How Thales HSMs Helped a Payment Service Provider Deliver The Security They Needed To Rollout a New Mobile Payment Product The Goal: To Bring The Highest Standards of Security To Mobile Point-of-Sale (mPOS) Technology CreditCall, a leading payment gateway service provider, saw a huge opportunity to reach a new market with an innovative, mobile point-ofsale (POS) credit card payment technology. In years past, it was difficult for certain types of merchants to utilize mobile POS systems. The technology was expensive – smaller merchants often couldn’t afford the costs or want the long term contractual commitments. Traditional POS equipment requires a physical network connection meaning merchants who provided products or services away from an office or retail location were forced to either operate on a cash basis, missing out on the convenience and security that credit card payments offered, or rent expensive and bulky GPRS terminals. With the enormous popularity of mobile devices, CreditCall envisioned an opportunity to bring face-to-face card payment solutions to a whole new category of smaller businesses and micro-merchants by incorporating portable, low cost card reader devices that could connect wirelessly via (merchant-owned) tablets and smartphones to remote payment gateways. Mobile businesses like gardeners, plumbers and electricians could now accept credit card payments on-site at their customers’ homes. This solution now stands to replace conventional POS systems in certain environments, with low cost readers and mobile device-based application software. This significantly reduces cost and complexity, paving the way for widespread adoption by all types of merchants, not just micro-merchants. The CreditCall team began to develop mobile POS technology they could sell as a white label solution to banks, acquirers, payment processors and mobile network operators (MNOs), who could in turn sell the products and associated services to their merchant customers. But while the opportunity was significant, the CreditCall team knew security would be the primary challenge. Mobile devices are inherently insecure. If the customer’s credit card information was present in a smartphone or tablet, it would be much more vulnerable to malware, Trojans, backdoors, memory scraping and other advanced malicious threats than a traditional POS terminal. For their banking and financial clients to buy-in to the new mobile POS business model, CreditCall would have to ensure the highest levels of security could be achieved. Benefits For Payment Service Providers (PSPs): Increase transaction volume and revenue by enabling a broader community of merchants to accept card payments in a highly secure manner with low onboarding costs Minimize installation costs by using HSMs to secure the remote key injection process for the card readers, eliminating costly pre-personalization at the factory or manual installation on site at the merchant Reduce cost to scale internationally by enabling additional data centers and merchant terminals to be managed remotely from a central location using a flexible pool HSMs Accelerate implementation projects with HSMs that are pre-qualified to integrate with products from leading card reader vendors Benefits for Merchants: Move the merchant environment out of scope for PCI DSS compliance by ensuring that all sensitive data is encrypted using proven and certified hardware-based techniques Facilitate payment acceptance anytime and anywhere through a flexible, low cost and secure card-based solution, supporting the strongest EMV standards Reduce certification costs by eliminating the need for the merchant mobile device (smart phone or tablet) to undergo any independent security certification Minimize staff and customer training costs by delivering the same cardholder experience as traditional chip and PIN based POS terminals The Solution: Point-to-Point Encryption and Thales HSMs The CreditCall team integrated card readers certified to the PCI SRED (secure reading and exchange of data) standard together with Thales payShield 9000 hardware security modules (HSMs) to enable a point-topoint-encryption (P2PE) zone to be established between the card acceptance point and the internet-based payment gateway. As the emerging preferred approach to providing strong hardware-based encryption of sensitive payment data in POS payment environments, the P2PE process encrypts data inside the secure card reader and protects it as it flows through the merchants’ system and into the payment processing chain. By encrypting the data before it enters the merchant smart phone or tablet device (and ensuring there is no means for the device to decrypt the data), there is no requirement for security certification of the smart phone or tablet, significantly reducing complexity, costs and time to market. CreditCall was able therefore to satisfy their clients’ security requirements and protect customer personal and credit card information from potential attacks in a highly efficient and secure manner. Thales payShield 9000 HSMs were a critical component in securing the CreditCall CardEase Mobile solution. Designed specifically for the payment industry, payShield 9000 HSMs combine state-of-theart security and operational ease. They are deployed as an external peripheral for devices running card issuing and payment processing applications, with a long history of delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions. In fact, approximately 80% of all payment card transactions worldwide run through a payShield HSM. These devices are involved in protecting and validating PINs, processing transactions, issuing payment cards and managing keys. CreditCall chose Thales HSMS for two overriding reasons. The first was reputation – CreditCall knew their banking and payment processing customers would require a solution that was recognized industry-wide as a proven and reliable security solution, and Thales fit the bill. But even more importantly, CreditCall chose Thales because payShield provided more robust protection and management of encryption keys than competitive solutions. Proper key management is critical to securing customer data in a P2PE solution, both to defend against malicious external data extraction threats and to protect against compromise by a malicious insider. With robust role-based access controls, tamper-resistant security and easy-to-use management capabilities, Thales HSMs offered CreditCall the highest level of security in the industry. Reduce Scope for PCI DSS Compliance Complying with payment card industry data security standards (PCI DSS) can be a costly and time-consuming endeavor for any business. Thales HSMs can help reduce the cost and burden of compliance by significantly reducing a merchant’s scope of PCI DSS compliance. If a P2PE process is implemented correctly and account data is encrypted within a secure capture device using keys protected by Thales HSMs, a merchant will benefit from being taken out of scope for PCI DSS compliance for their mPOS solution. Strict controls for protection of and access to decryption keys must be in place; in fact, the PCI P2PE Solution Requirements and Testing Procedures requires the use of HSMs with an appropriate security rating to protect access to those keys. Thales HSMs fulfill this requirement and can play an essential role in implementing a P2PE strategy to reduce the scope and cost of compliance. Benefits of PayShield 9000 Delivers comprehensive, certified security specially designed for card issuing and payment processing Provides off-the-shelf support for all major payment applications Maximizes business continuity with redundant hardware, field serviceable components, and support for clustering and failover Streamlines deployment and maintenance and reduces the cost of compliance with a choice of software options tailored for issuers, processors, and acquirers Offers a range of scalable, high-performance models, so you pay only for the capacity you need Jeremy Gumbley, Chief Technology Officer, CreditCall says: “I see hardware solutions as being pivotal in making security viable in mobile environments. You need to be able to police and control your encryption keys independently from the rest of your infrastructure and know that those keys are not ever going to come out of that device. I see hardware as being essential as there is no really good way of doing this without hardware.” Thales payShield 9000 HSMs The Thales payShield 9000 HSM provides a payment system certified method for remotely deploying the cryptographic keys required by secure capture devices such as the Miura Shuttle for PIN and data encryption and to perform the secure decryption of payment transaction data prior to onward transmission to the acquirer. Where online PINs are used, the HSM additionally facilitates a secure PIN translation process to enable issuers to validate the PIN entered at the secure capture device. This gives Payment Service Providers (PSPs) an off-the-shelf, proven solution that can help small merchants accept card payments in a cost-effective manner.

HPS provides one of the payment industry’s most comprehensive portfolios of electronic payment solutions and services in more than 90 countries, including the National Switch of the Kingdom of Morocco. The HPS PowerCARD is heavily utilized in the Moroccan market where, in the role as the country’s national switch, it protects the routing and clearing activities of 19 prominent banks. The rapid digital transformation of the Moroccan economy generates upward of 500,000 daily interoperable transactions managed by HPS Switch and is forecast to grow dramatically. A Flexible Payments Platform Needs Robust Security HPS uses an innovative platform that revolves around the powerCARD solution to support the delivery of its wide-ranging services; facilitating a variety of transaction types occurring on any channel. PowerCARD is used by over 400 payment card organizations, including multiple top 100 financial institutions worldwide. Highly ranked by industry analysts – including IT research and advisory giant, Gartner Inc. – PowerCARD is constantly recognized for its ability to deliver scalable solutions, with the flexibility to be tailored to the needs of each customer and local market. At the center of the HPS PowerCARD security architecture is the Thales payShield 9000 hardware security module (HSM). Radouane Elfitouri, head of information technology at HPS, stated, “We were already familiar with the Thales HSM product line and the company’s reputation for continuous innovation. We like that the Thales payShield HSM is designed specifically for the payment application marketplace and its rich set of features gives us the flexibility to pursue a wide variety of use cases. It was the obvious choice for us.” The multi-threading design of the payShield HSM range offers performance options up to 1,500 transactions per second, with multiple security compliances including PCI HSM, FIPS 140-2 level 3, APCA and MEPS addressing the needs of global and regional markets. payShield 9000 from Thales is used in an estimated 80 percent of all global payment card transactions. Fast and Flexible HPS puts the Thales payShield 9000 to multiple uses, including PIN verification, card personalization, authorization processes for cards and mobile devices, HCE, contactless payments and 3-D Secure processing. “The versatility of payShield makes it the perfect solution for a great number of critical tasks,” reflected Elfitouri. “We have the first-hand experience to know that it delivers exactly what we need, whatever the situation.” He continued, “The adaptability and sheer performance of the payShield HSM gives us the ability to bring new services to market faster than our competitors and be confident that we are securing our operations with the very latest cryptography technologies.” Designed to Deliver The electronic payment industry is growing at an amazing rate; surging past the most aggressive predictions of even a year ago. The volume of payment cards in active use continues to increase dramatically, with several billion current mobile payment solution users. “The pace at which the market is expanding makes it critical that our infrastructure can scale commensurately without causing any operational disruptions,” noted Elfitouri. “The payShield 9000 range is intrinsically architected to deliver precisely this level of scalability; completely removing any concerns about throughput or processing capabilities.” Nacer Amraoui, director of alliances and partners program for HPS, concluded, “Whatever we do has to be 100 percent secure: This is a business built on trust and we have to ensure that we remain worthy of that trust. The Thales payShield HSM gives us the ability to deliver on our commitments.” Business challenge Identify HSM capable of securing majority of business operations, procured from a company with a longstanding reputation for innovation and dependability. Technology need Scalability, reliability and flexibility Protect broad range of payment transaction types utilizing multiple channels Solution Thales payShield 9000 Result PowerCARD selected as National Switch of the Kingdom of Morocco Creation of industry-leading suite of global electronic payment services and solutions Accelerated time to market of new offerings Ability to easily scale and adapt to capture new market opportunities About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

As America’s oldest and largest healthcare services company, McKesson Corporation provides a broad range of pharmaceuticals, medical supplies and information technologies to customers in every segment of the industry. The publicly traded company achieved sales of $191 billion in 2016, making it the 5th largest company in the U.S. Business Challenge McKesson is subjected to an enormous number of regulatory standards for securing data found in every one of the segments in which it operates. Sabastian High, senior manager for Product Development Standards and Innovation at McKesson, commented, “We needed to identify an enterprise-wide solution for encryption and key management that could be easily deployed across our business units without impacting operations or security “An aspect that is of utmost importance to us is the responsiveness of a vendor’s tier-2 phone support and the resulting speed of escalation to engineering. Our requirements for resolving issues are pretty unique: If we’re doing encryption of data at rest for an application that is involved with supporting critical care activities, the notion of having a non- operational system is just unacceptable. It literally can be a life or death situation.” Technical Challenge McKesson has grown both organically and through acquisitions for 180 years. This very successful strategy has led to an accumulation of multiple disparate environments, technologies and data repositories spread through-out the company. High and his colleagues created a detailed set of criteria to identify and select the optimal solution for the McKesson environment. “We had a large number of technical specifications for our key management and encryption solution; the top factors were ease of deployment, the performance impact of doing encryption, the strength of key domain capabilities across disparate file systems and file system agnosticism.” Solution Following a multi-month research and evaluation period, High and his team selected Thales eSecurity’s healthcare solutions. High noted, “Thales eSecurity’s implementation – especially the total separation of roles within a domain model and the ability to consistently provide robust key management across disparate file systems – was the best we saw. “ “The Vormetric Data Security Platform also exceeded all of our acceptance criteria for problem identification and resolution responsiveness,” High continued. “Performance is a very critical factor for us. We conducted a proof of concept with several vendors’ solutions configured in parallel. We created a wide variety of scenarios, involving data warehousing, analytics, and informatics platforms: Vormetric consistently scored the highest marks. Every other encryption solution increased the file IO and data IO latency by a factor of 50 to 100. There was a really significant performance advantage using Vormetric when compared to the degradation we experienced with the other competitors. “I also appreciated Thales eSecurity’s approach to encryption; I was never satisfied with the competitors’ strategies of encrypting individual tables or columns, both of which made no sense to us.” Technology solution provider, Williams & Garcia, was tasked to help refine the overall implementation and support models, as well as to coordinate the massive deployment across the McKesson environment. The Atlanta, Georgia-based company is responsible for actively managing key domain for each business unit and providing ongoing operational maintenance and support. Results Since beginning the enterprise-wide deployment, reliability of the Vormetric solutions has been impeccable. High described, “We’ve never had a Vormetric Data Security Manager appliance fail, or even falter. Agent reliability has been equally flawless.” He continued, “The separation of key operators, key creator, policy, administrator, access controls, and the separation of duties model are all truly military grade; and I have a lot of experience in this field!” The Vormetric solution provides full coverage of all regulated data throughout the McKesson infrastructure, including facilitating compliance with the HIPAA HITECH Act, PCI DSS, FDA and EPCS (Electronic Prescriptions for Controlled Substances) mandates. “The flexibility of our Vormetric solution gives us an enterprisewide capability that enables business units to implement a service and support model that exactly works for them. We’ve been able use the Vormetric platform as the vehicle to implement robust key management practices that support corporate policies across the company, no other vendor can compete with the Thales eSecurity model; we love the technology,” concluded High. Business Need Identify enterprise-wide solution for encryption and key management Zero permissible impact on operations, security and service delivery Technology Need Nominal performance impact ofdoing encryption Industry-leading key domain capabilities File system agnosticism Solution Healthcare Solutions from Thales eSecurity Vormetric Transparent Data Encryption Vormetric Key Management Vormetric Data Security Manager Result Impeccable reliability and performance Policy and regulatory mandates implemented across diverse infrastructure Military grade key management capabilities About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group

With an estimated 3.2 billion people using the Internet daily, the importance of cybersecurity and encryption of personal data has become increasingly critical, especially for any organization involved in the financial services sector. Monaco-based Planet of finance, an institution founded by a core group of highly credentialed banking executives, attaches extreme importance to all matters relating to security. Created in 2015, Planet of finance is the leading platform for investors. With a goal of digitizing the financial world, the company has established a dynamic platform focused on building long-lasting connections among both wealth management executives and individual high-net worth investors. Business Challenge With members in 81 countries, Planet of finance professional members collectively manage USD 15 trillion of assets. The platform delivers multiple benefits, including providing industry members with the ability to network, connect with investors and raise money. Private investors are empowered to locate and compare services that are exactly tailored to their own unique blend of requirements. One of the differentiators behind the success of Planet of finance is its unique philosophy around the ownership of personal data. Alain Broyon, partner of Planet of finance described, “A person’s information is clearly their own property but we strongly assert that this data has inherent value. If they elect to share this with, for example, a family office, then there should be appropriate compensation that recognizes the intrinsic value in the information they have provided. The family office benefits from the data, so why shouldn’t the owner!” He continued, “Our profession has always assigned the utmost importance to data security but for Planet of finance the concept of apportioning additional value to data shared with a thirdparty takes things to an even higher level. Our goal from the very beginning has been to secure our clients’ information while enabling them to remain in control of how they share it. To deliver on the trust that our customers place in us, our approach is to implement the strongest, most robust technologies available. Technical Challenge As with all companies in the financial services sector, Planet of finance is subjected to a wide range of industry, regional and global regulatory requirements, including the General Data Protection Regulation (GDPR), mandated by the European Union. Broyon explained the implications, “As ours is a global platform it was crucial to find a solution that automatically secured our data in a way that placed us in compliance with all prevailing laws and rulings but that didn’t need constant checking and adjustment.” With Planet of finance’s aggressive growth objectives, the company sought a security solution that would scale quickly, remain flexible, and provide impenetrable security to their clients. Xiaochen Guo, head of IT at Planet of finance, elaborated, “To give us the agility we need, our infrastructure is almost entirely cloud-based. This immediately eliminated many of the traditional methods used to protect information.” Solution “We did a lot of research and decided that encryption would be the optimal approach for us,” stated Guo. “We had indepth discussions with the local Thales team and they really understood what we wanted to achieve. They were very collaborative and we felt very comfortable that Thales could offer the right solution to meet all of our requirements.” The Planet of finance team selected Vormetric Application Encryption by Thales to protect the organization’s data. “The Thales solution is architected in a way that delivers the level of security sophistication we need, but without adding unnecessary complexity or overhead,” observed Guo. Vormetric Application Encryption is FIPS 140-2 Level-1 certified and includes a comprehensive software development kit for multiple languages and operating systems, as well as a collection of RESTful APIs for broad platform support. Vormetric Application Encryption was complemented by the addition of Vormetric Data Security Manager from Thales to facilitate the centralized management of data security policies and encryption keys. The flexibility of the solution enables not only Thales-generated keys to be managed, but keys from other devices that comply with the OASIS key management interoperability protocol (KMIP) standard and third-party vendors such as Microsoft, IBM and Oracle. Results The ability to expediently process transactions, irrespective of throughput volumes, was a key factor for Guo: “Vormetric Application Encryption streamlines the encryption process without sacrificing performance,” he explained. “When a user submits their information into our database, it is immediately encrypted and stored. Using Thales’s Vormetric Data Security Manager (DSM) to manage the security keys ensures that the person controlling access is the actual data owner. This means that – even in the very unlikely event of the data becoming accessible – it is totally unintelligible and therefore unusable to anyone else, including our own internal staff.” The Planet of finance technical team utilizes customized API calls to access the encryption and decryption functions residing in a Thales-provided library. “We do a lot of in-house application development and the Thales APIs gave us immediate access to an extensive range key management and encryption services,” commented Guo. He added, “If we do ever have a question about an unfamiliar area, the support we’ve received from Thales has been really great. Responses are always quick and I’m very happy with the communication we have between all the groups.” The Thales solutions make key contribution to the successful launch of innovative new offerings from Planet of finance. Broyon explained, “As we continue to add new services we have to work through a large number of legal and administrative considerations: Our use of Thales is significant in helping to overcome these challenges to be the leading platform for investors. Leaders Like to Work with Leaders Alain Broyon reflected, “Our entire business is built on a foundation of integrity and trust, and Thales enables us to grow in a way that safeguards the confidence our clients have in us. The world today is driven by data and it is therefore imperative to work with best-in-class partners. For me, Thales is the world leader in cyber security – it has world-class solutions backed by the people, services and creativity needed to stay ahead.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centres or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organisation needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenisation, and privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organisation’s digital transformation. Thales eSecurity is part of Thales Group.

