Overview of CTE

For very large data sets, initial encryption deployments can affect data availability, require unacceptable maintenance windows or require cloning and synchronizing data. Encrypting millions of files can span hours or even days, which can delay encryption, or require extra disk space and data synchronization, which can be labor-intensive. Rekeying large data sets can demand significant processing time and lengthy maintenance windows. Security and IT teams face tough tradeoffs, having to choose between security and availability.

CipherTrust Transparent Encryption operates with minimal disruption, effort, and cost. Its transparent approach enables security organizations to implement encryption without changing application, networking, or storage architectures. CipherTrust Live Data Transformation builds on these advantages, offering patented capabilities that deliver breakthroughs in availability, resiliency and efficiency.

CTE includes several unique utilities to help you encrypt and manage your data. It also integrates with several third-party platforms such as Oracle, Teradata Database Appliances, and Amazon S3.

This document describes the installation and advanced configuration options for CTE, as well as detailed information about how to integrate CTE with the supported third-party products.

CTE Terminology

The guide uses the following terminology:

Term	Description
CTE	CipherTrust Transparent Encryption is a suite of products that allow you to encrypt and guard your data. The main software component of CTE is the CTE Agent, which must be installed on every host whose devices you want to protect. Notes • This suite was originally called Vormetric Transparent Encryption (VTE), and some of the names in the suite still use "Vormetric". • For example, the default installation directory is /opt/vormetric/DataSecurityExpert/agent/ for Linux and AIX, and C:\Program Files\Vormetric\DataSecurityExpert\agent\ for Windows.
CTE Agent	The software that you install on a physical or virtual machine in order to encrypt and protect the data on that machine. After you have installed the CTE Agent on the machine, you can use CTE to protect any number of devices or directories on that machine.
CTE Capabilities	CipherTrust Transparent Encryption agent version-specific features like Multi-Factor Authentication.
CTE-K8s	CipherTrust Transparent Encryption for Kubernetes. Policy-based encryption of data stored on persistent volumes
CTE-RWP or RWP	CipherTrust Transparent Encryption with Ransomware Protection. Ransomware protection for volume-level (Windows)/GuardPoint (Linux) data storage through process behavior monitoring and analytics.
CTE UserSpace (CTE-U)	CipherTrust Transparent Encryption (formerly known as ProtectFile FUSE). File system level encryption and access control solution for Linux servers.
Data Transformation	Encrypting or decrypting data.
Domain Sharing	This allows Clients in one domain to get cross-domain resources, specifically GPs.
GuardPath	A directory to which a CTE Kubernetes data protection and encryption policy has been applied. CTEK8s will control access to, and monitor changes in, this device and directory, encrypting new or changed information as needed.
GuardPoint	A device, or directory, to which a CTE data protection and encryption policy has been applied. CTE will control access to, and monitor changes in, this device and directory, encrypting new or changed information as needed.
Host /Client	In this documentation, host and client are used interchangeably to refer to the physical or virtual machine on which the CTE Agent is installed.
In-place Data transformation	Encryption mechanism for block devices.
Key Manager	An appliance that stores and manages data encryption keys, data access policies, administrative domains, and administrator profiles. Thales offers CipherTrust Manager, a key manager for use with CTE.
LDT (Live Data Transformation)	After initial GuardPoint enablement, LDT performs initial encryption, or rekeying, in the background, unnoticed by users. The data stays live and available. This accelerates CTE deployments and eliminates the need to block applications and user access to data during encryption or rekey operations, which can inconvenience users and affect operational efficiency.
LDT Communication (Comm) Group	A group of LDT clients who communicate with each other, and are responsible for, initial data transformation and future key rotation of CIFS/NFS GuardPoints.
LDT GuardPoint Group	An LDT GuardPoint Group contains a collection of LDT-enabled CTE clients that are all on the same network, managed by one CipherTrust Manager, guarding a common NFS/CIFS share and can communicate with each other over that network. An LDT GuardPoint Group enables the primary host of an LDT GuardPoint Group to communicate with the secondary hosts that are members of that LDT GuardPoint Group.
LDT Primary node	The LDT GuardPoint Group node that performs LDT rekeying of data.
LDT Secondary node	All of the other clients in the LDT GuardPoint Group are assigned as secondary nodes. Note: Secondary nodes do not participate in rekeying data, however, they can be promoted to primary nodes if a primary node fails.
LDT Subordinate nodes	The subordinate nodes are the remaining nodes in the LDT Communication Group.
LDT Triad nodes	The triad nodes are the first three servers in the LDT Communication Group.
Learn Mode	Logging mode for audit logs to help generate security policies. Learn Mode allows access to guarded paths while logging access details. Users can analyze the content users and processes are accessing, the data used, and define GuardPoint policies accordingly.
MFA	Multifactor authorization ensures that the access credentials presented belong to the actual person. After logging in to the system, when a user tries to access a CipherTrust Transparent Encryption GuardPoint, it triggers a second factor authorization to verify the user with a second form of authentication, like sending a passcode to the users's registered cell phone, that they then have to input into the application.
Profile	Shared configuration resource for Client logging, Quality of Service, Multi-Factor Authentication, Ransomware Protection and key manager communication settings.
Signature	The hash of an entity. Where Entity can be the process or the docker image.
Versioned key and Key versions	Keys whose name remains the same but keybytes are different for each different version.

CTE Components

The CTE solution consists of two parts:

• The CTE Agent software that resides on each protected virtual or physical machine (host). The CTE Agent performs the required data encryption and enforces the access policies sent to it by the key manager. The communication between the CTE Agent and the key manager is encrypted and secure.

  After the CTE Agent has encrypted a device on a host, that device is called a GuardPoint. You can use CTE to create GuardPoints on servers on-site, in the cloud, or a hybrid of both.

• A key manager that stores and manages data encryption keys, data access policies, administrative domains, and administrator profiles. After you install the CTE Agent on a host and register it with a key manager, you can use the key manager to specify which devices on the host that you want to protect, what encryption keys are used to protect those devices, and what access policies are enforced on those devices.

How to Protect Data with CTE

CTE uses policies created in the associated key manager to protect data. You can create policies to specify file encryption, data access, and auditing on specific directories and drives on your protected hosts. Each GuardPoint must have one and only one associated policy, but each policy can be associated with any number of GuardPoints.

Policies specify:

• Whether or not the resting files are encrypted.

• Who can access decrypted files and when.

• What level of file access auditing is applied when generating fine-grained audit trails.

A Security Administrator accesses key manager through a web browser. You must have administrator privileges to create policies using key Manager. The CTE Agent then implements the policies once they are pushed to the protected host.

CTE can only enforce security and key selection rules on files inside a guarded directory. If a GuardPoint is disabled, access to data in the directory goes undetected and ungoverned. Disabling a GuardPoint and then allowing unrestricted access to that GuardPoint can result in data corruption.