Data Encryption

With the recent rash of data breaches in the news, I'm doing some high level research for a presentation on data protection. I know that Informix supports network data encryption, column level encryption, and requires certain permissions on $INFORMIXDIR and the chunk files. However, I'm wondering about encryption/protection on the chunk files other than OS level security. On the Oracle site, I read this: Oracle Database 11g uses authentication, authorization, and auditing mechanisms to secure data in the database, but not in the operating system data files where data is stored. To protect these data files, Oracle Database provides transparent data encryption. This feature enables you to protect sensitive data in database columns stored in operating system files by encrypting it. Then, to prevent unauthorized decryption, it stores encryption keys in a security module external to the database. Is there an equivalent to Transparent Data Encryption for Informix databases? I realize that with many of the recent data breaches, the hackers had root/admin level access to the system and encryption probably wouldn't have helped, but I'm trying to understand whether Informix dbspaces and chunks are protected at the OS level assuming someone had access to the disk, but not credentials for the database.

I have customers using Vormetric - I think it does what you are asking Cheers Paul > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Rubinstein, James > Sent: Friday, February 13, 2015 9:41 AM > To: ids@iiug.org > Subject: Data Encryption [34657] > > With the recent rash of data breaches in the news, I'm doing some high level > research for a presentation on data protection. I know that Informix supports > network data encryption, column level encryption, and requires certain > permissions on $INFORMIXDIR and the chunk files. However, I'm wondering > about > encryption/protection on the chunk files other than OS level security. On the > Oracle site, I read this: > > Oracle Database 11g uses authentication, authorization, and auditing > mechanisms to secure data in the database, but not in the operating system > data files where data is stored. To protect these data files, Oracle Database > provides transparent data encryption. This feature enables you to protect > sensitive data in database columns stored in operating system files by > encrypting it. Then, to prevent unauthorized decryption, it stores encryption > keys in a security module external to the database. > > Is there an equivalent to Transparent Data Encryption for Informix > databases? > I realize that with many of the recent data breaches, the hackers had > root/admin level access to the system and encryption probably wouldn't > have > helped, but I'm trying to understand whether Informix dbspaces and chunks > are > protected at the OS level assuming someone had access to the disk, but not > credentials for the database. > > > ********************************************************** > ********************* > Forum Note: Use "Reply" to post a response in the discussion forum.

Static or data at rest disk encryption is not part of Informix, no. You have to use a third party encryption solution like Vormetrics' or EMC's to achieve that. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Fri, Feb 13, 2015 at 10:40 AM, Rubinstein, James <JRUBIN@midwestern.edu> wrote: > With the recent rash of data breaches in the news, I'm doing some high > level > research for a presentation on data protection. I know that Informix > supports > network data encryption, column level encryption, and requires certain > permissions on $INFORMIXDIR and the chunk files. However, I'm wondering > about > encryption/protection on the chunk files other than OS level security. On > the > Oracle site, I read this: > > Oracle Database 11g uses authentication, authorization, and auditing > mechanisms to secure data in the database, but not in the operating system > data files where data is stored. To protect these data files, Oracle > Database > provides transparent data encryption. This feature enables you to protect > sensitive data in database columns stored in operating system files by > encrypting it. Then, to prevent unauthorized decryption, it stores > encryption > keys in a security module external to the database. > > Is there an equivalent to Transparent Data Encryption for Informix > databases? > I realize that with many of the recent data breaches, the hackers had > root/admin level access to the system and encryption probably wouldn't have > helped, but I'm trying to understand whether Informix dbspaces and chunks > are > protected at the OS level assuming someone had access to the disk, but not > credentials for the database. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a1133728ecd5378050efa5177

Thanks. I have read a bit about Vormetric. Just at a very high level, without something like this, how does Informix store its data in the dbspace/chunks? I'd assume it is in some proprietary format. Can anyone provide a very high level description of how Informix stores data and any risks if data is not encrypted on disk. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Paul Watson Sent: Friday, February 13, 2015 8:49 AM To: ids@iiug.org Subject: RE: Data Encryption [34658] I have customers using Vormetric - I think it does what you are asking Cheers Paul > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Rubinstein, James > Sent: Friday, February 13, 2015 9:41 AM > To: ids@iiug.org > Subject: Data Encryption [34657] > > With the recent rash of data breaches in the news, I'm doing some high level > research for a presentation on data protection. I know that Informix supports > network data encryption, column level encryption, and requires certain > permissions on $INFORMIXDIR and the chunk files. However, I'm > wondering about encryption/protection on the chunk files other than OS > level security. On the > Oracle site, I read this: > > Oracle Database 11g uses authentication, authorization, and auditing > mechanisms to secure data in the database, but not in the operating > system data files where data is stored. To protect these data files, > Oracle Database > provides transparent data encryption. This feature enables you to > protect sensitive data in database columns stored in operating system > files by encrypting it. Then, to prevent unauthorized decryption, it > stores encryption > keys in a security module external to the database. > > Is there an equivalent to Transparent Data Encryption for Informix > databases? > I realize that with many of the recent data breaches, the hackers had > root/admin level access to the system and encryption probably wouldn't > have helped, but I'm trying to understand whether Informix dbspaces > and chunks are protected at the OS level assuming someone had access > to the disk, but not credentials for the database. > > > ********************************************************** > ********************* > Forum Note: Use "Reply" to post a response in the discussion forum. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.