Providing informed medical opinions is what physicians are paid to do: Each diagnosis and recommendation can trigger multiple outcomes, including prescriptions for drugs, insurance payment authorizations and formal completion of treatments. If a judgement is ever questioned or needs further validation a highly specialized category of company, known as an independent review organization (IRO), is called in to provide an expert review of the facts. Headquartered in Portland, Oregon, AllMed Healthcare Management offers comprehensive physician peer review solutions to leading payer and provider organizations. The company utilizes a panel of hundreds of licensed, board-certified and actively practicing physicians to conduct its assessments. Their clients include medical management and managed care organizations (MMO, MCO), third party administrators (TPA) disability carriers and other providers. Given the wide variety of highly confidential data that it handles, AllMed falls at the intersection of numerous federal, regional, industry and general regulatory mandates associated with personally identifiable information (PII), protected health information (PHI) and other sensitive data categories. As a demonstration of its commitment to adhere to the highest levels of data integrity, AllMed is one of just a handful of independent review organizations to have earned the stringent Health Information Trust Alliance (HITRUST) certification for information technology security. Business Need Joel Campbell, Information Security Officer at AllMed, commented, “In the healthcare industry the number of regulations relating to data protection can be totally overwhelming, even for security professionals. For AllMed, being HITRUST certified is tangible proof to our stakeholders that we uphold the highest standards of security and privacy: They don’t need to know what the ‘HIPAA’ or ‘HITECH’ acronyms stand for, they just need to know that we’ve met or exceeded industry-defined requirements relating to protecting patient data.” Technical Need HITRUST certification utilizes a comprehensive security framework that integrates requirements from many authoritative sources – such as ISO, NIST, PCI, HIPAA and others – and tailors them specifically to healthcare organizations. “HITRUST touches all aspects of an organization, so it is imperative to architect a solid foundation on which to build security policies, controls and procedures,” reflected Campbell. “A key step was to ensure that our data is continually secure, and for me this means encryption.” He continued, “I’ve been in the security industry a long time and the number one name for encryption technologies has always been Thales. There are obviously competing products but Thales is always the name that jumps to the top.” Solution AllMed deployed Vormetric Transparent Encryption from Thales in conjunction with the Vormetric Data Security Manager (DSM) to manage access policies and encryption keys across physical data centers, cloud environments and hybrid deployments. Vormetric Transparent Encryption provides the necessary access controls and data access logging functions needed by almost all compliance and data privacy standards and mandates, including PCI DSS, HIPAA/HITECH, GDPR and many others. AllMed is able to secure information with file and volume-level encryption for both data at rest and in motion. Agents installed above the file system on servers or virtual machines enforce data security and compliance policies; making deployment simple and fast. “Everything gets encrypted,” described Campbell. “HIPAA doesn’t explicitly distinguish between different data states but by using Thales we immediately remove any concerns or issues about how we secure information.” Result “We use a lot of different applications and were able to implement the Thales solutions without having to modify any code, databases or infrastructure components,” recalled Campbell. “We have a modestly sized security team and despite serving such a critical role, the administrative overhead of the Thales solution has been phenomenally low, truly ‘set and forget’ once configured.” Providing its panel members with the information needed to review medical cases involves sending numerous files, some of significant size. This transfer process has several areas of potential vulnerability, especially because AllMed panelists are spread around the country, outside of the company’s headquarters infrastructure. Campbell remarked, “With Thales we can prove that all data being transmitted is both unchanged and unseen, from its origin through to the receiving physician. Given its sensitivity, being able to guarantee that only the intended recipient can view the information is critical.” Serious Security Campbell added, “AllMed is always looking for new business opportunities and we are growing quickly, making it essential that our IT infrastructure can support the company’s business objectives. Thales has engineered its solutions to scale and adapt to accommodate exactly this type of dynamic situation.” The widespread, positive reputation of Thales continues to bring benefits, Campbell summarized, “Without data integrity we wouldn’t have a business. When prospects, or even existing clients, learn that we use Thales to perform all our encryption duties, that’s typically all they need to hear. They know we’re serious.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Flash sales, Cyber Monday, e-commerce, and many similar phrases have become common terms in our everyday online experience. Millions of people shop online, participate in cybermarketplaces, and multiple other forms of Internet-based retail. It’s safe to say that online commerce has become a vital element of Western culture. However, countries that are newly entering this space, like Morocco, are learning about the complex issues that come hand-in-hand with online trading. Matters like cyber security and legacy banking regulations can threaten the proliferation of e-commerce throughput the country, and ignoring these puts its citizens in a vulnerable situation. A trusted partner of Moroccan financial traders, CMI, was founded by nine of the country’s banks to provide innovative, local technology-based solutions and expertise to businesses of all sizes and industries. Business Challenge Morocco, one of the most economically powerful countries in Northern and Sub-Saharan Africa, prides itself on its agricultural and artisanal sectors, as well as its strong history of exporting a wide range of goods and services. However, until 2001, the country’s outdated banking regulations hindered the development of e-commerce. Mr. Abderrahim Massaoudi, chief technology officer for CMI, explained, “In 1976, electronic banking was born in Morocco by accepting French foreign payment cards as well as Visa, Mastercard, and American Express. In 2001, CMI was formed to improve electronic banking within the country, linking Moroccan banks together to promote exchanges with merchants.” Intrinsically international, e-commerce triggers complex considerations such as examination of banking regulations, cyber-security, and payment service provisions. “Data integrity is vital in this space,” noted Massaoudi. “Any security breach that affects CMI could greatly impact the Moroccan economy and the region’s economic standing.” Consequently, CMI mandated the identification and deployment of a local solution that would help fight against the risks of fraud related to the use of bank cards. A core criterion was a solution to manage digital keys for strong authentication and provide crypto-processing. Technical Challenge “CMI secures and processes over 250,000 transactions each day, which makes us one of the largest acquirers in all Africa,” said Massaoudi. “Use of e-commerce is exploding in our region, so we needed a solution that could keep pace with the volumes to keep each user’s information secure and accurate.” To protect end-users from inherent e-commerce security risks, CMI required a solution with the flexibility to provide streamlined security and end-to-end integrity. CMI sought the guidance of Thales local partner, PCard, to assist in the search for the optimal approach. Solution PCard and CMI quickly determined that the capabilities of the Thales payShield 9000 hardware security module (HSM) would be the ideal match for the extensive architectural requirements. “In addition to the features and functionality, Thales was the only provider able to deliver local support and expertise,” commented Massaoudi. “Its local presence and ability to deliver 24/7 assistance sealed the deal.” In addition to flexible licensing options, payShield 9000 provides a broad set of cost-effective capabilities, ranging from PIN validation to transaction processing, to key management and more. The payShield HSM offers an effective combination of strong security and operational ease, maintaining a tamperresistant security platform that protects cryptographic keys and other sensitive information including customer PINs and cardholder data. Results Thales payShield 9000 delivers comprehensive, certified security designed to meet each of CMI’s business and technical requirements. “Thales is constantly evolving the HSM product-line but always ensuring that backward compatibility is maintained. This is a huge advantage for any long-time customer who wants to protect their original investment,” affirmed Massaoudi. “The way the Thales HSM is designed gives us the ability to meet the increasing demands from the payment transaction market without having to constantly swap our hardware.” He added, “The implementation of payShield 9000 took just five minutes. There were no problems because the HSM is explicitly designed to meet key requirement in the electronic payment space. Once you install it, you tend to forget about it because it works smoothly right from the start.” The partnership with PCard also has lived up to expectations: “Not only do we get support from Thales, but we also get assistance from PCard on licensing, product implementation, and we really appreciate having local expertise and resources,” stated Massaoudi. Mission Critical The Thales HSM enables CMI to support the commercial success of its customers by delivering simplified electronic payment in a secure and efficient manner. Massaoudi concluded, “The Thales payShield 9000 is a strong and reliable product. If the HSM failed, our entire system would fail. E-commerce volumes are rapidly expanding across the region and it is critical to us that we offer consistent services to support our customers. The security and flexibility provided by the Thales HSM gives us the confidence to deliver on our commitments.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Headquartered in Budapest, Hungary, Microsec is the largest Hungarian certificate authority and a Trust Service Provider (TSP) for electronic signatures and eIDAS-certified solutions. Founded in 1984, Microsec delivers a wide array of next-generation public key infrastructure (PKI) solutions and services that include e-Passport, e-ID card security technology, transaction authorization, and mobile PKI. A highly popular solution is Microsec PassBy[ME] Mobile ID, a PKI-based mobile ID system providing future-proof user authentication, transaction signing and mobile electronic signatures – creating a seamless end-to-end digital process for users. The solution is designed to equip smartphone users with a secure mobile identity which can be used for online banking access, ATM cash withdrawals, e-government services such as e-health or tax services, or by cloud service providers for secure remote access. The patented PassBy[ME] Mobile ID leverages eIDAS-compliant certificates to deliver future proof strong customer authentication; legal traceability and non-repudiation; and trusted messaging with signed receipts of messages as proof of delivery. Electronic Identification and Trust Services (eIDAS) is a European regulation designed to create consistency and standards across the European Union (EU) for electronic identities and trust services supporting authentication and signatures. eIDAS ensures that electronic transactions are secure, no matter where they take place. Business Challenge A fundamental design goal of Microsec PassBy[ME] Mobile ID was to establish the very same guarantees that exist in the physical world – such as in a bank branch office – replicated in an online model to facilitate legally-binding transaction authorization and signatures from any type of mobile device. Dr. Sándor Szőke, Microsec’s deputy director of eIDAS Trust Services, explained the major use cases for PassBy[ME] Mobile ID, “For the financial sector our solution facilitates online banking and ecommerce, ATM transactions and point of sale usage. For government entities, it can deliver services for e-health, tax, and a range of amenities for citizens. Government departments can also use the solution to securely access information and sensitive data. It also provides remote access services for cloud environments.” Technical Challenge The primary technology-related requirement for PassBy[ME] Mobile ID was the use of PKI with corresponding keys and eIDAS-compliant certificates. “With the critical nature of the transactions we support, we need to implement state-of-theart technology with the highest security solution components available to protect the private signing keys used in the system. These requirements can only be fulfilled by leveraging certified hardware security modules,” Dr. Szőke described. Solution Microsec has over a decade of experience utilizing hardware security modules (HSMs) from Thales, finding that the devices deliver a hardened environment for secure cryptographic processing, key protection, and key management, while enabling optimal operational efficiency. Dr. Szőke reported, “We selected Thales nShield Solo HSMs to be integrated into Microsec PassBy[ME] Mobile ID to provide comprehensive protection of the PKI private keys. The integration enables customers and service providers to meet EU cross-border standards; generate and manage sensitive cryptographic keys in a certified, tamper-resistant hardware environment; and deliver a source of trust for all derived digital services.” Specifically, Thales nShield Solo is used to secure keys within a carefully designed cryptographic boundary that leverages a robust access control mechanism, ensuring that keys are only utilized for their authorized purpose. The Thales HSM certifies key availability by using sophisticated management, storage, and redundancy features to guarantee they are always accessible when needed. Key information such as service logs and receipts of messages – as proof of delivery – are stored within Thales HSM. Thales nShield HSMs are certified to Common Criteria Evaluation Assurance Level (EAL) 4+ and by way of this certification are recognized as Secure Signature Creation Devices (SSCDs) which earns them eIDAS compliance (Article 51, Transitional Measures). They are also certified to FIPS 140-2 Level 3, the most widely adopted security benchmark for cryptographic solutions in government and commercial enterprises. In addition nShield HSMs support interfacing options with applications using industry standard APIs such as PKCS#11, OpenSSL, JCE, CAPI and CNG. Results “While the current concept specifically targets the European marketplace we believe it is applicable outside of the European Union because of its inherent security features and compliance with global standards,” noted Dr. Szőke. Best Of The Best “Cryptographic private keys handled outside the protected boundary of a certified HSM are significantly more vulnerable to attacks, consequently our selection of Thales nShield Solo gives us peace of mind that we have a best-in-class hardware solution embedded within PassBy[ME] Mobile ID,” summarized Dr. Szőke. EMBEDDING A BEST-IN-CLASS HSM Business need Facilitate legally-binding online transaction authorization and signatures Replicate physical guarantee process inside a protected digital environment Technology need Protect private signing keys used within PassBy[ME] Mobile ID solution Identify method to deliver hardened cryptographic processing Ensure compliance with rigorous industry and governmental standards Solution Thales nShield Solo HSM for the management of sensitive cryptographic keys in a certified, tamperresistant hardware environment Result Delivering a source of trust across broad range of mobile digital services Able to bring secure eIDAS-compliant mobile ID solution to market Compliance with FIPS and Common Criteria standards Full compatibility with industry-standard APIs About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

