0

I've received an email from IBM, where they feature "pervasive encryption". Would anyone know what it is?

IBM Z technology is widely known for its resiliency and security standards, which makes it the perfect platform for sensitive data hosting. With the latest IBM Z, we introduced pervasive encryption, a paradigm shift in data security.

|improve this question
  • 2
    When googleing I find quite a bit of information from IBM. Maybe you should read all that first and then ask a specific question about what you don't understand about pervasive encryption. – Wealot Nov 8 '17 at 7:42
  • I'll do, I just search here first to see if is a real new concept or just marketing hype. – Rogelio Nov 8 '17 at 7:57
4

I can promise you it's marketing ...

What I can read from their buzzword-filled infos, and some third-party sources, it means that:

Data is not only encrypted in sensitive phases of some process (eg. the TLS encryption between me and stackexchange here), but pretty much everywhere else too (eg. in the backend database of stackexchange). If it needs to be processed, it's decrypted right before processing, and encrypted again right after it.

That's all.

The two problems with that are

  • It needs more powerful computers (IBM will gladly sell their mainframes to you, which are the reason for this "pervasive" marketing anyways), and
  • the server with the database, or anything else that is doing some processing, will need the key too; and if someone can get the database then the chances of getting the key are not bad either. Of course IBM has no solution for this basic problem, that was/is the reason that no one is doing this in the first place.
    (Yes, with hardware support it doesn't have to be a (huge) problem, and it is done too, but IBM is not changing anything from the current state)
|improve this answer
  • The normal term for this is opportunistic encryption. You are right that this seems like an IBM buzzword synonym. – forest Mar 20 '18 at 4:35
2

From what google tells me at a first glance, this seems like a buzzword for "encrypt all the things!", within the IBM mainframe technology stack, in contrast to the concept that only encrypts data that is specified either in law or contract requirements and by encrypting all the things, not having to worry about what to encrypt anymore.

This may count as a paradigm shift in the closed off IBM mainframe world, but isn't all that new at all and quite a natural approach. They do however claim to do this hardware-accelerated, thus removing most of the performance costs of "encrypt all the things".

Nonetheless, I'd for now go for "marketing buzzword rather than paradigm shift".

|improve this answer
2

Whilst it is obviously a marketing buzzword, encryption at rest (as opposed to encryption in transit (TLS)) is becoming more and more common.

This is mostly caused by the move the cloud (also known as someone else's computer). Admins at a cloud provider can essentially see all of your data. You would hope that most reputable providers would have appropriate access controls in place, but you are placing your trust (and possibly legal obligations) in them, not in your own employees.

By encrypting at rest with client keys you can protect your data from even the cloud operators, which has clear benefits for both parties.

The main reason encryption at rest has not been popular previously was that key storage is difficult. Within a company's network, if a database server is compromised, then it is highly likely that the key will be compromised too, so there is little point.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.