CTE Protection Policies

The basic unit CTE data protection policy application is the GuardPoint. GuardPoints are typically associated with file system mount points, but may also be associated with directory sub-trees.

Note

Nested mount points within a directory, or mount points protected by a GuardPoint, are also protected in Linux and AIX environments.

Figure 1-6: CTE GuardPoints

All files in the directory hierarchy, below a GuardPoint, are subject to the GuardPoint’s policy, which consists of rules that specify:

• Protected files: Filenames or filename patterns (example: *.dat) to which the policy applies.

• Authorized users: User(s) group(s), and application(s) permitted to access the protected files.

• Permissions: Actions permitted to users (example: create/delete, read/write, rename, decrypt).

Policies also specify the name of an encryption algorithm and a key for encrypting protected files. For example, a policy might specify that all Excel workbooks protected by a GuardPoint be encrypted using an AES256 key called EXCEL-KEY. Additionally, only users in group 128 have access to the files. All other files that are not encrypted, are freely accessible to all users.

CTE Agents use two types of policies:

• Initial Data Transformation — Dataxform policies contain the elements listed above, plus a data transformation key, used by the dataxform utility to rekey file data. Transformation policies contain strict access control rules that prevent application and user access to files during transformation. CTE only uses Dataxform policies for the initial transformation. Afterwards, you replace it with a production policy.

  Dataxform operates on a per-GuardPoint basis. For initial encryption, the dataxform policy specifies a clear production key (meaning that the utility does not decrypt data because the data is unencrypted) and a new data transformation key to encrypt the data.

• Production/Standard — Production policies contain the elements listed above. They protect data within GuardPoint(s) during day-to-day IT operations.

For decryption, the policy specifies a clear data transformation key (that is, the utility does not re-encrypt files as it rewrites them) and the current production key. A rekeying transformation policy specifies both a current production (“old”) key and a transformation (“new”) key.

The following tables show various policy components of a typical dataxform rekey policy.

Security Rule (Policy Rules)

Key Selection Rules (Production/Standard)

Data Transformation Rules (Key)