How Thales helped a leading bank quickly and securely implement mobile wallet technology to secure cloud-based payments in the banking sector – ahead of its competitors. The Challenge: Deploying the First Live Host card Emulation Solution in the Belarus Market As one of the largest banks in the fast-growing economy of Belarus, MTBank wanted to enhance its leadership position by introducing mobile wallet services before any of its competitors. Offering contactless mobile payments is difficult for banks – the need to support a broad range of phones owned by their customers, that not all phones have secure elements, and developing an in-house solution usually demands complex new skills. Host card emulation (HCE) may help address some of these issues since it helps turn Android smartphones into contactless payment devices, allowing users to make payments at point-ofsale terminals using a smartphone instead of a payment card. Customers benefit from increased flexibility and convenience including the ability to consolidate multiple payment cards into a single mobile device if desired. Issuers typically see benefits in terms of easier provisioning, reduced ongoing maintenance costs and easy scalability – things that often have proved elusive with the secure element alternative. However additional security and risk management techniques are required to deliver such benefits. Security is possibly the most critical hurdle when using HCE technology. The standards set by international payment networks require every HCE solution to implement cryptographic functions using hardware security modules (HSMs) for encryption key storage and management. To succeed in its goal of allowing more than 300,000 bank cardholders to use cloud-based payments – and do this as quickly as possible, before the competition – MTBank needed HCE technology with timetested and proven cryptographic hardware that could integrate into its existing IT infrastructure and a partner who could make it happen fast. The Solution: an in-House HCE Solution With Built-in Tokenization and Authorization Services MTBank chose D8 Corporation, a proven long-term partner that specializes in the development, integration and support of IT solutions for the banking and finance sectors, to implement this project. D8’s HCE Payments platform integrates with Thales payShield 9000 HSM and its cloud-based payments functionality. The Thales HSM enhances the security of the critical tokenization solution – a process that substitutes the actual payment account data with encrypted surrogate values called ‘tokens’ that represent a fully functional digital copy of a payment ‘card account’ in the customer’s phone, without needing to store the actual data (that would be used for a companion chipbased credit or debit card) on the phone. The Thales solution securely stores the tokens and manages the separate set of keys for creating and validating token-based transactions. Thales payShield HSMs ensure that cryptographic keys are stored using a secure and tamper-resistant mechanism for maximum security, while satisfying requirements for obtaining MasterCard Cloud Based Payments (MCBP) certification. Using Thales payShield HSMs enabled MTBank to implement its HCE payment platform quickly, as the solution required no changes to the bank’s existing processing infrastructure. It also ensured maximum security of all token-based transactions and full compliance with the requirements set by international payment networks. MTBank completed the project on schedule and became the first bank in Belarus to implement HCE technology, helping to earn a “Bank of the Year” award and strengthening its reputation as a key innovator in the region. Why Thales? D8 evaluated several HSM manufacturers on behalf of MTBank and choose Thales for three critical reasons: Proven performance. With a very aggressive 90-day schedule for design and implementation, MTBank wanted a solution with an unmatched record of performance, as the bank could not afford any missteps or bugs with its HSM technology Product reputation. MTBank and D8 knew that Thales products had the highest reputation for quality and that payShield 9000 technology was used in roughly 80% of all payment transactions worldwide Exceptional support. D8 knew that the Thales customer support team could provide invaluable and highly responsive support, working quickly to fulfill requests and providing deep expertise in the implementation of HSMs in a wide variety of applications About the Solution Designed specifically for payments applications, payShield 9000 from Thales is a proven hardware security module (HSM) that performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. payShield 9000 is the most widely deployed payment HSM in the world, used in an estimated 80% of all payment card transactions. The payShield 9000 design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The payShield 9000 device is deployed as an external peripheral for mainframes and servers running card issuing, mobile provisioning and payment processing software applications for the electronic payments industry—delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card and mobile transactions. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, UnionPay, and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM v1.0 specification as published by the PCI Security Standards Council. Key Benefits: Achieve comprehensive, certified security with a solution specially designed for card issuing, mobile provisioning and payment processing Secure keys within carefully designed cryptographic boundaries with robust access control mechanisms, so keys are only used for their authorized purpose Ensure key availability with sophisticated management, storage, and redundancy features to guarantee keys are always accessible when needed by the HCE Payments server Prevent reverse engineering of cryptographic keys and algorithms Add additional encryption layer on top of the Token vault to ensure maximum safety of data from the real payment card Maximize business continuity with redundant hardware, field serviceable components, and support for clustering and failover Streamline deployment and maintenance and reduce the cost of compliance with a choice of software options tailored for issuers, processors, and acquirers About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group. About D8 Corporation D8 Corporation is an international company that specializes in the development, integration and support of IT solutions for banking and finance sectors. Their main business focus is the development and integration of payment and loyalty cards processing solutions, mobile payments systems, fraud prevention systems, AML/CTF process automation solutions, as well as associated post-project support and SLA.

Slovakia - based Regional Card Processing Centre, s.r.o. (RPC) is a member of Raiffeisen International A.G., a leading banking group in the central and eastern European region. RPC’s team handles credit and debit card issuing and processing, merchant sign - up, and fraud risk monitoring for the group, earning the company $17M in revenue. RPC’s clients include Tatra Bank as well as Raiffeisen Banks from Albania, Bulgaria, Czech Republic, Croatia, Romania, Serbia and Kosovo. Business Challenge RPC wanted to extend its services portfolio to provide cardholders with the option to perform in-store purchases using a smartphone. Ľudovít Kuruc, RPC’s project manager, described, “We wanted to offer the convenience of smartphone transactions but had to ensure that we had end-to-end security to protect the sensitive data at all times. Additionally, because the market is evolving extremely quickly and is so unpredictable, the greatest challenge was to select a security solution that was flexible, scalable and offered long-term viability.” Technical Challenge The RPC infrastructure is very complex, spanning four countries and involving banks, card processing centers, and provisioning service vendors. “Our primary technical requirements were to provide security, high availability, and interoperability across our diverse environment,” recounted Kuruc. “We became very interested in Host Card Emulation (HCE), an alternative approach to mobile payment security.” HCE is expected to deliver a simplified, lower cost approach for contactless mobile payments and digital secure remote e-commerce payments over the internet, removing much of the technical and business complexity associated with the alternative secure element implementation model. However, HCE introduces new security challenges and risk models that mean banks require security enhancements to their existing card issuing and transaction processing infrastructures. Limited-use credentials are delivered to the phone in advance to enable contactless transactions to take place. Although this method enables banks to maintain control, it has a different profile of security and risk challenges that need to be addressed, resulting in numerous technical approaches that can be taken. RPC moved forward with the development of its digital payment application that enables contactless mobile payments via HCEprepped Android smartphones at point of sale terminals. “Given the criticality of this offering to RPC, my team was focused on finding the optimal HCE security solution in the shortest possible timeframe,” Kuruc recalled. Solution RPC has been utilizing Thales hardware security modules (HSMs) in its main data centers for some years. However, Thales HSMs also can be used to secure HCE-based solutions: payment credentials are securely generated by the issuer and stored centrally using HSMs. As an integral part of the overall risk profile, the card issuers also have the flexibility to decide how many keys are saved on each phone to cover situations where authorization without handset data connectivity is needed. This exactly matched RPC’s requirements. Kuruc observed, “In our evaluation of possible HCE security solutions we found all other vendors were quickly excluded once we learned that the Thales payShield 9000 HSM had the required critical functionality – such as industry-compliant cryptography, key management and transaction processing – already integrated into the module and was already proven in the field with leading mobile payment solution providers. The alternatives would have added unnecessary complexity to an already very complicated project.” He added, “The integration of payShield 9000 was very smooth; the HSM worked exactly as described in the preliminary specifications we received, complying with all of the various payment card scheme specifications we needed to meet.” Thales has been at the forefront of offering HCE support in its HSM software, working closely with the major card schemes since the initial HCE proprietary specifications were first made available to the vendor community in 2014 and therefore RPC was able to quickly benefit from this expertise. The payShield 9000 HSMs already deployed by RPC only needed software license upgrades (which can be performed remotely using the payShield Manager remote management tool) to support HCE. This was more cost effective than having to buy additional HSMs or being forced to migrate to a totally different HSM model. Thales has more than 25 years of experience with payment system security solutions. The payShield 9000 is the most widely implemented payment HSM in the world, used in an estimated 80% of all payment card transactions. Results Despite its sophistication, the solution is extremely easy to use: RPC customers simply install the application from Google Play Store, enroll, and are then completely ready to make purchases. Behind the scenes, the payShield 9000 HSM keeps transactions protected. Kuruc noted, “When we compared the price of another vendor’s device – plus its maintenance fees, hosting, testing and upgrades, implementation of new interfaces, and the extra networking complexity, etc. – it would have added in the order of €50,000-100,000. In comparison, the Thales solution is very compelling and enabled us to standardize on payShield 9000 throughout our infrastructure!” The Perfect Security Solution Kuruc summarized, “payShield9000 has proven to be the perfect match for our digital payment application requirements because it is robust, reliable, rich in functionality, and complies with all the payments regulations, including the independent PCI HSM certification, reinforcing its security pedigree.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

London-based Kashing Ltd. offers small merchants a broad range of digital payment services that previously have only been available to mid- and large-scale businesses. Established to empower small independent companies, Kashing’s solutions provide options for online, face-to-face, and mobile payment transactions. With its omnichannel portfolio, Kashing presents a uniform way to accept and manage payments, removing the barriers traditionally found with banks and other finance companies. Business Challenge As a relative newcomer to the massive financial services marketplace, Kashing is heavily focused on establishing a robust foundation for its rapidly expanding business. Gert Horne, chief security officer and Kashing co-founder, observed, “Security is at the very core of our business: Just about everything we do revolves around ensuring the ongoing integrity of the data we hold.” He continued, “Our commitment to protecting sensitive data goes much deeper than just attaining compliance but being certified is certainly tangible, objective proof that we are serious about security.” Kashing’s business objectives for growth dictated the need for an architecture capable of scaling to support expanding transaction volumes, accompanied by requirements for highavailability and elevated throughput capabilities. Technical Challenge To safeguard the integrity of each transaction, Kashing created an architecture that utilizes point-to-point encryption of all sensitive information. The payer, payee and all transaction details remain protected from the original point-of-sale (POS) through to back-end processing. Hein de Kock, a senior developer for Kashing, elaborated, “We needed to identify a solution that could handle encryption of all our data in motion but additionally, in order to provide comprehensive coverage across our entire infrastructure, we also wanted to protect the static data that we hold.” The small, and even micro-sized businesses targeted by Kashing are frequently run by entrepreneurs with minimal technical knowledge. “We’re all about ease-of-use and bringing simplicity to what is already an overly complicated world, so whatever encryption methods we selected must be completely transparent to our users,” noted de Kock. Neil Osborne, digital marketing account executive at Kashing, concurred, “Our approach is that we are ‘Secure by Default’ – we really don’t want our clients to have to become security experts. Our subscribers are like family to us and by identifying best-in-class solutions we’re able to ensure that all personal information is secure.” Solution Kashing selected the Thales payShield 9000 HSM to facilitate transaction encryption and remote key injection into the company’s POS card reader which is used typically by their small merchant customers to accept face-to-face card payments in conjunction with the Kashing app on their smartphone or tablet. “Throughout our evaluation period we were continually impressed by the HSM’s performance and the excellent technical support we received, especially the Thales team’s willingness to work with us to accomplish our goals,” noted Horne. He added, “We were given access to a virtual device that allowed us to accurately simulate the operational scenarios that we were planning and to begin development before having our physical device. This really confirmed that payShield is the right choice for us.” Result Originally focused on encrypting transaction-related traffic, the broad capabilities of the Thales HSM creates an expanded role in the Kashing architecture: “It transpired that payShield is a great fit for encrypting our static data,” observed de Kock. “We’re able to apply all of the benefits of the HSM to our archived records too.” Horne commented, “Thales has been extremely instrumental in Kashing attaining PCI DSS compliance: The ability to perform end-to-end encryption and key management across all inmotion and at-rest data addresses significant components of the standard. In fact, we’re one of only a handful of companies that are a payments company and designated by PCI as a qualified security assessor [QSA].” The Kashing team includes a number of members located outside of its London headquarters, placing emphasis on the ability to remotely manipulate code and perform administration tasks. “We need to have hands-on control of the devices from anywhere, and Thales has done a fantastic job in the hardware design,” stated de Kock. “The flexibility to log into payShield from my laptop at home and make changes to the HSM is just amazing.” Horne summarized, “I’ve had in-depth exposure to payShield – the way it’s designed, the layout, the construction, the way that it operates, and it’s a natural choice for Kashing. From many perspectives – especially any involving integrity, availability, scalability and quality of service – Thales inspires me in the design and creation of our own environment. “I strongly recommend Thales.” About Thales eSecurity Thales eSecurity is a leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

As one of the world’s best-known airlines, this carrier operates an extensive international and domestic route network. The company is publicly traded and enjoys a market capitalization in excess of $10 billion. Like many enterprise clients, the airline had made widespread use of the RSA Data Protection Manager (DPM) solution for administering encryption and key management across its globally distributed environment. RSA’s 2016 end-of-primarysupport (EOPS) announcement signaled the start of a major initiative to identify and deploy a fitting replacement. Business Challenge The pervasive use of RSA DPM across multiple layers of the air carrier’s IT stack created an urgency and a dawning realization of the magnitude of the challenge. With DPM entrenched in most of the company’s business-critical applications, the risks were high: The original implementation of RSA DPM was notoriously complex and continuing to use the application without factory support was unacceptable. The security team’s directive was to avoid any form of negative operational impact, making it imperative to ensure that all risks were appropriately managed and mitigated. Technical Challenge The airline team considered two primary types of approach to removing the reliance on DPM: One was a“ rip and replace” procedure, where all elements of the RSA solution would be simultaneously swapped with new code modules; the second was a strategy that utilized a more orderly phased approach to the transition, removing the requirement to rewrite and test all of the affected applications. RSA DPM code had been extensively utilized across the airline’ s application portfolio, including its customer - facing ticketing, loyalty and merchandizing functions.Without the necessary inhouse technical knowledge or bandwidth to tackle the project, it became critical to quickly identify a partner that had the track record and the solutions in place to ensure a smooth transition. Solution After exhaustively researching its options the airline elected to partner with Thales eSecurity. The Thales reputation across the airline industry, and the combination of proven solutions, backed by the renowned Thales Advanced Solutions Group, provided a high-level of confidence that a successful outcome could be achieved. The Thales approach utilizes a dedicated translation server to capture existing RSA DPM calls that are collated into an emulation library to facilitate conversion to equivalent API instructions before being routed to a series of dedicated Thales Vormetric Data Security Manager (DSM) appliances. To achieve this, the translation server includes modules to simulate the DPM and interact with a Vormetric Application Encryption engine before passing the translated calls to the new DSM devices. Key preservation is a major consideration for any company considering a DPM replacement. With substantial volumes of encrypted data that had been archived, being able to retrieve any of these records – even a decade into the future – is imperative. The disadvantages of the rip-and-replace approach include the length of time required to design and implement the replacement encryption and key management environment. An inherent drawback is that all data must be migrated and an entirely new set of keys has to be created. A primary differentiator of the Thales phased approach is that keys are migrated, not replaced: This enables the continued use of existing keys to access live, and/or previously archived, encrypted data. Results Intercepting HTTP traffic containing key management calls from RSA client modules enables the full range of the airline’s DPM calls to be translated and the keys rapidly migrated to corresponding Vormetric DSM commands. Because applications and databases think they are still communicating with the RSA DPM there is nominal impact to operations. The airline was fully operational and compliant throughout the entire transition. Completion of the second phase culminates in the utilization of a newly created library of emulated calls and a Vormetric Application Encryption client that completely replaces all RSA DPM components located in individual applications. The Thales Advanced Solutions Group was intimately involved with every step of the project. The consultants’ expertise and experience, combined with their approach and tools, made the whole project feel very straightforward, despite the complexity, and at times highly convoluted nature of what needed to be done. Added Benefits Although the primary focus of the project was the RSA DPM replacement, the availability of new features and capabilities from the Thales solution provided further benefits to the airline. Thales’s Vormetric Data Security Manager is FIPS 140-2 certified and utilizes NIST-approved encryption keys. The Vormetric DSM provides the ability to import keys from any source and facilitates multi-tenancy key management across the airline’s entire infrastructure, including cloud and on-premises domains. The Thales solution delivers world-class security and great performance with almost infinite scalability enabling the capabilities to be further leveraged as new applications are added. With the complex project coming in on-time and within budget, the combination of the Thales Vormetric Data Security Manager and the expertise of the Thales Advanced Solutions Group, proved to be the optimal choice for the airline. About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premises, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Renowned for innovation and out-of-the-box thinking, this North America-based healthcare provider has been in the business for over 50 years. Business Challenge The company has a rich portfolio of services including the provision of image storage technology solutions for institutions that don’t have the in-house ability to store or distribute medical images. A state-of-the-art picture archiving communication system (PACS) offers clients a full suite of capture, archiving, transmission and display capabilities. The comprehensive portfolio of services and wide variety of endpoints also present a broad attack surface for cyber criminals. The company’s chief information officer observed, “There are many sophisticated cyber challengers out there and we want to protect ourselves from being on the ‘wall-of-shame’! We cannot take any risks with the integrity of the data we handle; the reputational and financial impact would be unacceptable.” Technical Challenge Alongside its traditional protection measures the company has deployed a sophisticated set of security solutions, including breach detection technologies and predictive artificial intelligence capable of discovering advanced malware. “The final piece of the puzzle was to identify an encryption solution that could work seamlessly with our existing security solutions, while providing the highest level of protection for patient data at rest in databases, applications, and log files: all at an affordable cost,” recalled the CIO. To be considered a viable contender, any potential encryption solution had to be capable of operating without disrupting the patient management system or PACS-related applications, while simultaneously meeting all HIPAA and protected health information (PHI) regulatory standards. Solution The team initially explored the possibility of an application vendor-provided encryption solution but at the time the PACS and patient management system providers did not offer it. “We created a prioritized list of alternatives, and when we received approval to make the investment we conducted a trial of Vormetric Transparent Encryption from Thales,” commented the CIO. To fully evaluate the solution, test databases were created using structured patient information. The Vormetric Data Security Manager (DSM) agent was installed in monitor mode and the permissions required by PACS application users were set up (part of Vormetric Transparent Encryption, the DSM is used to manage policies and implementation). The tests evaluated encryption/decryption speed, the effect of encryption on the applications being protected, and the level of interoperability with the company’s existing security components. Impact on HIPAA and PHI governmental compliance levels were also reviewed. The trial yielded a very positive outcome. “We were really pleased with the way the Thales solution worked with our PACS application,” reported the CIO. “The DSM is designed so that encryption is almost transparent to the application. We found we could encrypt and decrypt data on the fly without disruption.” Results Following successful completion of the trials, a formal decision to deploy the Thales solution was made. The team took a very structured approach to the order in which operational files would be encrypted. “The granularity of encryption made the whole process easy; we could choose a database or a specific group of files to encrypt at each step. This enabled us to immediately secure critical data without having to encrypt everything at once,” said the IT executive. He added, “This allowed us to avoid the BitLocker/ full-disc-encryption – all or nothing – scenario and definitely reduced the resource overhead. All at a price point that was within our budget.” The company currently encrypts several terabytes of structured data. The ability of Vormetric Transparent Encryption to scale volumes of data into petabyte levels ensures ongoing investment protection and provides the flexibility to adapt to evolving business requirements. Ease of use and intuitive administration also are core components of the Thales solution. “I’ve challenged my team to look for technology solutions that do the heavy lifting for us; Vormetric Transparent Encryption provides an easy interface that even a CIO can understand,” said the CIO. He concluded, “Thales has enabled us to further elevate the levels of security and integrity that we have across all of our clients’ data. The Thales solution takes care of itself: once the data is encrypted and you turn on ‘policy enforcement’, Thales just does its thing.” Peace oF Mind With Vormetric Transparent Encryption from Thales in place, the CIO and his team have confidence that their clients’ data and trust are fully protected. The chief information officer summarized the sentiment of his CEO: “Thales is like an insurance policy – we’ll do our very best to ensure that a breach never occurs – but just in case something did happen, we’re glad we have it!” Keeping Personal Data Personal Business need Affordable encryption to secure patient health information from threats that could cause reputational and financial harm Technology need A transparent encryption solution that would not disrupt performance of the PACS and patient management system applications Support for terabytes of structured data Interoperability with existing anti-malware and breach detection security solutions HIPAA and PHI standards compliance Solution

