Conforms To Visa Best Practices for Data Field Encryption; Format-Preserving Encryption Meets Recommendations for End-to-End Encryption



PALO ALTO, Calif. - PIN Payments News Blog -  February 11, 2010 - Voltage Security™, the global leader in end-to-end data protection, today announced that Cryptographic Assurance Services, LLC (CAS), a leader in cryptographic compliance consulting, has completed an independent security review of Voltage's innovative Format-Preserving Encryption used in numerous end-to-end encryption implementations around the world. Voltage End-to-End Encryption, part of the Voltage SecureData(tm) product line, conforms to the complete list of Visa’s global industry best practices for data field encryption, published on October 5th, 2009. The Visa best practices are designed to further the payment industry's efforts to develop a common, open standard while providing guidance to encryption vendors and early adopters. Data field encryption, also known as end-to-end encryption, protects card information from the swipe to the acquirer processor so that the merchant is no longer processing or transmitting card data in the "clear."



CAS was asked to evaluate Format-Preserving Encryption (FPE) as a mode of the Advanced Encryption Standard (AES). CAS evaluated the mathematical model on which it was based and the associated proofs of security. CAS also reviewed a source-code instantiation of FPE provided by Voltage Security. CAS identified applicable compliance regimes and assessed FPE against them.



In its finding, CAS noted the large body of cryptographic research on which FPE is based, accumulated over decades, and the strength of the mathematical proofs and cryptanalysis. CAS concluded that FPE as implemented in the form of the AES mode FFX3 meets the compliance criteria for PCI DSS v1.2 encryption requirements and for Visa’s Data Field Encryption requirements, making Voltage Security’s Format-Preserving Encryption solutions suitable for use by organizations needing to comply. AES mode FFSEM is a sub mode of AES mode FFX and included in this assessment.



The complete report is available at www.voltage.com/security-review, registration required.



About Cryptography Assurance Services



CAS is a team of security professionals with over 50 years of combined experience. The CAS experience covers a wide range of technologies addressing confidentiality, integrity, authentication and non-repudiation with emphasis on cryptography and key management. CAS has been, and is still today, involved in developing X9, ISO and other industry security standards and providing assurance services to gain compliance to such standards.



About Voltage Security



Voltage Security, Inc., an enterprise security company, is an encryption innovator and global leader in end-to-end data protection. Voltage solutions, based on next generation cryptography, provide end-to-end encryption, tokenization, masking and stateless key management for protecting valuable, regulated and sensitive information based on policy. Voltage products enable reduction in PCI audit scope with rapid implementation and the lowest total cost of ownership in the industry through the use of award-winning cryptographic solutions, including Voltage Identity-Based Encryption™ (IBE) and a new breakthrough innovation: Format-Preserving Encryption™ (FPE). Offerings include Voltage SecureMail™, Voltage SecureData™, Voltage SecureFile™ and the Voltage Security Network™ (VSN), an on-demand managed service for the extended business network.



As a service to the industry and general public, the company maintains the Voltage Data Breach Index and Map which is continuously updated with global data breach information: www.voltage.com/data-breach. The Company has been issued several patents based upon breakthrough research in mathematics and cryptographic systems. Customers include Global 1000 companies in banking, retail, insurance, energy, healthcare and government. To learn more about Voltage customers and sign up for the customer news letter please visit www.voltage.com/customers.







###

PALO ALTO, Calif. – February 9, 2010–Voltage Security™, the global leader in end-to-end data protection, today announced financial results for the fiscal year ending January 31, 2010. With growing market acceptance of its broad set of encryption solutions, including Voltage SecureData™, its end-to-end encryption product line for enterprise and payment applications, Voltage completed four quarters of year-over-year revenue growth, and three consecutive quarters of profitability and cash generation from operations, resulting in over 70% revenue growth for the fiscal year. The company also was cash flow positive from operations and profitable for the fiscal year.



“We are extremely pleased with our performance over this past year, especially given the tough economic climate,” said Sathvik Krishnamurthy, president and CEO of Voltage Security. “We continue to see demand increasing across our entire product line, with our sales pipeline having tripled as compared to this time last year.”



Multiple Trends Driving Growth



The heightened demand for Voltage solutions is being driven by three broad trends:

• Increasing set of cyber threats across the enterprise is causing enterprise IT executives to be more vigilant in protecting valuable data assets, and particularly, private and personal customer data.

“Customers are battling cyber crime throughout the enterprise. Much of the publicity is focused on endpoint security but our customers around the globe are increasingly concerned with malware and cyber threats within the data center as well,” commented Krishnamurthy.

• Reducing audit scope for payment card industry (PCI) compliance continues to be an important objective for large companies in regulated industries, particularly in the financial services, payments, insurance and medical sectors. These enterprises are responsible for protecting the privacy of customer credit card data, and are subject to mandatory time-consuming and expensive assessments.
  
