While encryption is widely recognized as the gold standard for protecting data privacy, the technology is only as strong as its key management, according to Oracle, and critical credential files such as Oracle wallet files, Java KeyStores, Secure Shell (SSH) key files, and Secure Sockets Layer (SSL) certificate files are often widely distributed across servers and server clusters that use error-prone synchronization and backup mechanisms.
Just months after the massive data breaches of the 2013 holiday season, a newly discovered data breach is again shining a spotlight on the need for better enterprise data security and the fact that not enough is being done to secure critical customer data. This time, the reported data breach involves a Russian crime ring and 1.2 billion user names and passwords as well as at least 500 million email addresses.
Against this backdrop, Oracle announced Oracle Key Vault, a software appliance designed to securely manage encryption keys and credential files in the enterprise data center.
What is needed, said Vipin Samar, vice president, database security product development at Oracle, is an approach to data security that addresses new threats as they emerge.
The third member of the Oracle Vault family, after Audit Vault and Database Vault, the new Oracle Key Vault provides secure, centralized management of encryption keys and credential files in the data center, including Oracle wallet files, Java KeyStores, Kerberos keytab files, SSH key files, and SSL certificate files.
“These attacks are constantly evolving. Organizations do a lot for security and that is the good news, but the bad guys keep getting better and better and when you close one window, they find another to break through,” added Roxana Bradescu, senior director, security product management, at Oracle. “As a result, organizations have to look at constantly increasing their security."
As organizations become more committted to encrypting data at rest and on the network, securely managing all the encryption keys and credential files in the data center has become a new challenge. "Encryption has become the basic thing that everybody does, and that is great," Bradescu said, but "in the ongoing battle between good and evil, the next step for most organizations is really looking at how to protect encryption keys.”
This latest security product, Key Vault, said Samar, “is really about managing all of your keys and credentials and your key stores in one central place and being able to archive your keys there, being able to restore your keys from there, being able to group them together, and share them and being able to audit who is accessing those keys. It really provides enterprises with a great way to manage all of the keys that are otherwise dispersed across systems.”
Optimized for the Oracle technology stack, including Oracle Database and Oracle Fusion Middleware, Oracle Key Vault can be deployed seamlessly in existing environments. The product’s browser-based management console offers point-and-click administration, simplified server enrollment, and audit reports, and enables organizations to share Oracle wallet files—standards-based encrypted files that securely store keys and related metadata used by components of the Oracle stack—across database clusters or disaster recovery environments. The product works with Oracle Real Application Clusters, Oracle Active Data Guard, and Oracle GoldenGate.
Delivered as a software appliance, customers provide bare hardware and on top of that, the fully hardened and preconfigured operating system, database, and application are installed. “Customers have to provide the IP address and the whole system just comes up,” said Samar. “We have done integration with the Oracle stack to enable customers to manage their wallets and key stores, and it is such that the whole provisioning model is greatly simplified because you don’t want to create a bottleneck in adoption.”
For added flexibility, in Oracle Database environments using Oracle Advanced Security with Transparent Data Encryption (TDE), Oracle Key Vault manages TDE keys over a direct network connection as an alternative to a local Oracle wallet. And, basedon the OASIS Key Management Interoperability Protocol (KMIP), Oracle Key Vault can manage keys from KMIP-compliant clients.
More information is available about Oracle Key Vault and Oracle Database Security.