Korea-based, Beyond Platform is an internet-based financial services technology company offering an innovative platform for peer-to-peer (P2P) lending. Beyond Platform entered into a memorandum of understanding with NongHyup Bank (NH Bank) an agricultural and retail bank in South Korea, to develop a mid-level interest loan product: the 30CUT-NH Loan. The company jointly developed a credit evaluation model with NH Bank by analyzing the data of five million users of credit evaluation agencies and credit card loans, accumulated over three years. Beyond Platform was recognized for its technological capabilities on the project and obtained a venture company certification from the Technology Guaranteed Fund. It also signed a collaboration agreement with the Smart FinTech Research Center at Sogang University for the joint development of an unstructured credit evaluation model using big data. Through this project, Beyond Platform plans to combine a big data analysis engine with machine learning technology to develop a self-learning credit evaluation model. The analysis engine will be able to upgrade itself and identify correlations between diverse pieces of information. Business Challenge Beyond Platform had to implement a data security strategy that placed the solution in compliance with the Personal Information Protection Act in South Korea as well as being able to pass the stringent NH Bank security review. A key component of the strategy was a solution that could effectively encrypt unstructured personal data contained in both image and sound files. The data included scanned borrower’s income verification documents and audio recordings of consent being provided verbally. With the upcoming service launch, fast and reliable implementation of the encryption solution was a major concern. Unlike other similar P2P companies, Beyond Platform needed to implement a security level commensurate with the requirements of a commercial bank, as opposed to the lesser standards for a lending company. This was critical for Beyond Platform in order to bolster its competitiveness and differentiate itself from other rapidly growing financial services technology companies. Technical Challenge Beyond Platform initially decided to develop and implement an encryption solution for structured and unstructured data in accordance with NH Bank’s security policies. However, having insufficient staffing to carry out the development task, the company began researching outside alternatives that could be deployed and managed with minimal resources. In addition, the solution had to be capable of being implemented without having to make changes to existing applications or to the database schema. Solution After reviewing a series of encryption solutions from foreign and domestic vendors, Beyond Platform decided to implement Vormetric Transparent Encryption from Thales. The company was impressed by the many positive references for the solution both in Korea and internationally. The Thales solution encrypts all file types, including logs, images, and database information, eliminating the need to purchase separate encryption solutions for the database and for unstructured data. The solution also delivers privileged user access control that prevents other administrators from accessing the files. Of the options Beyond Platform researched, Thales best suited the company’s needs. As a startup with a limited data security staffing, the solution is ideal because it is easy to maintain and has nominal performance impact after deployment. Beyond Platform’s decision also was influenced by the fact that the full implementation of the encryption technology could be achieved without making any changes to the existing systems, with an implementation time significantly shorter than that of other vendors. The fact that the solution has Common Criteria security certification gave the firm confidence in choosing the Thales solution. Results Using Vormetric Transparent Encryption from Thales, Beyond Platform is now efficiently encrypting and managing structured and unstructured data in its enterprise application, and achieving the security level of a commercial bank. Thales encryption facilitates full compliance with the Personal Information Protection Act. The P2P application easily passed the NH Bank security audit, enabling Beyond Platform to begin developing and launching additional P2P services, in turn, further reinforcing its reputation as a creative and trustworthy financial services technology provider. As Vormetric Transparent Encryption from Thales supports the same level of encryption for unstructured and structured data, Beyond Platform has flexibility to scale the protection to include other data formats. The company plans to expand the use of the solution as it adds more servers. Now Beyond Platform can realize its vision of becoming a next generation P2P service provider without having to worry about data security. Having conducted the encryption of all target data, the promise of needing a shorter time for implementation was confirmed, as well as avoiding the need to modify applications. System performance is not impacted after encryption, creating a secure environment with no adjustments imposed on application users. Consequently, the company was able to eliminate additional maintenance and labor costs related to implementing a new solution, drastically reducing the total cost of ownership. Beyond Platform chose Roltech as a partner for the implementation of the database encryption solution. Roltech is a data encryption and network security solution provider that offers consulting, implementation, outsourcing, and maintenance service for enterprise data protection and personal data compliance. BEYOND PLATFORM CREATES A SECURE ENVIRONMENT FOR BUSINESS INFORMATION WITH THALES DATA SECURITY Business challenge Comply with the Personal Information Protection Act and implement an encryption solution that meets the personal data security level required by the banking sector Implement a reliable encryption solution in time for service launch Technical challenge Encrypt both structured and unstructured data so that separate development efforts are not required Reduce time and technology adoption costs by implementing encryption technology without having to make changes to the existing database schema Minimize maintenance and performance impact so that no additional staffing is required Solution Vormetric Transparent Encryption from Thales Results Reinforced the brand value and partnerships by safely protecting customer information in all formats Achieved simple, fast and reliable system operation and management without making changes to existing applications and systems, avoiding additional investment costs About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

NucleusHealth is advancing patient care through innovation in cloud-based medical image management, allowing global access to medical images by physicians, patients, and health systems, as well as healthcare companies requiring images for their products and services. NucleusHealth deploys a scalable cloud platform for medical images that is web-based. At the core of the platform is patented streaming technology, providing diagnostic workstation performance in a browser on any web-enabled device. The technology significantly improves clinical collaboration through fast access to images, reduces IT overhead, is optimized for machine learning and provides flexibility and customization through numerous RESTful APIs. The company’s state-of-the-art technologies overcome traditional obstacles and distribute diagnostic quality images at unprecedented speeds. The ability to deliver faster, accurate patient care means enhanced patient outcomes at a lower cost: A compelling achievement. Business Challenge NucleusHealth relies on the speed, agility, and scalability of its cloud-based automated infrastructure to manage the onslaught of data from a diverse array of global medical imaging environments. When the company sought an encryption solution there was a mission-critical objective to identify a fully automated, enterprise-grade solution that could accommodate the enormous amounts of information. Grant Cermak, chief information and security officer at NucleusHealth recalled, “Securely managing huge volumes of patient data is a business imperative for NucleusHealth, and to achieve this goal the entire process has to be scalable and automated. On top of this, everything we do must be capable of being remotely deployed and managed.” Technical Challenge To establish the company’s compliance with HIPAA for the storage of PHI, NucleusHealth needed to identify an industrial grade encryption solution capable of keeping costs under control and validated for FIPS 140-2 Level 2 and 3. Cermak elaborated, “HIPAA compliance is a great starting point but we strive to go further. We offer customers the choice of a multi-tenant environment or complete data segregation, and in each case, we have to ensure that only authorized personnel can access patient data.” To accomplish this, it was determined that enterprise-grade key management and role-based access controls (RBAC) would be required to protect information, even from an insider threat with root level access. Solution NucleusHealth makes extensive use of MongoDB: a big data repository deployed by many of the world’s best known companies. Because of the existing relationship and familiarity with MongoDB, Cermak and his team decided to evaluate two different encryption approaches: MongoDB’s own professional database version that includes built-in encryption, versus Vormetric Transparent Encryption from Thales that offers highly scalable encryption and key management using the Vormetric Data Security Manager (DSM) from Thales. Each solution went through a double proof-of-concept (POC) evaluation; one testing range and facility on a full dataset within MongoDB, and a second gauging the ability to provide support automation. The first POC had a set of essential success criteria; transparent encryption of data, fast encryption/decryption, audit traceability, and support for cloud-based platforms – such as Microsoft Azure – to ensure the safety of data in the cloud. This POC also examined key management protocols, which entailed a detailed review of key storage security and access procedures; with particular attention to physical separation of key vaults as required for governmental compliance regulations. Tests were included to determine the degree of protection from unauthorized root access. Price performance also factored in as a strong consideration. The second POC assessed each encryption solution’s automation capabilities, specifically the level to which deployment, reporting, policy-setting, and regulatory compliance auditing could be automated in support of NucleusHealth’s sophisticated deployment strategy. Results “Vormetric Transparent Encryption was the fit we were looking for and we quickly embarked on a full rollout,” remarked Cermak. “The Thales solution met all of our evaluation criteria at a price that was affordable, and offers the automated reporting, policy setting and auditing that was vital to our strategy. Because we leveraged Vormetric Transparent Encryption, we were able to utilize the much cheaper, free, open source release of MongoDB.” Thales provides a complete separation of administrative roles. With role-based access control, only authorized users and processes can view patient data, affording a fundamental level of security that ensures the privacy of sensitive patient data. Vormetric Transparent Encryption provides granular oversight of user access patterns – who accessed which files, with which processes, and at what time – so that any departure from policy can easily be traced. “Thales takes us to the next level,” stated Cermak. “Even someone with root access to a server machine can’t view unauthorized data or adjust policies.” Thales supports scalability to the petabyte level required in medical imaging environments. Without this scale-out capability, NucleusHealth could not adequately support the continuously growing volume of data being assimilated. STREAMING SECURELY In an industry where patient data integrity is paramount and regulated, NucleusHealth ensures that customer data is fully protected from any breach -- inside or out. Cermak concluded, “With Thales solutions deployed no one has the opportunity to do the wrong thing. It’s not just encryption that’s enabled, it’s security policy”. Encryption and protection with thales Business Need Protect patient data from zero day exploits, internal and external intrusions, and unauthorized access Provide support for client multi-tenancy and data segregation requirements in public cloud environments Technology Need An automated encryption solution with secure key management to meet HIPAA compliance and the company’s strict access control requirements Provide scalability to support cloud-based platforms and protect petabytes of data without impacting Service Level Agreements (SLA) Solution Vormetric Transparent Encryption from Thales Result Implemented cost-effective encryption solution with enterprise-grade key management that scales to keep petabytes of patient data secure from unauthorized access Enabled a sophisticated cloud-based dev-ops environment with automated reporting, policy-setting, and audit traceability About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Headquartered in New South Wales, Australia, The Information Management Group (TIMG) was originally formed to provide secure storage of backup tapes using a series of underground vaults. By 2004 – when it was purchased by Freightways – the company had expanded its range of services to embrace physical, digital, and cloud-based assets. With eight facilities in Australia and an additional three in New Zealand, TIMG personalizes its offerings to the individual needs of each client. TIMG’s information security manager commented, “We are an information management company, but are also very people focused. We offer our clients tailored storage solutions that always place an emphasis on security: We take the confidentiality of data extremely seriously.” Business Challenge Sensitive to the security of payment card information (PCI) and personally identifiable information (PII) online – and to comply with regulations such as the PCI Data Security Standards (DSS) – TIMG embarked on an initiative to identify and implement file-level encryption. The IS manager noted, “Clients trust us with their data and our duty is to ensure the proper processes are always in place. We decided that enhancing our security posture by deploying a best-in-class encryption solution would help us to deliver on these expectations.” Technical Challenge With millions of records in its care, TIMG wanted an enterprise-level encryption solution. The manager elaborated, “We looked for an approach that could handle the scope of our operations and scale as we continued to grow. In addition, we wanted it to be easy to implement and manage; able to encompass both files in motion as well as those at rest; and cover log files too. The flexibility to include all data types was another critical decision criterion.” The IS manager also needed a security solution that could prevent a single individual from having full access to any of the data entrusted to TIMG. He stated, “We wanted to eliminate the ‘Edward Snowden’ effect where one person has the keys to everything; we needed administrators to be able to manipulate files but not access the contents.” Solution In its evaluation of encryption solutions, The Information Management Group discovered an unexpected differentiator for Vormetric Data Security Manager (DSM) by Thales; “Thales is the only solution that enabled us to isolate and segment individual domains,” the manager recalled, “and with our diverse clientele this is extremely important. “We ran a proof-of-concept using the Thales solution, with one administrator tasked with encrypting the data and another trying to access it; and the files were always secured perfectly. Users of the test application were completely unaware that file encryption was in place, and when the administrator tried to access the data it was gibberish.” The company also found that the Thales team demonstrated a quicker response to questions than its competitors, as well as having both a technical and commercial awareness that supported TIMG’s goal of coming up with additional innovative services for its customers. Deployment of the solution into the production environment proved to be simple: the IS manager recalled, “The implementation process is very straightforward, even with some of the more sophisticated activities like setting up logging and role management rules.” Results TIMG’s internal audit team verified the environment to be in full compliance with all of the applicable standards. The manager shared, “An independent compliance manager verified everything and Thales helped us pass with flying colors. Encryption is one of the key components that have enabled us to meet and exceed the ISO/IEC 27001 standards, a core mandate for information security management systems.” He continued, “We were able to implement Vormetric Transparent Encryption by Thales without changing any of our existing application code. Now securing additional datasets is as simple as utilizing the same infrastructure and installing an extra Thales agent. “We’ve split the system administrators from the users authorized to access specific data and are leveraging the ability to set up separate domains. This enables us to create better data segregation and eliminated the risk of any one person having access to the entire system.” Only The Best For Timg’s Customers The IS manager concluded, “Cryptography is hard; doing it correctly, efficiently and flexibly is even harder. By leveraging Vormetric DSM – and the millions of dollars of research and countless resources that have gone into developing it – we are protecting our clients’ data with the best-in-class solution. We could not be happier.” Thales opens the door to new possibilities Business need