With care you can interpret the data on disk, an easy example is dd if=<mychunk> bs=2048 count=100 | strings Cheers Paul > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Rubinstein, James > Sent: Friday, February 13, 2015 10:03 AM > To: ids@iiug.org > Subject: RE: Data Encryption [34660] > > Thanks. I have read a bit about Vormetric. Just at a very high level, without > something like this, how does Informix store its data in the dbspace/chunks? > I'd assume it is in some proprietary format. Can anyone provide a very high > level description of how Informix stores data and any risks if data is not > encrypted on disk. > > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Paul > Watson > Sent: Friday, February 13, 2015 8:49 AM > To: ids@iiug.org > Subject: RE: Data Encryption [34658] > > I have customers using Vormetric - I think it does what you are asking > > Cheers > Paul > > > -----Original Message----- > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > > Rubinstein, James > > Sent: Friday, February 13, 2015 9:41 AM > > To: ids@iiug.org > > Subject: Data Encryption [34657] > > > > With the recent rash of data breaches in the news, I'm doing some high > level > > research for a presentation on data protection. I know that Informix > supports > > network data encryption, column level encryption, and requires certain > > permissions on $INFORMIXDIR and the chunk files. However, I'm > > wondering about encryption/protection on the chunk files other than OS > > level security. On > the > > Oracle site, I read this: > > > > Oracle Database 11g uses authentication, authorization, and auditing > > mechanisms to secure data in the database, but not in the operating > > system data files where data is stored. To protect these data files, > > Oracle > Database > > provides transparent data encryption. This feature enables you to > > protect sensitive data in database columns stored in operating system > > files by encrypting it. Then, to prevent unauthorized decryption, it > > stores > encryption > > keys in a security module external to the database. > > > > Is there an equivalent to Transparent Data Encryption for Informix > > databases? > > I realize that with many of the recent data breaches, the hackers had > > root/admin level access to the system and encryption probably wouldn't > > have helped, but I'm trying to understand whether Informix dbspaces > > and chunks are protected at the OS level assuming someone had access > > to the disk, but not credentials for the database. > > > > > > > ********************************************************** > > ********************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > ********************************************************** > ********************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > > ********************************************************** > ********************* > Forum Note: Use "Reply" to post a response in the discussion forum.

Informix's disk layout on a page level, for data pages is fairly strait forward. There are four sections of a page: - A 20 byte header at the beginning of the page with page number, next & prev pointers for pages that hold rows wider than a page, content flags, and a checksum. - A four byte trailer with a "timestamp" at the end of the page which is a sequential number used by incremental archives to determine which pages have been modified since the "timestamp" at the time of the last higher level archive. It is also used along with the checksum in the header to detect pages that were partially written during a hard crash. - A "slot table" which grows backwards from the trailing timestamp towards the header with one entry per row that is homed on the page. The entry is four bytes per row and contains the row length and location of the beginning of the row within the page. If a row was moved off of its home page because the table is variable length and the row outgrew the free space on the page, then the slot table entry for that row contains a forwarding point which is the rowid (page and slot #) for the new location of the row so that its external rowid in indexes remains unchanged. - Data in natural format. Some internal structure on disk for decimal and datetime type columns is more compact on disk than in memory and BYTE, TEXT, BLOB & CLOB, and some UDT type columns only store header information "in row" but otherwise it is the same as the memory image of the data. Data pages are gathered into extents of contiguous pages belonging to a partition (table, index, or a partition of one). The mapping of extents to partitions is stored in each partition's header page in the tablespace tablespace (an internal pseudo table that begins at the beginning of each dbspace) and since v11.70 in partition header expansion pages linked through that partition header's next pointer. What else do you want to know. Could someone read the data on disk if it is not encrypted? Yes. I have multiple times been able recovered most of the data from a crashed server whose files were too badly damaged to allow the engine to start up. Figuring out the underlying data structure without a schema is difficult but not impossible, especially if you have an idea of what data you expect to see. I did a project to recover data from a structured data file (IE a private database) for an application whose documentation and source code had been lost back in 1983 using only "C" and a three month old report produced before the application started to fail to run. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Fri, Feb 13, 2015 at 11:03 AM, Rubinstein, James <JRUBIN@midwestern.edu> wrote: > Thanks. I have read a bit about Vormetric. Just at a very high level, > without > something like this, how does Informix store its data in the > dbspace/chunks? > I'd assume it is in some proprietary format. Can anyone provide a very high > level description of how Informix stores data and any risks if data is not > encrypted on disk. > > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Paul > Watson > Sent: Friday, February 13, 2015 8:49 AM > To: ids@iiug.org > Subject: RE: Data Encryption [34658] > > I have customers using Vormetric - I think it does what you are asking > > Cheers > Paul > > > -----Original Message----- > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > > Rubinstein, James > > Sent: Friday, February 13, 2015 9:41 AM > > To: ids@iiug.org > > Subject: Data Encryption [34657] > > > > With the recent rash of data breaches in the news, I'm doing some high > level > > research for a presentation on data protection. I know that Informix > supports > > network data encryption, column level encryption, and requires certain > > permissions on $INFORMIXDIR and the chunk files. However, I'm > > wondering about encryption/protection on the chunk files other than OS > > level security. On > the > > Oracle site, I read this: > > > > Oracle Database 11g uses authentication, authorization, and auditing > > mechanisms to secure data in the database, but not in the operating > > system data files where data is stored. To protect these data files, > > Oracle > Database > > provides transparent data encryption. This feature enables you to > > protect sensitive data in database columns stored in operating system > > files by encrypting it. Then, to prevent unauthorized decryption, it > > stores > encryption > > keys in a security module external to the database. > > > > Is there an equivalent to Transparent Data Encryption for Informix > > databases? > > I realize that with many of the recent data breaches, the hackers had > > root/admin level access to the system and encryption probably wouldn't > > have helped, but I'm trying to understand whether Informix dbspaces > > and chunks are protected at the OS level assuming someone had access > > to the disk, but not credentials for the database. > > > > > > ********************************************************** > > ********************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a11c36b6893636f050efaa978

