Ingrian’s DataSecure puts locks in a box

Ingrian Networks' DataSecure network appliance provides centralized encryption for databases and applications, allowing DBAs to control who can view specific columns of private or sensitive data based on user and group privileges. Administrators choose from a wide range of encryption algorithms, and they flexibly determine who can view, say, Social Security or credit card numbers and who can't.

Unlike software encryption solutions for individual databases, such as Application Security's DbEncrypt, DataSecure gives you a single place to manage keys and permissions for multiple data sources, and it offloads encryption processing overhead from your application and database servers. Performance is quite good, however, there is a price to pay for DataSecure's substantial benefits: extra planning and implementation time, plus the additional appliance or two you'll want for load balancing and fail over.

Hard From the Gate

Setting up the DataSecure isn't the easiest task. Nothing in this platform is intuitive, and it takes quite a bit of reading and hand-holding from tech support to understand the idiosyncrasies of implementing the system. Some of the difficulties I experienced resulted from a poor GUI and poor documentation, whereas others had to do with strong security that may be too strong. For example, the appliance holds the administrator password and provides no way to retrieve or reset it. When I misplaced my password I had to exchange the box for another.

If you're a Microsoft shop, keep in mind that DataSecure requires Service Pack 3 for SQL Server 2000. Another caveat: SQL Server administrators cannot use a blank "sa" password, nor can you connect with any administrator account other than sa. (Ingrian says it will be removing the requirement for an sa password in the next release.) I'm fully aware of the risks of having blank sa passwords, but I've been in several shops that had no choice, because they were running third-party applications that hard-coded blank passwords into their systems. The same holds true regarding Service Pack 3. In cases where the service pack breaks an application, a company really has no choice but to remain at the previous version. No doubt shops in this predicament would welcome broader SQL Server support.

Once you get past the initial hurdles, DataSecure provides a rich range of encryption methods and role-based security that can be mapped to SQL or LDAP databases. It also nails auditing. You easily see anything that's ever been done in the system, including failed encryption attempts, configuration changes, and system reboots.

The role-based security makes it easy to assign keys to different groups, allowing these groups to encrypt and/or decrypt at the column level. You set up as many keys as you like so that every encrypted column in all your databases has a different level of encryption and its own security. I found the process of creating users and groups and assigning them to keys, a bit cumbersome. The GUI doesn't provide drop-down menus or any other shortcuts around repetitive data entry. You must type the names of all your users and groups again and again. If you're like me, you'll frequently flip back to the previous screens to make sure you've got the names exactly right.