Molina Healthcare (Molina) provides services for individuals who qualify for government-sponsored health care. Dr. C. David Molina founded the company in 1980 as a provider organization serving low-income families in Southern California. Today, the FORTUNE 500 enterprise operates health plans in 12 states across the nation and in the Commonwealth of Puerto Rico; serving a total of over 4.3 million members. Business Challenge Given the nature of its activities, Molina must adhere to both the Payment Card Industry Data Security Standard (PCI DSS) and Health Insurance Portability and Accountability Act (HIPAA) regulations for the protection of members’ information. Bharani Krish, associate vice president of enterprise infrastructure, explained, “When it comes to security, we always strive to exceed the standards required by the governing regulations and mandates that apply to us. Encryption is a core component of our security architecture but we were always concerned that implementing a sophisticated solution might adversely impact the performance of our infrastructure and subsequently impede our ability to scale as we continued to grow.” Technical Challenge To ensure pervasive protection, Molina wanted to implement a standard operating procedure for encrypting all sensitive data, regardless of file formats and whether the data is in use or at rest. To adequately protect the information, Krish’s team developed precise requirements for encryption – including the need to protect encryption keys – with the aim that even with server access, a threat actor could not retrieve the data in a way that could lead to compromise. The solution also would need to facilitate the separation of roles, to comply with regulations preventing misuse by valid system users who were not authorized for data-level access to specific information. Solution Molina narrowed the field to a shortlist of solutions and conducted proof-of-concept (POC) trials; deploying each option on servers running Microsoft SQL, Cisco UCS, and Oracle SPARC. Applications were benchmarked on each solution/server combination to test for performance degradation. Of particular note was that throughout the evaluation, Krish’s team detected no performance impact with Vormetric Transparent Encryption in the Vormetric Data Security Manager (DSM) solution by Thales. A stark contrast to some of the other candidates. In addition, Krish was impressed by the seamless key management and powerful security enabled by Vormetric Key Management. Molina discovered the other solutions frequently had lengthy deployment processes that typically required an audit of all production-related data to specifically identify high-risk information to encrypt. Krish described, “The Thales solution really was in a class of its own; Vormetric Transparent Encryption is so efficient that we calculated from the POC that we would be able to encrypt all of our production databases in less time than it would have taken the team to manually sift through the data to categorize the sensitive information required by the other solutions just to start!” Krish leveraged Thales Professional Services to encrypt the first database and demonstrate how to optimally implement Transparent Encryption in the Molina environment. He recounted, “The support was excellent; Thales had an engineer standing by every weekend in case the deployment ran into complications.” The team elected to encrypt subsequent databases each weekend; planning for completion of each one by Sunday morning, then spending the rest of the day running extensive tests to identify any potential problems. At the conclusion of the project the team successfully encrypted 650 terabytes of data with zero issues. Results Molina has developed a standard procedure for scaling security as its business expands. Krish outlined, “Our encryption process is now very clearly defined: Whether we acquire a company or expand through organic growth, all of our new production data is encrypted using Vormetric Transparent Encryption.” The company also has prioritized training for all of its employees to elevate awareness and knowledge of securityrelated topics. The roles of the network administrators and users with access to encrypted data are now completely separated; administrators can manipulate and move files but cannot decrypt their contents. Krish noted, “Vormetric Key Management totally locks down the keys: There is no way they can be used in manner that puts data at risk.” Delivering Above-And-Beyond Vormetric Transparent Encryption satisfies all mandates for data-at-rest and active file protection, least privileged access, monitoring, and key management. The solution is optimized for low latency and has overcome Molina’s concern about the possibility of degrading application performance. Users have been unaware of the specific date of each database rollout and no negative feedback has been received about any aspects of the deployment. Krish concluded, “Encrypting all of our production databases perfectly fits with our mission of going above-and-beyond what is required for compliance: Vormetric DSM made that possible.” About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Kareo is the only cloud-based, medical office software and services platform that has been purpose-built for independent practices. The company’s mission is to help medical providers spend their time focused on patients, not paperwork. Consequently, these providers rely on Kareo’s platform 24/7. Key to the value of its platform is the document management and object storage system, which requires encryption to protect sensitive patient information. Business Challenge One of Kareo’s key advantages is the balance it strikes between providing innovative functionality and achieving a compelling price point. The company’s legacy encryption mechanism was a critical component of the Kareo offerings, but it had begun to impose unacceptable levels of overhead and a decision was taken to search for an alternative. Jerry Miller, director of network operations at Kareo recalled, “We needed to integrate encryption into our workflow to simplify our security administration but at an affordable cost for the independent medical practice market.” To best serve its customers, Kareo strives to deliver a highly intuitive platform. Miller explained, “We assume our customers do not have an IT background or IT staff on site, so we offer simple-to-use, intuitive software. And therefore any third-party solutions we leverage also have to be hassle-free in every way.” Technical Challenge The company wanted a solution that could encrypt the terabytes of data in its document management system without causing any network downtime or performance issues for file accesses. In order to comply with audit requirements, Kareo also needed an encryption solution that logged details of whenever the Document Management System (DMS) was accessed. With aggressive plans for continued expansion, the encryption solution needed to be capable of integrating and scaling with the company’s anticipated growth. Jesse Salmon, security architect for Kareo stated, “We’ve deployed a fast-moving, adaptable architecture that utilizes hundreds of micro services that all talk to each other; we needed an encryption solution that could keep in step with us.” Solution The Kareo team looked at several possible approaches and invited select vendors to participate in a proof-of-concept (POC). Salmon described the process, “We had each vendor attempt to encrypt 12 terabytes of data. During this process some of the factors we considered were if we could encrypt the data in place, at what speed it would run, the impact it had on the overall system, and the caliber of administrative tools provided to perform activities like changing encryption keys. “Vormetric Transparent Encryption by Thales ended up scoring the highest because of its powerful administrative features, ease-of-integration, and outright performance.” Results Even with terabytes of information being encrypted during the rollout, Kareo’s customers did not experience a moment of downtime. Salmon noted, “Because we could select individual groups of files, we were able to encrypt tens of terabytes of data without interruption. One of the differentiators with Vormetric Transparent Encryption is that you can specify folder identifiers – called guard points – at the system level via the central manager. With other solutions we lost track of which folders were encrypted and their status.” Kareo’s deployment of Vormetric Transparent Encryption was invisible to users. Miller stated, “Customer impact during the transition was another area where other solutions would have given us a lot of pain. With Thales however, encryption took around three months to fully deploy, and we were able to keep our systems operating around the clock. None of our customers were affected, there was no impact on performance of our servers, we didn’t receive a single complaint or service desk ticket, and we haven’t had any since deploying. Our end users aren’t even aware of the improved encryption protecting their files.” Salmon added, “Another benefit with Thales is that we can now audit all accesses of our DMS. We have visibility into which services are accessing which files, with which processes, at what time. This is paramount to ensuring our data is protected.” “To remain nimble, we have implemented an agile microservices architecture,” explained Miller. “Vormetric Transparent Encryption is able to support this easily and with minimum disruption – both in its deployment and in ongoing operations.” Above And Beyond Kareo can assure its customers that uploaded patient data is fully protected. Salmon concluded, “From a HIPAA (Health Insurance Portability and Accountability Act) compliance perspective, encryption may not be explicitly required for these files, but we at Kareo view this as necessary to providing the proper level of security for our customers. Vormetric Transparent Encryption is key to doing this.” Brand and business Protection With Thales Business need Enable independent medical practices to focus on care while protecting patient information Provide scalability to support business growth objectives Technology need Enable DMS access logging Support agile micro-services architecture Encrypt terabytes of data with minimal downtime or system performance degradation Solution Vormetric Transparent Encryption by Thales Results Deployed encryption across entire portfolio with zero service interruptions or disturbances to end users Implemented cost-effective solution that removed encryption from being an impediment to company growth Retained architectural agility while providing industryleading protection About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

As one of the Asia-Pacific region’s recognized Stock Exchanges, this organization was challenged by its Government to bring transparency to the country’s capital market. Taking on the challenge, the exchange set up a modern, fully automated screen-based trading system with national reach and has brought about greater transparency, speed & efficiency, safety and market integrity. Business Challenge The exchange makes a point to showcase its best-in-class information security solutions. The exchange’s solution architect explained, “The executive management and business teams look to us to set the standard for security. It is for this reason that we have always gone above and beyond what the mandatory regulations require of us; we wanted robust encryption for our personally identifiable information.” Technical Challenge With the country’s capital market totally dependent on uninterrupted operations, the spokesperson reflected, “We needed powerful encryption from an effective, mature product that has been developed and tested for several software generations. We also wanted a flexible solution that supports a variety of file types. “From the beginning of the search process we knew we needed to invest in encryption that would not cause any application-level changes or performance degradation.” Solution The exchange examined all of the levels at which it could implement encryption and – after zeroing in on the options that also supported data at rest – put all of the possible solutions through a stringent two-phase evaluation process. The architect reported, “We knew Thales is very highly rated but we looked at several other products as well. When we did a head-to-head commercial evaluation of the possible solutions, we found many to be unrealistically expensive for what they offered. “Only two solutions graduated to the technical proof of concept and Vormetric Data Security Manager (DSM) by Thales with Vormetric Transparent Encryption was the clear leader. It was faster in terms of the actual encryption, we did not see any lag in applications’ performance, and it was completely stable. This was definitely not the case for the other product we looked at.” Determined to prevent any interruption to its production operations, the exchange rolled out Vormetric DSM in a test environment to fully define policies and key management configurations. The solutions architect recounted, “We ran exhaustive tests in our simulations and then brought in Thales consultants for the production deployment: We were well prepared and the implementation went perfectly to plan, without incident.” Results The exchange’s staff is pleased with the outcome: “The internal audit team – from IT risk and compliance – was involved in the entire process,” the solutions architect noted. “After the proof of concept was complete and we moved into planning the production deployment, we reconnected with them, and they were completely satisfied with the strength of the Thales solution. “To the delight of my management, Vormetric Transparent Encryption works as promised and the exchange has met its encryption goals with no performance impact or change of any kind; in fact no one on the user side even knows they are accessing encrypted information!” Thales more than meets the exchange’s reliability requirements, the spokesperson stated, “For failover we have a business continuity, fully redundant, mirrored infrastructure in place with Thales seamlessly deployed and protecting our backups too.” It also is important to the exchange that it can rely on Thales as it expands and scales in the future the architect noted, “We chose Thales because it delivers the latest in encryption technology in a mature product that has proven compatible with every file format we have or may someday implement. We are secure in our future with Thales.” Recommending Thales To Peers The exchange is so satisfied with the performance of Thales that the security team has been recommending it to peer organizations. The solutions architect concluded, “Since realizing Vormetric Transparent Encryption’s success in our own environment we have been advocating for it in both across our industry and beyond.” Cutting-Edge Technology, Stable, Scalable Solution Business need Setting the standard for information security in country’s financial industry Exceed mandatory compliance requirements Technology need Experience no change in application performance Deploy a mature, scalable encryption solution, employing cutting-edge technology Solution Vormetric Data Security Manager by Thales Vormetric Transparent Encryption by Thales Results: Exchange management and internal audit team acknowledge speed, reliability, and quality of encryption Secure encryption extends to the business continuity environment Thales’ flexibility will enable the exchange to scale in the future Exchange has initiated plans to rollout Vormetric Encryption in other critical applications on a wider scale About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Protecting government has never been more of a challenge: The demand for online, transparent access to services and records is rapidly increasing, meanwhile the corresponding attack surface grows exponentially. The State of Hawaii tackled this situation head on. Todd Nacapuy, chief innovation officer for the State of Hawaii, oversees the Office of Enterprise Technology Services (ETS), which is tasked with providing governance for information technology programs, projects and services across the state’s executive branch. He explained, “We have defined seven CIO priorities for ETS to ensure an effective, efficient and open government: IT Workforce Development, IT Governance, Services-Oriented Infrastructure, Enterprise Projects and Programs, Open Government, Cyber Security, and IT Cost Transparency.” Business Challenge As the State of Hawaii tries to make more and more of its data accessible to the public under the open government initiative, it is ETS’ duty to mitigate the inherent new risks. Much of the data that the State holds is considered personally identifiable information (PII), and regulations – such as the Payment Card Industry Data Security Standard (PCI-DSS), Health Insurance Portability and Accountability Act (HIPAA), Fair Information Practice Principles (FIPPs), and Federal Information Security Management Act (FISMA) – require the data to be protected by encryption. Michael Otsuji, the State’s IT development officer, noted, “We are constantly making our organization aware of the potential cost of a breach, as well as what would happen if data was exposed; including the effort of clean-up that would have to be undertaken.” “Our goal was to implement data access on a just-in-time basis: only enabling an entrée to information as and when an authorized user really needs it,” recalled Nacapuy. “We wanted to deploy an encryption solution for our enterprise projects, and at the same time extend an ‘encryption-as-a-service’ offering to all of the State of Hawaii departments that wish to more tightly secure their data.” Technical Challenge Deploying encryption as a last line of defense became a key initiative for ETS particularly when it implemented a second data center – to serve as a back up to the primary site – that was located in a shared facility. “Even though the center is physically secure, we don’t have exclusive control of the space,” explained Nacapuy, “And we wanted the data to be unreadable if our other defenses were breached – for example, if someone stole a server – we needed the data to be useless to them.” Solution ETS evaluated vendors with encryption solutions, assessing them to find the optimal solution to meet its needs. Having reduced the options to a shortlist of contenders, a proof-of-concept with each was undertaken to determine individual speed, cost, ease of - use, and overall capabilities. Nacapuy recounted, “Vormetric Data Security (DSM) by Thales stood out because of Vormetric Transparent Encryption with its support for a wide variety of file formats and data states – such as data at rest – combined with Vormetric Key Management handling the rolling keys. It also demonstrated impressive speed at processing the encryption and decryption of files.” Having made the decision to standardize on the Thales solution, rollout began with ETS educating the various departments about the new encryption service. ETS took on a consultative role to fully understand the specific compliance regulations that needed to be achieved by each group and to ensure the appropriate information became secured by Vormetric Transparent Encryption. Otsuji stated, “The response to ETS offering the encryption service has been very enthusiastic because it’s not just a nice to - have it’s now a requirement for many departments, and with Thales we make it so easy and efficient.” Results Nacapuy concurred, “It’s very efficient for us because management of the Vormetric Transparent Encryption is so simple. It enables us to accomplish more with less because of the flexibility it offers in terms of spanning all of the data types across the business entities that we service.” “Thales has been a wonderful partner,” recounted Otsuji, “Putting on presentations for the departments and being extremely involved in the successful adoption of encryption by them.” Just-in-Time Data Access “We’ve listened to the operational needs of our colleagues and are able to take a business-centric approach to the capabilities we offer,” observed Nacapuy. “And Thales has become a critical offering within our services-oriented infrastructure for end-to-end encryption as well as data at rest.” He concluded, “Our move into the new paradigm of only enabling access to data as and when authorized users really need it is one of the primary catalysts behind our investments in leading-edge security solutions like Thales. DSMs is a key contributor to delivering just-in-time access conveniently and efficiently.” Keeping Everything Secure In The Aloha State Business need Identify encryption solution to achieve Compliance with a broad range of regulations Data only accessible on a just-in-time basis Technology need Secure multiple data types and states Support dual data center operations Solution Vormetric Data Security Manager by Thales Results Cross-departmental, cross-facility security Major regulatory compliance requirements addressed easily and effectively Protection for data from cyber and physical breaches Encryption now offered as a component of services-oriented infrastructure Move to just-in-time information access About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and, with the internet of things (IoT), even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property, and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged-user control and high-assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