As already mentioned we don't provide encryption at rest within the product. Vormetric can be used for databases and files. IBM resells it as Guardium Data Encryption and I've done some work with it. If you have specific questions post them. Regards Em 13/02/2015 15:41, "Rubinstein, James" <JRUBIN@midwestern.edu> escreveu: > With the recent rash of data breaches in the news, I'm doing some high > level > research for a presentation on data protection. I know that Informix > supports > network data encryption, column level encryption, and requires certain > permissions on $INFORMIXDIR and the chunk files. However, I'm wondering > about > encryption/protection on the chunk files other than OS level security. On > the > Oracle site, I read this: > > Oracle Database 11g uses authentication, authorization, and auditing > mechanisms to secure data in the database, but not in the operating system > data files where data is stored. To protect these data files, Oracle > Database > provides transparent data encryption. This feature enables you to protect > sensitive data in database columns stored in operating system files by > encrypting it. Then, to prevent unauthorized decryption, it stores > encryption > keys in a security module external to the database. > > Is there an equivalent to Transparent Data Encryption for Informix > databases? > I realize that with many of the recent data breaches, the hackers had > root/admin level access to the system and encryption probably wouldn't have > helped, but I'm trying to understand whether Informix dbspaces and chunks > are > protected at the OS level assuming someone had access to the disk, but not > credentials for the database. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a11c317fcdc8c32050efe11ef

Thanks to all. This information has been very helpful. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Fernando Nunes Sent: Friday, February 13, 2015 1:28 PM To: ids@iiug.org Subject: Re: Data Encryption [34665] As already mentioned we don't provide encryption at rest within the product. Vormetric can be used for databases and files. IBM resells it as Guardium Data Encryption and I've done some work with it. If you have specific questions post them. Regards Em 13/02/2015 15:41, "Rubinstein, James" <JRUBIN@midwestern.edu> escreveu: > With the recent rash of data breaches in the news, I'm doing some high > level research for a presentation on data protection. I know that > Informix supports network data encryption, column level encryption, > and requires certain permissions on $INFORMIXDIR and the chunk files. > However, I'm wondering about encryption/protection on the chunk files > other than OS level security. On the Oracle site, I read this: > > Oracle Database 11g uses authentication, authorization, and auditing > mechanisms to secure data in the database, but not in the operating > system data files where data is stored. To protect these data files, > Oracle Database provides transparent data encryption. This feature > enables you to protect sensitive data in database columns stored in > operating system files by encrypting it. Then, to prevent unauthorized > decryption, it stores encryption keys in a security module external to > the database. > > Is there an equivalent to Transparent Data Encryption for Informix > databases? > I realize that with many of the recent data breaches, the hackers had > root/admin level access to the system and encryption probably wouldn't > have helped, but I'm trying to understand whether Informix dbspaces > and chunks are protected at the OS level assuming someone had access > to the disk, but not credentials for the database. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a11c317fcdc8c32050efe11ef ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.