  
  
  By utilizing Voltage encryption and key management solutions, our customers are dramatically reducing audit scope, and saving significant amounts of time and money,” continued Krishnamurthy.
  
  


• Displacing competitive legacy encryption solutions is also increasingly driving Voltage growth. In the past, enterprises have chosen encryption solutions based on legacy technology like PKI, which quickly becomes unmanageable and too expensive to administer. Now customers are turning to more simplified but innovative Voltage end-to-end encryption and key management solutions.

Leadership in Payment Security



Throughout the year Voltage continued to build its leadership position in providing information security solutions for the broader payments industry. Voltage continued to build out its customer and partnership base as follows:



One of the nation’s top five credit card processors has selected Voltage to power its encryption of credit card data, from card swipe to card brand hand-off, covering the critical endpoints of the payment stream.  



Heartland Payment Systems: Heartland’s E3 End-to-End Encryption solution is powered by Voltage SecureData and protects cardholder and sensitive authentication data throughout the payment acquiring network.

Thales: Thales, a leading provider of information systems and communication security, that secures more than 70 percent of the world’s card payment transactions, has integrated Voltage SecureData technology with its hardware security modules (HSMs).



In addition, Voltage launched the industry’s first, global, zero-cost licensing program, the Voltage SecureData Open License Program™. This dramatically lowers the barriers to enable the easy integration of encryption with any POS device, electronic cash register (ECR), mobile device or eCommerce Payments platform, protecting credit card data from the point of entry into the payment flow.



Early participants in the program include Hypercom, one of the leading global point-of-sale (POS) device manufacturers, and XAC, one of the world’s leading private label electronic payment system manufacturers.



In addition, Voltage added payments industry executive Doug Dwyre, previously with First Data Corp., to its executive team as vice president, business development, payments.



Successful Product Line Diversification Results in Increase in Suite Sales



Over two years ago Voltage strategically began product line diversification, bringing to market solutions such as Voltage SecureFile™ and Voltage SecureData™, to complement its flagship, market leading enterprise email security solution, Voltage SecureMail™. Based on innovative encryption technology and sharing an underlying common key management architecture that greatly simplifies administration and total cost of ownership, customers are now increasingly purchasing “suites” of Voltage products to protect information as it flows within and beyond the enterprise.



During the fiscal year, over 40% of Voltage’s revenues came from suite sales, and the company expects to see this number continue to grow.



Some of those customers include:

• A Fortune 10 telecommunications company.


• A top 5 payments processor.


• A leading auto insurance company.

Industry Leadership



Voltage continued to take a leading role in both standards and educating the broader market.



Earlier in the year, Voltage unveiled the Voltage Data Breach Index and Map. The company maintains this interactive tool, found here www.voltage.com/data-breach, which is continuously updated with global data breach information.



In the standards area, Voltage continued its work with memberships in the following organizations: FIPS, PCI Security Standards Council, OASIS KMIP Working Group and SPVA (Secure POS Vendor Alliance).



About Voltage Security



Voltage Security, Inc., an enterprise security company, is an encryption innovator and global leader in end-to-end data protection. Voltage solutions, based on next generation cryptography, provide end-to-end encryption, tokenization, masking and stateless key management for protecting valuable, regulated and sensitive information based on policy. Voltage products enable reduction in PCI audit scope with rapid implementation and the lowest total cost of ownership in the industry through the use of award-winning cryptographic solutions, including Voltage Identity-Based Encryption™ (IBE) and a new breakthrough innovation: Format-Preserving Encryption™ (FPE). Offerings include Voltage SecureMail™, Voltage SecureData™, Voltage SecureFile™ and the Voltage Security Network™ (VSN), an on-demand managed service for the extended business network.



As a service to the industry and general public, the company maintains the Voltage Data Breach Index and Map which is continuously updated with global data breach information: www.voltage.com/data-breach. The Company has been issued several patents based upon breakthrough research in mathematics and cryptographic systems. Customers include Global 1000 companies in banking, retail, insurance, energy, healthcare and government. To learn more about Voltage customers and sign up for the customer news letter please visit www.voltage.com/customers.

Thales and Voltage Security Forge Technology Integration and Partnership to Deliver End-to-End Encryption and Key Management to Secure Payments

PALO ALTO, Calif. & CAMBRIDGE, United Kingdom--(BUSINESS WIRE)--Thales, leader in information systems and communications security, and Voltage Security, Inc., the global leader in end-to-end data protection, announce a technology integration and partnership centered around delivering End-to-End Encryption and key management solutions for the payments industry and broader enterprise security applications. Through the partnership, the two companies have worked together to integrate Voltage SecureData technology with Thales hardware security modules (HSMs) for customers, Heartland Payment Systems being an example.