How Thales HSMs Helped a Leader In Payment Solutions Secure a Revolutionary New Mobile Card Acceptance Solution. The Goal: Create The First All-In-One Solution For Secure Card Acceptance Utilizing Mobile Technology ROYALGATE, saw a tremendous market opportunity. The trend towards flexibility and mobility was clear – it wasn’t just micro-merchants, doorto-door salesmen and mobile businesses that wanted flexibility to accept card payments anywhere. Larger businesses like restaurants, retail sites and events companies were looking to add value and improve customer service by moving payment transactions away from traditional cashier scenarios and to wherever the customer wanted to pay. What these businesses lacked was an easy-to-use, all-in-one solution that could take advantage of the explosion of mobile devices and convert any smartphone or tablet into a payment terminal. There were plenty of payment service providers, terminal manufacturers and more than enough manufacturers of smartphones, but no one had yet developed an all-in-one software/hardware solution that would let businesses easily process card payments regardless of the card type in use. ROYALGATE wanted to be the first. The product they envisioned included a card reader, connecting directly or wirelessly to any smart device, to encrypt payment data as it is received from the card. It would provide strong security utilizing the DUKPT (Derived Unique Key Per Transaction) key management scheme in hardware, and also provide the mobile device application and back-end payment processing. Finally, it would read any kind of card, including magnetic stripe, chip and even contactless cards – a world’s first. A significant challenge, they knew, would be security. They not only needed an end-to-end solution that could be certified by all applicable associations, but also that provided strong protection for the over-the-air wireless and Bluetooth components that were important to the ease of use of the system. Protect your data with comprehensive, certified security specially designed for card issuing and payment processing. Speed deployment with off-the-shelf support for all major payment applications. Ensure business continuity with redundant hardware, field serviceable components, and support for clustering and failover. Reduce cost of maintenance and compliance with a choice of software options tailored for issuers, processors, and acquirers. Improve ROI - a range of scalable, high-performance models enables you to pay only for the capacity you need. The Solution: Thales PayShield 9000 To solve their security requirements around cryptographic key generation, protection and overall management, ROYALGATE selected Thales payShield 9000, a hardware security module designed specifically for payments applications. As the most widely deployed payment HSM in the world, payShield 9000 offered the high assurance protection, cryptographic functionality and superior key management features proven to meet or exceed the security audit requirements of all major international card schemes. payShield 9000, with its built-in DUKPT capabilities, enabled ROYALGATE to use it to securely generate and inject encryption keys into PayGate readers in Japan, prior to shipping them to their merchant customers. The Thales HSM provided the high assurance cryptographic security that was critical to creating an end-to-end solution that could be PCI DSS certified. ROYALGATE wanted to ensure protection for the entire chain of transactions – from the point of card data acceptance to the mobile application to the data center to the acquirer. Why Thales? Robust and proven technology. payShield 9000 offered comprehensive payments capabilities, including mature support for the DUKPT key management scheme. Speed. payShield 9000 offered a proven solution with a range of scalable, high-performance models so ROYALGATE could pay only for the capacity they required. Time to market. As the world’s leading payment HSM, payShield 9000 offered standard functionality and specifications that enabled ROYALGATE to develop their new solution more easily and get it to market faster Certifications. Because payShield 9000 has all major certifications and validations, ROYALGATE knew this would be an enabler to securing the approval of the Japan Credit Card Association. Support. Thales was able to provide support for the deployment at many levels – from technical support in the installation to critical help and education on the DUKPT protocol. Thales payShield 9000: Proven, Scalable Payment System Security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM’s design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a stateof-the-art solution that delivers an ideal combination of security and operational ease. The device is deployed as an external peripheral for mainframes and servers running card issuing and payment processing software applications for the electronic payments industry – delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

How Thales payment HSMs Provided The Flexibility And Global Payment Network Interoperability This Fast-Growing Company Needed To Develop a Solution That Would Revolutionize The Industry. The Challenge: find a Card Payment Security Solution That Could Promote Innovation and Confidence The founders of Marqeta wanted to do something in the card payment space that had never been done before: create a card issuing and payment system that had multiple closed loop and open loop accounts on a single card. This new model would combine a nearly unlimited amount of prepaid, debit and credit accounts into a single piece of plastic. When a Marqeta-enabled card would be swiped at a Point of Sale (POS) terminal anywhere in the world, within a split second the company would be able to identify the cardholder and merchant, and authorize a transaction based on sequestered funds available or on restricted rules for the merchant. But securing the system would be the challenge. Even as Marqeta sought to revolutionize the payment network, a tried and true payment security and information protection technology was essential to widespread adoption. Marqeta’s security technology had to be a strong, stable platform that could enable real-time, dynamic processing of card information, while also being able to operate with the standard payment network used by all the other players in the space. The Solution: Thales Payment Hardware Security Modules. To secure its new payment system, Marqeta chose Thales payShield 9000 hardware security modules (HSMs). As the most widely deployed payment HSM in the world, the payShield 9000 provides Marqeta with a solution that communicates with merchants, issuers, and acquirers worldwide. As an external peripheral supporting a wide range of hosts including mainframes and servers, it provided the interoperability and high assurance Marqeta required for POS credit and debit card transactions. Key Benefits Achieve comprehensive, certified security specially designed for card issuing and payment processing. Maximize business continuity with redundant hardware, field serviceable components, and support for clustering and failover. Streamline deployment and maintenance and reduce the cost of compliance. Reduce costs by paying only for the capacity you need, choosing from a range of scalable, high-performance models. Get off-the-shelf support for all major payment applications. With cryptographic functionality and management features that meet or exceed the card application and security audit requirements of other major international card schemes, payShield 9000 enables Marqeta to gain the trust of key players throughout the payment industry. With security provided by Thales HSMs, Marqeta today is the platform for payment innovation. The company has expanded the platform going beyond multi-merchant commerce capabilities to enable a host of dynamic spend controls and advanced processing capabilities. The platform is powering a number of popular card solutions for some of the world’s largest brands and retailers. About the solution Designed specifically for payments applications, payShield 9000 from Thales eSecurity is a proven hardware security module (HSM) that performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. payShield 9000 is the most widely deployed payment HSM in the world, used in an estimated 80% of all payment card transactions. The payShield 9000 design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The payShield 9000 device is deployed as an external peripheral for mainframes and servers running card issuing and payment processing software applications for the electronic payments industry—delivering high assurance protection for Automated Teller Machine (ATM) and Point of Sale (POS) credit and debit card transactions. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, UnionPay, and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

How An Innovative Leader In mPOS Solutions Ensures That Cardholder Data And PINs Are Protected At All Times The Challenge: Card Acceptance Needs To Be Simple, Secure And Available Anywhere With the decline of cash payments, merchants of all sizes are increasingly looking for a flexible, cost effective and secure payments solution to accept EFTPOS (electronic funds transfer at point of sale) and credit card transactions on the go. It is no longer just the established bank acquirers and third party processors that want to offer card-based payment solutions to merchants, with telcos and other service providers looking to integrate card payments into their solutions or expand their current offerings. Together with the increasing desire for integrators to develop payment functions into their mobile apps, a solution supporting secure card acceptance without the traditional merchant POS device installation, configuration and security audit complexity is urgently needed. The Solution: Flexibility and Security Powered by Thales HSMs In order to address these issues, Mint Payments chose Thales hardware security modules (HSMs) to provide high assurance encryption and key management functionality as an integral part of their PCI DSS compliant data center. Mint’s mobile card acceptance solution uses a small portable card reader that connects via Bluetooth to a merchant-owned smartphone or tablet. The device is magnetic stripe, EMV Chip and contactless enabled, allowing the merchant to accept “customer present” payments securely. Tight control of the remotely initiated key injection process for card reader activation, encryption of the payment data at the point of capture and the use of hardware security modules (HSMs) at the payment platform level, enables mPOS solution providers like Mint to attain PCI DSS compliance and delivers a clear win for all participants in the value chain. Thales payShield 9000 hardware security modules (HSMs) are used in the Mint infrastructure for a variety of purposes, including: Generating keys for the card readers Decrypting card data PIN block translation at the payment platform prior to sending the transaction into the acquirer network for authorization How Mint and Thales deliver the win-win for corporates and merchants The Mint Solution for mPOS using Thales HSMs is Comprised of Three Main Product Offerings: Minterprise: a branded mobile payments platform for enterprises and banks, customizable to their needs Mintegrate: a program supporting a set of SDKs and APIs that allow developers to seamlessly integrate payments into third- party software while leveraging Mint’s PCI capabilities Mint mPOS: a solution comprising a mobile app and card reader combination that allows merchants of all sizes to accept contactless, chip and PIN-based card payments securely, anytime and anywhere. Mint offers a complete and modular solution for mobile card acceptance, enabling many players in the value chain to leverage its proven bank grade payments infrastructure rather than having to invest in their own. All components of the solution meet relevant PCI, EMV and card scheme standards and certifications, provide simple integration and enable live deployments within weeks rather than months. The combined Mint Payments and Thales solution expands card acceptance in a flexible and secure way, delivering clear benefits for the various adopters. Minterprise (for Enterprises): Accepts a wide range of global/regional/national credit and debit card brands using smartphones and tablets supporting iOS and Android Utilizes the bank grade security infrastructure hosted by Mint, eliminating the need for banks, telcos and service providers to create their own in-house PCI DSS compliant mPOS payment gateway Offers white label, custom branded or integrated solutions generating strong brand awareness and tight integration where necessary Mint mPOS (For Merchants): Enables merchants to offer secure mobile card acceptance to customers as an alternative to cash Eliminates clear text payment data from the merchant environment (and hence PCI DSS compliance overhead) through the use of point-to-point encryption (P2PE) Benefits from an easy, quick on-boarding process as well as simple pricing options About the Solution Thales PayShield 9000: proven, Scalable Payment System Security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM’s design benefits from over 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

How an Innovative Start-up Leveraged Thales Payment Security Expertise To Bring Mobile Card Acceptance To The Middle East Region For The First Time The challenge: Increasing Card Acceptance In Countries Where Cash Is King The United Arab Emirates (UAE) is a highly developed market in terms of IT infrastructure as well as internet and smartphone penetration and yet, surprisingly, has a relatively low penetration level of card payments. The card acceptance network only caters to established businesses and there is a huge potential to penetrate the previously untapped SME market as well as the home delivery sector. With Dubai hosting Expo 2020 (the next World Fair), the UAE government is driving an initiative towards a cashless society with the adoption of innovative and more flexible card-based payment methods. The scheme is endorsed by the major card brands active in the region, namely American Express, MasterCard and Visa, and is planned to cover all types of contact and contactless cards. Swiftch, a nimble start-up company, saw an opportunity to be a part of this cashless society by providing innovative, simple and secure card-based acceptance solutions to all levels of merchants and acquirers. The biggest challenge was to choose an industry leading partner who would be able to assist in delivering a flexible, secure and scalable hardware infrastructure, compliant with the stringent Payment Card Industry Data Security Standard (PCI DSS) security requirements. The Solution: A Secure And Flexible Mobile Payment Gateway Solution Secured By Thales HSMs Swiftch knew that mobile connectivity would play a major role in their offering – traditional fixed point-of-sale (POS) terminals would not be suitable to address the large market opportunity to take card payments on the move, especially in places like restaurants, street markets or when making home deliveries. This led to the choice of mobile card readers linked to standard smartphones or tablets running an application that Swiftch designed and now maintains. Merchants of all sizes, especially small merchants (accepting card payments for the first time and who are difficult for large bank acquirers to reach) could now be approached directly by the Swiftch sales team in the field, facilitating secure, low cost and efficient on boarding. Thales HSMs enabled Swiftch to fast track their payment gateway solution, leveraging existing proven HSM hardware that supports the end-to-end encryption of payment data and enables a secure payment processing interface to the various bank switches through which Swiftch routes their transactions. Aditya Anand, Chief Executive Officer at Swiftch says: “Taking card payments on the move, especially in places like street markets, restaurants or when making home deliveries has always been a challenge. Our mPOS solution enables affordable on-the-go payments for merchants of any size or where home delivery drivers require payment on delivery. Hardware solutions are pivotal in making security viable in mobile environments and Thales was an obvious for choice for us, offering a best in class solution with wider support and recognition in the payments market than any other provider.” About The Solution Thales payShield 9000: Proven, Scalable Payment System Security Designed specifically for payments applications, payShield 9000 performs tasks such as PIN protection and validation, transaction processing, payment card issuance, and key management. Used in an estimated 80% of all payment card transactions, payShield 9000 is the most widely deployed payment HSM in the world. The HSM design benefits from more than 25 years of Thales experience with payment system security, giving organizations confidence in a state-of-the-art solution that delivers an ideal combination of security and operational ease. The cryptographic functionality and management features of payShield 9000 meet or exceed the card application and security audit requirements of the major international card schemes, including American Express, Discover, JCB, MasterCard, Union Pay and Visa. payShield 9000 is certified to FIPS 140-2 level 3 and is also available in configurations certified to the PCI HSM specification as published by the PCI Security Standards Council.

Challenge Is concerned about protecting the following types of information: Financial data Credit Card information Credentials Require data protection during the following circumstances: Database security Unstructured data security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure personal information Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Uses the following SIEM solutions to identify possible internal threats or APTs: McAfee Nitro Security Splunk Results Purchased Vormetric Data Security for the following reasons: Current compliance measures are inadequate when it comes to safeguarding the business Rates the likelihood of recommending Thales eSecurity as 9 out of 10.

As one of North America’s premier drug store chains this company handles large amounts of sensitive personal and business-related information. One factor in the impressive longevity and growth of the organization is the encouragement of continual innovation to create new products and services that benefit the organization’s large customer base: These include online prescription refills, web and phone-based medical advice hotlines, and a wide range of health and wellness programs. Business Challenge With many hundreds of retail locations and a large headquarters presence, maintaining rigorous standards for the protection of data is a constant priority. The nature of the company’s business involves many different types of data – from patient records to financial information and intellectual property – each falling under the directives of a variety of governmental and industry requirements. Maintaining compliance – either voluntarily or under regulatory mandate – requires that a number of security measures be in place at all times. A critical element of the company’s multi-layered defense strategy involves the use of encryption to encode sensitive data; in order to ensure that the infrastructure continues to be populated by best-in- class products, it was determined that a new encryption solution should be identified, tested, and implemented. Technical Challenge To support the pharmacy chain’s constant release of new capabilities for its employees and customers, it was imperative that the IT infrastructure – and all its constituent components – be commensurately flexible and scalable. Reflecting the diversity of data under its control, the company placed an emphasis on being able to choose if individual files needed to be encrypted or not: Not every file needs securing, so the ability to accurately differentiate between candidates became a key selection criterion in the search for a suitable encryption solution. Solution Following a period of investigation the short list of viable contenders was narrowed down to one solution: Vormetric Transparent Encryption. The company’s director of network and security recalled, “We had an exhaustive list of evaluation metrics and used these to uncover that Vormetric was clearly the best solution for us.” A proof of concept was undertaken to verify performance in the organization’s own environment: “We subjected the Vormetric solution to a wide range of challenges – including regression testing – and it performed admirably,” the director noted. “We were able to confirm that it really was the most flexible option out of everything we’d reviewed and had the ability to execute across all the different scenarios we threw at it.” Once the decision to proceed had been made, a pilot involving 10 stores was conducted to validate the implementation procedures. Following the successful completion of the trial, the remaining stores were deployed in batches of 40-50 each week. The security expert extolled, “We were able to do the full rollout from a central location: Saving us considerable time and money when compared with the alternative of visiting each one of the many hundreds of sites.” Results Implementation of Vormetric Transparent Encryption ensures that sensitive information is never exposed, irrespective of its state, location, or format. “Vormetric now protects everything we need encrypting, including data at rest; making it ideal against any network-sourced malware attacks that do manage to evade our other measures,” the director commented. He continued, “The inherent flexibility of the Vormetric architecture makes it ideal to support our current operational model but equally important, we don’t have to worry about encryption-related issues restricting any of the new capabilities we want to implement in the future. “Vormetric is totally application transparent and the ability to protect data is not impacted by modifications to key infrastructure components, like changes to our database platform.” To keep business running smoothly in its hundreds of branch locations, the company has an in-field service unit replacement policy that includes swapping out disk drives as a resolution for hardware and software problems. The use of Vormetric encryption ensures that even when physically removed from the stores, the contents of every drive continue to be secure. Performance And Protection Vormetric Key Management’s extremely granular level of control gives the security team the capability to precisely specify which users are permitted access to individual data elements across the network. “Despite the dramatically enhanced levels of protection and control, performance has been outstanding. Prior to the proof of concept we did have some concerns about the ability of certain of our legacy infrastructure products to support the new functionality but we’ve had zero negative feedback from any users,” remarked the company’s director of network and security. He summarized, “Encryption is a critical component in our security strategy but it also needs to function in a way that doesn’t impose limitations on where we want to take the business. Vormetric gives us the protection, the flexibility, and performance – all with the right cost of ownership – to make it a compelling addition to our environment.”

