution to fit manufacturing process Delivered unmatched expertise for high tech manufacturing Turning to the experts After deciding on its approach, Polycom began looking for the right solution and implementation partner. The company discussed its options with several technology vendors and solution developers, but—with one exception—none offered everything Polycom was looking for: proven technology, experience with encryption key generation and digital certificate issuance in manufacturing, and the ability to develop a secure endto-end process. Thales Professional Services was the exception. Its team explained how Thales HSMs secure the digital certificate issuance and key generation processes. Most importantly, the team also understood how to engineer and execute upon a solution that integrated with Polycom’s manufacturing process. “We decided to use Thales HSMs, and to implement our solution with help from Thales Professional Services,” says Dutkiewicz. “Thales provided the expertise needed to design and implement a tailored, secure VoIP solution.” Developing an effective process To design a process that fully met Polycom’s needs, Thales Professional Services worked closely with Polycom’s staff. Polycom explained how it wanted certificates to work within its manufacturing process, and Thales detailed a system that could deliver the capabilities Polycom wanted. Thales consultants developed a solution that generates keys and uses a Microsoft certificate authority (CA) to sign digital certificates at Polycom’s data center in North America. All key generation and certificate signing takes place within the HSM environment. Then the keys and certificates are transferred to the Thales HSM in Polycom’s manufacturing facility in Thailand. There the keys and certificates are stored encrypted until they are placed into a newly manufactured VoIP phone. “We wanted to generate keys and certificates at our data center and transfer them to the manufacturing facility and into new devices securely,” says Dutkiewicz. “Thales Professional Services delivered what we asked for and needed. The Thales team helped us to develop and implement a process that protects our customers’ calls and our company from counterfeiting.” Secure execution Thales used the Secure Execution Environment (SEE) within Thales HSMs to enable end-to-end protection of the certificate and key generation, transmission, and device insertion process. The Thales SEE allows Thales HSMs to execute a variety of processes within a secured environment. To take advantage of it, the Thales Professional Services team wrote code that generates phone key pairs, requests certificate signing, and transmits the encrypted package to Polycom’s manufacturing facility. The team also engineered a process that initiates an encrypted secure socket layer (SSL) connection within the HSM at the manufacturing facility and that terminates in the newly manufactured phone. This connection enables the secure delivery of keys and certificates into the phones. “Our Thales HSMs keep the certificates and private keys that identify phones secure, and the Thales SEE protects the issuing process half way around the world,” explains Dutkiewicz. “We have found the process to be a very effective and secure way to include digital certificate issuance in our manufacturing process.” Organization Profile Polycom, Inc. is the global leader in telepresence, video, and voice solutions and a visionary in unified communications (UC) solutions that empower people to connect and collaborate everywhere. In today's economy, Polycom solutions offer a rapid ROI and help customers reduce costs, increase productivity and lower their carbon footprint. To learn more about Polycom UC solutions, visit http://www.polycom.com. For more information about Thales, visit http://www.thales-esecurity.com. A foundation for continued success Polycom sees its Thales HSM-powered device authentication process as delivering two key bottom-line benefits to the company: reduced risk of counterfeits and increased sales opportunities. “No matter how authentic a counterfeit device might seem, it shouldn’t be able to fool an authorized VoIP network without a valid certificate,” observes Dutkiewicz. “Thales HSMs are the foundation to the entire process—from manufacturing to everyday use. I think of them as a bank vault, but really they are more secure than that. Most importantly, of course, they benefit our customers. Customers definitely want security without hassle in their VoIP devices. We see digital certificates helping us to drive sales and increase our market share.”