The Thales and Voltage technology integration allows customers to apply hardened data protection measures at virtually any point along the data path to help achieve the goal of end-to-end protection. By helping to reduce the time and complexity of deploying data protection and by significantly limiting the scope of security audits, the burden of demonstrating regulatory and internal compliance is dramatically reduced. The technology integration builds on Voltage SecureData™ to protect data without having to make expensive changes to the point of sales (POS) infrastructure, database and business applications. The encryption and key management process is protected by Thales nShield Connect hardware security modules – part of the nCipher product line - to ensure the security and integrity of the overall solution. Beyond initial deployment, Voltage and Thales encryption and key management solutions further simplify the ongoing management and operation for customers.



End-to-End Encryption is increasingly the leading method of securing data throughout the payment stream and for enterprise security applications. For organizations subject to PCI DSS (Payment Card Industry Data Security Standard), using hardware security modules (HSM) solutions further reduces the scope of PCI audits – reducing the time and money required for compliance.



“With Heartland End-to-End Encryption (E3), Heartland is raising the bar in retail payments security, beyond existing security mandates, by deploying End-to-End Encryption to protect cardholder and sensitive authentication data throughout the payment acquiring network,” says Steve Elefant, chief information officer, at Heartland Payment Systems. “The Voltage solution integrated with Thales HSMs just works and, in a matter of weeks rather than months, delivered the data protection and key management that Heartland needs to move the payments industry forward.”



“The goal of achieving end-to-end protection is a challenging one with so many diverse endpoints in a transaction lifecycle – point of sale (POS), databases, mainframes, and payment networks – all of which need to be protected from compromise,” says Sathvik Krishnamurthy, president and CEO, Voltage Security. “Key management is a critical aspect of all encryption systems and through our partnership with Thales we are able to enhance our End-to-End Encryption solution to protect key management functions and other cryptographic operations in a tamper resistant and security certified environment – an essential requirement in the payments market.”



“Today, Thales helps secure more than 70 percent of the world’s card payment transactions. Thales is delighted to partner with Voltage to deliver to customers such as Heartland an innovative End-to-End Encryption and key management solution that further helps customers in the payments market and beyond to address their expanding data protection needs,” says Franck Greverie, vice president, managing director for the information systems security activities of Thales.

• More information on Thales HSMs is available at http://iss.thalesgroup.com/Products/Hardware%20Security%20Modules.aspx.


• More information on Voltage SecureData is available at www.voltage.com/end-to-end


• For additional commentary on trends in payment security, please visit www.PaymentsSecurity.com.

About Voltage Security



Voltage Security, Inc., an enterprise security company, is an encryption innovator and global leader in end-to-end data protection. Voltage solutions, based on next generation cryptography, provide end-to-end encryption, tokenization, masking and stateless key management for protecting valuable, regulated and sensitive information based on policy. Voltage products enable reduction in audit scope with rapid implementation and the lowest total cost of ownership in the industry through the use of award-winning cryptographic solutions, including Voltage Identity-Based Encryption™ (IBE) and a new breakthrough innovation: Format-Preserving Encryption™ (FPE). Offerings include Voltage SecureMail™, Voltage SecureData™, Voltage SecureFile™ and the Voltage Security Network™ (VSN), a SaaS service for the extended business network.



As a service to the industry and general public, the company maintains the Voltage Data Breach Index and Map which is continuously updated with global data breach information: www.voltage.com/data-breach. The Company is active in the standards community and is a PCI Security Standards Council Participating Organization and is a member of the Secure POS Vendor Alliance (SPVA). Voltage has also been issued several patents based upon breakthrough research in mathematics and cryptographic systems. Customers include Global 1000 companies in banking, retail, insurance, energy, healthcare and government. To learn more about Voltage customers and sign up for the customer newsletter, please visit www.voltage.com/customers.



About Thales



Thales is a global technology leader for the Aerospace and Space, Defence, Security and Transportation markets. In 2008, the company generated revenues of 12.7 billion euros with 68,000 employees in 50 countries. With its 25,000 engineers and researchers, Thales has a unique capability to design, develop and deploy equipment, systems and services that meet the most complex security requirements. Thales has an exceptional international footprint, with operations around the world working with customers as local partners. www.thalesgroup.com



Voltage Identity-Based Encryption, Voltage Format-Preserving Encryption, Voltage SecureMail, Voltage SecureFile, Voltage SecureData and the Voltage Security Network (VSN), are registered trademarks of Voltage Security, Inc. All other trademarks are property of their respective owners.

Related articles by Zemanta

• Voltage Security Opens End-to-End Encryption to POS Vendors with Zero-cost License (pindebit.blogspot.com)


• Thales offers new security hardware modules (v3.co.uk)


• Sun Tzu: PCI-DSS and Situational Awareness (information-security-resources.com)


• Hacker Charged With Stealing 130 Million Credit Cards (wired.com)