Challenges Is concerned about protecting the following types of information: Financial data Credit Card information Mission-critical text, voice, and video information Customer personally identifiable information (PII) Require data protection during the following circumstances: Database security Unstructured data security Intellectual property Data segregation Contractual requirements (either with a customer or for suppliers) Legacy application security Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Help meet requirements 3, 7 and 10 of the Payment Card Industry Data Security Standard (PCI DSS) that call for the protection of cardholder information Secure personal information Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Uses Vormetric Data Security to achieve the following: Tightly monitor exposure, and implement transparent controls that do not impact how employees perform their jobs Leverage alerts that trigger red flags when users are performing actions outside of the behavioral norm Engage in ongoing monitoring and reporting Establish an appropriate separation of duties between IT operations and IT security Uses the following SIEM solutions to identify possible internal threats or APTs: HP Arcsight Symantec Security Information IBM TSIEM Solutionary Results Prevents the following insiders from accessing protected data with Thales eSecurity: System administrators Domain administrators Network administrators Database administrators UNIX/LINUX root users Security administrators Federal contractors and outsourcing Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Current compliance measures are inadequate when it comes to safeguarding the business A data-centric strategy locks down the data, and removes risk from privileged users Thales eSecurity sets controls around the data and examines controls from the inside out Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Challenges Is concerned about protecting the following types of information: Financial data Customer PII Require data protection during the following circumstances: Database security Contractual requirements (either with a customer or for suppliers) archive data at rest (on tape) Use Case Applies Vormetric Data Security to adhere to global compliance regimes in the following ways: Provide safe harbor and helps businesses avoid the cost and brand damage that comes with breach notification Meet national data protection laws that mandate encrypting citizen personal information including UK Data Protection Act, EU Data Protection Directive and South Korea’s Personal Information Protection Act Provide security, access control and reporting so enterprises can demonstrate effective controls over sensitive information mandated by Sarbanes-Oxley, GLBA, and Basel III Meet NIST SP 800-53 Guidelines Uses Vormetric Data Security to achieve the following: Lock down their data with encryption, strong key management, and security intelligence Create strict access policies that ensure only authorized users can access sensitive information Reduce the attack surface against sophisticated Cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks Protect cloud deployments securely Meet ISO 27001 requirements Uses the following SIEM solutions to identify possible internal threats or APTs: Splunk Symantec Security Information Websense Results Purchased Vormetric Data Security for the following reasons: Network-centric and perimeter security do not protect sensitive data Data is the main target for APTs and server data is the biggest target Data-centric security mitigates risk and reduces the attack surface for APTs Rates the likelihood of recommending Thales eSecurity as 10 out of 10.

Houston, Texas-based Empyrean is an advanced human resources technology and service company focused on administration of employee benefits for corporations of all sizes. It currently oversees the benefits packages of more than 90 organizations, managing over one million individuals. Rick Miller, vice president of information technology for Empyrean Benefit Solutions, Inc., explained, “We provide services and software to administer benefits programs, including self-service websites for administrators and staff. We deliver a fully custom .NET structure, via our Web portal, that streamlines the required infrastructure and improves efficiencies through use of a common database.” Business Challenge “To accomplish economies of scale for our clients, each database is logically partitioned but they all reside on the same pool of hardware,” commented Miller. “A recent prospective customer shared that they had experienced a data breach prior to talking to us and this resulted in them mandating that all of their sensitive information be encrypted, irrespective of location. “Originally we would only encrypt back-up copies of our databases before they were shipped to our offsite storage facility; we didn’t have the data encrypted within our data center, which we knew would be a problem for this new client.” Technical Challenge Empyrean handles massive amounts of sensitive employee data every day and while its customers need robust levels of security, there are some complicated considerations. “Our clients understandably want to know about our security procedures, such as how their data is destroyed if they should retire from using our services. But because the storage process didn’t differentiate between individual clients, it wasn’t feasible for us to go to the back-up media and erase a specific part of it,” noted Miller. Solution The company wanted to have a security solution that would set it apart from the competition and that would be sufficiently flexible to scale with client growth and accommodate individual customer needs. Miller recalled his search for the right solution, “Our original desktop encryption product turned out not to be recommended for SQL servers and it lacked the necessary key management capabilities. We also looked at a native SQL server encryption product, but this compromised our flexibility and actually required platform changes that we just didn’t have time for. “We knew we needed an enterprise-class solution, so started researching alternative options; the Thales eSecurity solutions really stood out. The ability to execute data at rest encryption, very straightforward key management and negligible impact on performance really differentiated it from the competition. We undertook a month long proof of concept and, very importantly, demonstrated that Vormetric Transparent Data Encryption gave us the ability to place private keys on specific information and be able to pin-point that data within the back-ups, which was critical for meeting our clients’ data destruction requirements.” The deployment of Vormetric Transparent Data Encryption proved to be seamless and had minimal impact on Empyrean’s clients. “We installed it across our whole environment, giving us the ability to fully leverage the sophisticated key management capabilities and to perform targeted data destruction, if needed,” recounted Miller. “The Thales eSecurity consultants’ performance was excellent and they were always able to give us answers whenever we had any questions.” Results Integrating the capabilities of Vormetric Transparent Data Encryption into its offerings is giving Empyrean tangible competitive advantage. Miller stated, “Across the board we’re seeing demand for far more rigorous search and procurement processes; having Vormetric Transparent Data Encryption enables Empyrean to demonstrate its commitment to protecting the integrity of all of our clients’ data and that we really understand their requirements.” Miller likes the partnership that Empyrean has formed with Thales eSecurity. He noted, “The experience I’ve had has exceeded expectations; I work with a lot of technology companies and implementing the Thales eSecurity solution has been remarkably smooth. It has quickly proved to be a very stable solution in our environment. I’m extremely happy.” There are many powerful aspects of the Thales eSecurity architecture: “The scalability of the solution means that there are no restrictions on how far or how fast Empyrean can grow. The data-centric strategy gives us the control and granularity our clients are demanding. And Thales eSecurity’s capabilities to handle data located in physical, virtual or cloud environments provide us with great flexibility. We’re confident that we can accommodate the data security requirements of even our most creative customers!” asserted Miller.

Founded in 1975, CHS is the industry’s largest independent provider of workforce health care solutions. The company offers onsite health and wellness services to Fortune 500 firms who prefer to self-insure their employees by taking on the capital liability of providing coverage. Clients depend on CHS for health and productivity management solutions including onsite primary care, health coaching, occupational health, and pharmacy services. Business Challenge CHS typically maintains information on all the employees who are eligible to participate in health care benefits for each of its clients. This results in dealing with substantial amounts of highly sensitive personal data, including health records, clinical information, and examination results. The nature of the data means that CHS must meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA). Joseph Johnson, chief information security officer for CHS, commented, “Frequently HIPAA is the primary compliance driver for how we manage client data but there is a possibility that we have to handle payment information, so conforming to the Payment Card Industry Data Security Standard (PCI DSS) also became a priority for us.” Technical Challenge CHS looked for solutions to be compliant with these standards. Johnson recalled, “The requirements around the ‘meaningful use’ of information are pushing more medical organizations into using electronic health records (EHR) which is very positive but it does present a variety of security challenges. Many current EHR applications don’t lend themselves very well to easily securing data, especially the encryption of data at rest. “We evaluated native SQL TDE encryption solutions but they ended up being extremely costly and actually offered very little in return. On top of this, certain EHR solution vendors don’t directly support encryption.” He continued, “We investigated other solutions that ultimately weren’t viable because of their need for unrestricted access into the core of our applications. So we found ourselves in a bind: The solutions were either too expensive and didn’t even meet the requirements or they were incapable of interacting with our closed source application environment. Even if we did decide on a workable encryption product, it looked like we would have to deploy a completely separate solution to handle key management, or add full time employees just for the keys and certificate exchanges.” Solution “We were very excited when we discovered the Thales eSecurity solution; by performing data-level encryption it completely avoided the need to modify the application in any way, and this alone was a big win as we did not need to involve our development or applications support teams,” stated Johnson. “Not only could it handle all of our encryption needs but it could seamlessly perform key management. The Thales eSecurity solution also gave us the ability to effectively implement role-based encryption; this was really important because some of our environments are multi-tenant and our clients are obviously very serious about data segregation. Being able to offer this level of granularity and sophistication was a really powerful driver in our decision to purchase Thales eSecurity’s solutions.” The CHS team conducted a proof-of-concept to validate expectations across all of the organization’s stakeholders. “There were absolutely no problems whatsoever and everyone quickly gave their approval to move to production,” recounted Johnson. “Once we’d done this, the impact on performance of implementing encryption across the live environment was exactly as promised; virtually imperceptible.” Results “EHR environments are not built with very strong access management capabilities. They just weren’t designed to accommodate the different roles of practitioners and explicitly control who can get to specific records. With the Thales eSecurity solution we can see exactly who is trying to view sensitive data and this has enabled us to implement very effective role-based access controls throughout our environments. We’ve been able to mitigate the data leakage issues that have traditionally plagued the healthcare industry,” noted Johnson. The ease of deploying and managing the Thales eSecurity solutions were appreciated by Johnson. He stated, “After the purchase decision is made, I think a lot of organizations overlook the level of effort and cost that goes into implementing and maintaining security in their own environment. Thales’ ability to so efficiently provide this level of sophistication takes away all those concerns about both initial and ongoing resource requirements.” He concluded, “One of the biggest fears of my peers is that they know they have to solve the issue of encrypting data but are afraid of investing in a solution that never becomes fully operational. The approach that Thales has taken with streamlining both encryption and key management has removed this concern for CHS. We have an unwavering commitment to security and protecting the integrity of our data: Thales eSecurity helps us to deliver exactly what is required.”

Best known for brands such as Frosted Flakes, Rice Krispies, Special K, Cocoa Krispies, Pringles, Pop-Tarts, Cheez-It, Eggos, Kashi, and Nutri-Grain; Battle Creek, Michigan-based Kellogg Company (Kellogg’s) is a food manufacturing giant with production facilities in 18 of the 90+ countries in which it conducts business. Business Challenge Kellogg’s views technology as a key enabler in marketing, selling, and manufacturing its brands, loved by consumers around the world: It relies on best-in-class IT security solutions to keep its infrastructure and digital assets protected. Recognizing the significant importance of encryption for security and compliance, Raghbir Sandhu, chief security architect for Kellogg’s, revealed, “It is mission-critical to the company to protect our employee and customer data from cyber attacks. Implementing formal data governance principles helps us to ensure data – especially any personally identifiable information (PII) – is secure and complies with all appropriate privacy regulations in the countries in which we operate.” Technical Challenge Many encryption solutions encode data in motion but not while it is archived. Kellogg’s sought a more comprehensive solution that would encompass both states. Sandhu reflected, “The first priority was encrypting flat files and data at rest: We wanted to make sure that even if our back up tapes were stolen, our data would be safe. “The second piece of our encryption puzzle was access control. At the operating system level we needed to ensure we could clearly delineate between roles. For example, while local administrators are responsible for maintaining the systems, they should not be allowed to have access to confidential data.” Solution “We looked at disk, network, application, and file-level encryption solutions,” recounted Sandhu. “We investigated many different characteristics; including using support and maintenance expenditures to determine an accurate total cost of ownership for each solution. “Based on its successes in our evaluations we narrowed the list of candidates down to a single winner: Vormetric. We then conducted a proof of concept (POC) to ensure that system performance would not be impacted by the encoding/decoding process. The POC confirmed that we could be confident in entrusting our encryption requirements to Vormetric Data Security Manager.” The company found implementation to be quick and simple. “We started with a North American rollout, expanded to Europe, and now are implementing in Asia Pacific,” Sandhu shared. “It is easy, efficient, and flexible. Best of all, to the users it is 100 percent transparent.” Results Kellogg’s relies on an SAP ERP environment for running its worldwide operations and Sandhu was reassured that despite the sophisticated level of protection, Vormetric enabled business to continue as usual. He noted, “Other encryption solutions we considered for the SAP data would have required changes to the schema, which in turn would have violated our SAP agreement. However, Vormetric enables us to maintain the original structure while also protecting the integrity of the database.” The company is now able to encrypt all of its information, including data at rest and in the cloud. Sandhu stated, “Our internal audit team has endorsed the measures we are using to protect our data – including encryption of log files – and we are completely PII compliant. “We have a data warehouse where we store a significant amount of confidential information and it is all protected by Vormetric.” Kellogg’s system administrators are able to manipulate files without having access to the contents. Sandhu commented, “With Vormetric Key Management the encryption keys are well managed and secure. We can provide access controls based on a need-to-know basis; this granularity gives us a much better safeguard on confidential data.” Vormetric Delivers Vormetric Data Security Manager satisfied everyone’s criteria for the ideal encryption solution; Sandhu concluded, “The database administrators wanted a solution that could integrate seamlessly with SAP; the application developers needed flexibility across file types and operating systems; the security team insisted on robust separation of roles capability and encryption of data at rest; and accounting wanted optimal total cost of ownership! At the end of the day, we all agree that Vormetric is the ideal encryption solution: It is impressing us all.”

Delta Dental of Missouri – a member of the nation’s leading dental benefits organization, Delta Dental Plans Association –offers dental and vision benefits in the states of Missouri and South Carolina. It is the carrier of choice for over 2,000 companies and has more than 1.5 million members.The company places a strong focus on prevention and evidence-based oral health quality measures, which has earned it the participation of 96 percent of all practicing dentists in Missouri. Business Challenge Delta Dental of Missouri stores many terabytes of information in its claims system – member demographics and eligibility, claims, provider information, contracts, payment information, notices of benefits, statements, etc. – approaching “big data” classification. Bound by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) standards for electronic health care transactions, all data must be encrypted both while in transit and at rest. Karl Mudra, Delta Dental of Missouri’s CIO, stated, “One of our corporate values is to be good stewards of the data we care for on behalf of patients, providers and the groups we serve. In our view, it was a sound practice – irrespective of the HIPAA mandates – to find a best-in-class security solution. With data encryption, I believe it’s essential to be prepared ahead of time, instead of trying to react after there’s been a data breach.” Technical Challenge Database-level encryption proved challenging: “When we first started looking, not all of the alternatives to encrypt our SQL data were viable,” recalled Mudra. “Because of our database version, many of the products necessitated rewriting our whole application, changing user-level processes and procedures, creating new reporting routines, and making modifications to our production and back-up environments.” Mudra had additional criteria for any viable encryption technology. He noted, “We wanted a policy-based encryption solution, so we could grant permissions at both the user and/or application levels according to pre-defined rules, similar to how most firewall products are configured. We also needed comprehensive key management, centralized administration, and the ability to leverage the solution across both the production and disaster recovery environments. Finally, the option we selected had to be invisible to our users, with zero impact on productivity.” Solution After rejecting multiple vendors, Mudra’s team brought in Thales eSecurity to demonstrate the Vormetric Data Security Platform. “We were very impressed,” he recalled. “The Thales eSecurity Platform gave us the policy-based approach we needed, and it didn’t matter if we were running Microsoft Windows® or Linux, handling files or folders, storing data in a SQL database or dealing with a storage area network. The data-centric approach took care of all our issues and didn’t require users to do anything different, which was a huge positive for us.” Delta Dental of Missouri has a lean IT infrastructure team, and one of Mudra’s concerns was the burden of an overly demanding installation process. The staff spent about half a day doing pre-installation planning and opted to deploy file-level encryption. A Thales eSecurity consultant was engaged for two days to train the team onsite, while completing encryption of the development environment. Installation was staged over three weekends, and the team was able to handle the last two installations without assistance. Mudra observed, “You define everything and set it up, and it does what you need without any headache. As always, we planned for the worst, but this time got the best. It was one of the easiest implementations from decision to production that I’ve experienced. I expected a painful install; thank goodness it was painless.” Results After originally struggling to find a solution to support HIPAA compliance, Mudra has been pleased with Thales eSecurity’s healthcare solutions. He commented; “The encryption overhead is pretty close to zero. Backup windows increased a little, however as that isn’t part of the user experience, it’s a good tradeoff for the protection. Most importantly, our users have no idea that each data request is coming and going to an encrypted source. My team is impressed with how self-sufficient the Thales eSecurity appliances are: If we ever need to take one offline, we have automatic failover to the other. The management of those devices is very straight forward too, as the appliances handle the majority of activities for us. The Vormetric Data Security Platform has supported everything we’ve wanted it to do. We’re all very happy with the choice.” Thales eSecurity’s Healthcare Solutions Make Encryption Easy Mudra concluded, “For us, the protection we now have is definitely worth the investment. By comparison, a single fine for failing to be HIPAA compliant would be much greater per occurrence than our total investment to date. With the Thales eSecurity platform, it’s so nice to be able to set-it-and-forget-it and be assured of our compliance. It’s perfect for us because it is platform agnostic, so I have no worries that as our infrastructure evolves, it will scale with us.” Thales eSecurity’s Simple Sophistication Business Need Comply with HIPAA Ensure security of clients’ data Technology Need Platform agnostic Rules based Minimize installation and operational overhead Transparent encryption for users Fail-over and fail-back to support replication Solution Healthcare Solutions from Thales eSecurity Vormetric Transparent Data Encryption Vormetric Data Security Manager Result Full rules-based security as well as HIPAA compliance Imperceptible to users Simple install with no infrastructure changes needed Supports high-availability functions About Thales eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

The St. Marianna Association is a network of hospitals and a medical school in the greater Tokyo area. Founded shortly after World War II, it pioneered treatment for displaced civilians and soldiers with post traumatic stress disorder. Today, the association is focused on evolving its capabilities and competencies to serve the health and wellness needs of its surrounding communities. BUSINESS CHALLENGE After the Japan Pension Service was breached in 2015, and 1.2 million people’s personal data was exposed, the country founded the National Center of Incident Readiness and Strategy for Cybersecurity (NISC). This organization spearheaded an initiative to protect Japan’s critical infrastructure – including hospitals – from cyber attacks by deploying the most advanced technologies, including encryption. From the outset it was St.Marianna’s goal to meet and surpass the NISC guidelines. The association needed encryption to secure critical data across a diverse number of discrete environments. Mr. Hosi Akaoi, St. Marianna’s chairman of the Board of Directors explained, “In the past, Japan’s medical service infrastructure has been slow to grow and strained when ramping up for natural disasters. Furthermore cyber security has lagged behind the standards implemented in Europe and the United States. It is time to expand our medical system while simultaneously improving protection for the medical information of the individuals we serve.” TECHNICAL CHALLENGE The healthcare association wanted an encryption solution that could enhance its multi-layered security architecture. Mr. Shinji Kumagai, director of the Social Systems Department reflected, “We sought to safeguard critical data at its lowest level, rendering it unintelligible even if stolen. Because of the way our applications are architected, server-level encryption was a top priority for us.” At the same time, St. Marianna needed to maintain the user experience for patients and staff with no degradation in performance. SOLUTION After assessing multiple encryption solutions, St. Marianna’s investigations culminated in the selection of Vormetric Data Security Manager and Vormetric Transparent Encryption from Thale eSecurity. The association first implemented the encryption solution in its flagship location, Megumi Hospital, Tokyo. Vormetric Transparent Encryption was deployed across all of the hospital’s file servers and the rollout proved to be exceptionally easy. Akaoi noted, “While our multi-layered network security is our main protection, now encryption forms our last line of defense. “Expansion of the scope of file encryption is proving to be effortless; the Vormetric agent is simply copied onto each server without making any changes to the system being encrypted.” RESULTS A key objective of NISC was to safeguard all critical infrastructure against cyber attacks by the 2020 Olympic Games. With the implementation of Thales eSecurity’s powerful and scalable encryption solution, St. Marianna is enjoying being ahead of that goal. The efficiency of Vormetric Data Security Manager results in end users being unaware that all the files are encrypted. Even if threat actors were to breach the St. Marianna network and access sensitive, personal information, the data is protected and the criminal would only find meaningless character strings. ENABLING A NEW PARADIGM IN HEALTHCARE COLLABORATION In Japan, an association in the healthcare sector must share data with more small-and medium-sized organizations than in any other critical infrastructure industry. After deploying the Vormetric Solution, St. Marianna achieved regulatory compliance and is enjoying the new era of security and cooperation. Kumagai concluded, “As we continue to broaden the scope of our network – and number of endpoints – we need a multi-layered security architecture that can expand with us: The powerful solutions and tools from Thales eSecurity have proven to be more than capable of scaling to meet our needs. Together, St. Marianna and Thales eSecurity demonstrate a best-in-class approach for other institutions to emulate.” LEADING THE WAY WITH A NEW ERA IN SECURITY STANDARDS Business Need: Comply with new government regulations ahead of the 2020 Olympic Games Encrypt critical data across the entire network to enable future expansion Technology Need: Enhance the security architecture by protecting data, even in the event of a breach Implement encryption while maintaining system performance for the users Thales eSecurity Solutions: Vormetric Data Security Manager Vormetric Transparent Encryption Results: Complied with critical infrastructure security regulations well ahead of the 2020 Olympic Games Deployed encryption without affecting user experience Ushered in a new era of data and security cooperation across the association Capable of supporting steady growth ABOUT THALES eSecurity Thales eSecurity is the leader in advanced data security solutions and services that deliver trust wherever information is created, shared or stored. We ensure that the data belonging to companies and government entities is both secure and trusted in any environment – on-premise, in the cloud, in data centers or big data environments – without sacrificing business agility. Security doesn’t just reduce risk, it’s an enabler of the digital initiatives that now permeate our daily lives – digital money, e-identities, healthcare, connected cars and with the internet of things (IoT) even household devices. Thales provides everything an organization needs to protect and manage its data, identities and intellectual property and meet regulatory compliance – through encryption, advanced key management, tokenization, privileged user control and high assurance solutions. Security professionals around the globe rely on Thales to confidently accelerate their organization’s digital transformation. Thales eSecurity is part of Thales Group.

Founded in 1998, TAB Bank was originally started by parent company, Flying J, Inc. – now FJ Management, Inc. – to serve the financial needs of the $300B US and Canadian trucking industry. It quickly built one of the largest portfolios of trucking relationships and became the leader in transportation-related financing, currently with over $670M in assets and $20M net revenue. TAB Bank has subsequently expanded into other commercial industries by providing a wide range of working capital facilities, equipment financing and deposit products. Business Challenge TAB Bank desired Payment Card Industry Data Security Standard (PCI DSS) compliance because this certification is an important component for banks. Daryl Belfry, Director of IT for TAB Bank, stated, “PCI DSS requires that all stored cardholder data is encrypted, irrespective of the file type or location. We understood why this is so important but were concerned that it could negatively impact the performance of our whole infrastructure.” Technical Challenge He continued, “We knew that the encryption solution we ultimately selected had to allow us to manage access policies via a simple and intuitive front end. We needed to precisely control how users could access data – such as selectively limiting the copying of files to a removable USB device or local hard drive – as well as being able to implement explicit system policies like encrypting specific archived data.” Solution Belfry and his staff investigated a number of encryption solutions. “We felt that the user interface and policy management capabilities of the Vormetric solution were a lot better than the competition,” noted Belfry. “We liked the simplicity of the Thales approach and the manageability from an administrator perspective; System Administrators can be configured to allow execution of certain functions, while a Security Officer can be granted a superset of administration access. John Hillas, TAB Bank’s Senior Systems Administrator, commented, “The majority of our environment is virtualized using VMware with a virtual desktop infrastructure (VDI) but we also have some separate SQL Server and AIX-based database servers. Thales’ coverage of a wide variety of operating systems and infrastructure configurations allowed us to protect our complete environment, making it very attractive to us.” “A demonstration of the Vormetric solution proved that it had minimal impact on infrastructure performance, and we were so impressed we decided a proof of concept would not be necessary.” Thales eSecurity provides a proven data security solution to enable rapid compliance with multiple aspects of PCI DSS. The Vormetric Data Security Platform delivers industry-leading data encryption and key management capabilities without the need to modify existing infrastructure components. High performance encryption methods ensure negligible impact on transaction throughput and a sophis-ticated Web-based management console minimizes incremental operational overhead. Vormetric Data Security Manager appliances were installed in the bank’s primary data center in Ogden, Utah and at a disaster recovery facility in Salt Lake City, Utah. “We had a Thales consultant booked for three days onsite,” recalled Hillas, “but after the first day we had already achieved everything we needed! The whole implementation process was far more intuitive than we had anticipated.” Results The decision was made to keep all data, including backups, encrypted by the Vormetric solution even though the tape archival system provided its own encryption mechanism. Hillas reflected, “We explicitly configured which programs are permitted to decrypt data, so in order to facilitate controlled access to tape-based archive files we needed to know what executable code our backup system software was utilizing.” Log files generated from the Vormetric “learn” mode enabled the capture and identification of the specific application modules that would be granted permission to perform the decryption. “We love the learn mode capability,” enthused Belfry. “It logs user interactions so administrators see how data is being accessed and can then configure our data access policies to take these patterns into consideration.” Hillas added, “It’s so easy to implement the right policies from the outset.” Exceeding Expectations “The Vormetric solution provides us with all the encryption capabilities we needed to attain PCI DSS compliance,” summarized Belfry. “Since going live we’ve experienced no impact on systems’ performance. The Vormetric appliances work as described and more, and we are delighted with the solution.”

Long known for being a pioneer in medical devices, today BD (Becton, Dickinson and Company) is a publicly traded company that manufactures and sells a wide range of medical devices, instrument systems and reagents. Founded in 1897 and headquartered in Franklin Lakes, New Jersey, it employs associates in more than 50 countries worldwide and is divided into segments: BD Medical and BD Life Sciences. When BD wanted to enable quicker decision making and improve the agility of its business in a highly competitive marketplace, the company consolidated its operations onto a US-based single global instance of SAP with an Oracle database. The company transferred and consolidated data from multiple countries that required strict adherence to many regulations covering data control and security. Business Challenge Damian McDonald, vice president of Global Information Security for BD recalled, “The security solution had to be transparent, meet our encryption requirements, and also support advanced logging and monitoring. Because this was a global consolidation, we also had to fulfill all of the data privacy and security requirements for each region in which we do business.” Technical Challenge Controlling access to data was a critical component of the consolidated environment. “We’re always very concerned about the possibility of intellectual property theft. And because we outsource some of our support, we knew we needed the flexibility to give approved third-party providers operating system- and file subsystem-level privileges, but simultaneously restrict access to the core data,” stated McDonald. Solution The Vormetric Data Security Platform from Thales eSecurity was selected because it works at the operating system level and is transparent to the application, which was critical to McDonald and staff because SAP does not support any changes to the database. “Our requirements for file level access control, simple key management, as well as being able to encrypt backup tapes made the Thales eSecurity platform the perfect fit for our needs,” he reflected. “Vormetric encryption is our standard. Whenever an encryption solution is needed, the answer is always, ‘let’s start with Thales eSecurity.” He continued, “A problem that we all face in the security world is the ‘urban sprawl’ of technology. Where possible, we strive to standardize and streamline controls to reduce our management overhead. Thales eSecurity has enabled us to do that because we can use the Thales eSecurity solution across all of our environments including our service provider infrastructure for cloud services.” Results Today, BD’s single global instance of SAP is composed of more than 30 individual SAP modules running on premise as well as in the cloud on Microsoft Azure. “We’ve expanded the use of the Vormetric Data Security Platform to address a critical need in cloud security by leveraging Vormetric Key Management to maintain custody of keys, as well as managing the data,” explained McDonald. “We’ve had a lot of help from Thales eSecurity’s consultants with architecture and execution; now our IT teams have all the access and flexibility they need but not down to the data level. “Thales eSecurity has been there whenever we’ve needed help: The support is excellent. It’s a true partnership; we have very close engagement with senior leaders in Thales eSecurity and we witness their desire to see us succeed.” Encryption is No Longer a ‘Nice to Have’ McDonald observed, “Encryption is a fundamental requirement in the evolving threat scape. The new reality is that it’s virtually impossible to keep all threats out. Vormetric Encryption and other technologies like security analytics are essential elements of a properly engineered, multi-layered, defensive strategy: If a hacker eventually does succeed in getting through to the data they will also have to break the encryption in order to access the contents.” To ensure business operations remain unimpeded, the company’s IT and security organization attaches great importance to the user experience. “The challenge with typical information security groups is that when they get involved, from a user perspective, it normally equates to whole new levels of restrictions and delays,” noted McDonald. “We’re very focused on ensuring that security is as transparent as possible to minimize the impact on each user’s experience. Vormetric Transparent Encryption enables us to apply security in a way that is invisible to the end user; in fact, it’s pretty much transparent from an administrative viewpoint too.” He concluded, “The Thales eSecurity platform is a primary control against insider threats. The situation of someone hacking into the data is less of a worry because the Thales eSecurity solution’s preventative controls make a world of difference.” BD Relies on Thales eSecurity for Global Encryption Business Need: Identifying encryption solution that achieved compliance with multi-region data security mandates Deployment of a solution that can scale to support cloud services Technology Need: Ensuring IT personnel only have access to the information they need and not more Transparently encrypting a massive cloud-based single instance of SAP Solution: Thales eSecurity Encryption and Key Management Vormetric Data Security Manager Vormetric Transparent Encryption Vormetric Key Management Result: Flexible, transparent, enterprise-wide encryption with easy management of the custody of keys

Nautilus, Inc. has been a leading proponent of the worldwide fitness revolution delivering fitness solutions through its globally recognized brands that include: Bowflex®, Octane® Fitness, Nautilus®, Schwinn® and Universal®. The Vancouver, Washington-based company has always been focused on the health and wellbeing of its customers and this dedication extends to protecting the digital assets of all its stakeholders. Jon Wagner, senior manager of infrastructure and security, clarified, “It has always been our policy to treat customers as we would want to be treated. This is why we have a passion to protect all data, irrespective of source, as if it were our own. “Data integrity is of critical importance across the whole company – from my direct reports, to our IT leadership, to our executives, to our board members – the company is committed to security and data protection.” Business Challenge In part due to its involvement in direct sales operations, Nautilus has to comply with the Payment Card Industry Data Security Standard (PCI DSS) mandates, and as holder of a wide variety of other data the company also adheres to the Personally Identifiable Information (PII) security requirements. Wagner stressed, “We knew that to meet and exceed compliance with the various regulations we needed a commercial-grade encryption solution. Dealing with a lot of credit card information and handling large volumes of both PII- and PCI-related data; protecting our financial servers became a key consideration in the selection process.” Nautilus has adopted a centralized model to secure its business interests around the globe; leveraging a dedicated security team located at its Vancouver headquarters. Having discovered the administrative burden imposed by some encryption solutions, the proof of minimal overhead from a new encryption solution became another important evaluation criterion. Technical Challenge Nautilus engineers have been leading the development of innovative fitness equipment for decades and they are constantly generating a significant amount of intellectual property, any fragment of which would be a highly-prized trophy for a cyber criminal. “Protecting our archived intellectual property is a company-critical imperative for us: If it fell into the wrong hands it would have a significant negative impact on our ongoing operations,” Wagner cautioned. “And we’re designing new equipment all the time using engineering design systems, including CAD, so the ability to encrypt a diverse number of file types, in motion and at rest, also became essential requirements for us.” Solution Wagner described the selection process, “We did a lot of research and used analyst recommendations to influence our decision on selecting the optimal encryption solution. We were looking for a vendor that was well known in the industry and could meet or exceed our set of requirements. Having evaluated a lot pf proposals we then narrowed down our list of viable candidates; all of our analysis confirmed that Thales eSecurity stood out as the clear leader.” With the decision made to implement Thales’ Vormetric Data Security Manager, Wagner described another big plus, “Even though we run a lot of virtual servers, Thales’ host-based licensing scheme enabled us to really simplify the whole process.” Results Wagner recalled, “The deployment was very uneventful. When we did need guidance, the Thales team was really first rate and totally transparent in everything it did. We originally planned for a five-day implementation period but were able to get everything configured, tested and rolled out in just two. The whole project was a very positive experience.” He added, “Daily administration and key management have been very straightforward; they really have exceeded all of our expectations. “All of our credit card and customer information is safely encrypted, positioning us to be in full compliance with the applicable PCI and PII rulings. Similarly for the rest of our data, if a threat actor were somehow able to gain access to any of the servers, they would only find unintelligible, meaningless files.” Wagner noted, “Thales eSecurity has enabled us to unify our encryption strategy across all of our locations, including our engineering and manufacturing facilities in the U.S. and overseas. This encompasses data in motion and at rest, such as our archived CAD files and other forms of intellectual property.” As a long-time industry leader, Nautilus knows the benefit of partnering with a company that is not only at the head of its own field but one that is making the necessary investments to ensure that it retains its leadership. Wagner concluded, “The Vormetric solution is ideal for us today and we’re also excited about the company’s direction, and the advanced functionality that’s in the works. “I’m really proud of how our whole company is so committed to security. Our partnership with Thales eSecurity is another great example of how seriously we take this responsibility.”