Data security has always been a challenge, but compared to the modern era, securing an environment in the past was a much easier undertaking.  Fast forward to today and more data than ever is being collected... and from more applications, users, devices, and connected hardware with dwindling amounts of it under enterprise control.  New forms of doing business demand easy access from the outside.  With the emergence of the cloud, your data may not even be on the inside anymore!  And insiders with access to your data increasingly include third parties who don't even work for your organization.  

To dig in deeper, I spoke with Derek Tumulak of Vormetric. 

VMblog:  Derek, thanks for speaking with VMblog today.  Can you tell us a little bit about your company?

Derek Tumulak:  Vormetric provides data security solutions that defend data through a single platform. By providing encryption, key management, access control tokenization and comprehensive auditing, Vormetric protects information across both new and existing technology environments.

Within traditional data centers, Vormetric products safeguard data even when perimeters and networks have been penetrated or endpoint security has failed. These same solutions enable enterprises adopting cloud services (IaaS, PaaS, and SaaS) to extend their organization's data security controls to the cloud ensuring that data is protected no matter where it resides.

Vormetric helps more than 1500 customers, including 17 of the Fortune 30, to meet compliance requirements and protect what matters - their sensitive data - from both internal and external threats.

VMblog:  I've heard about Vormetric's Cloud Encryption Gateway, can you tell me more?

Tumulak:  Enterprises struggle with being able to trust cloud storage users and providers. Users are often unaware of sensitive and unprotected data, which may result in compliance violations or worst-case scenario, a data breach. With providers, the security and infrastructure can be unknown. And if cloud storage providers manage the encryption keys, enterprises are not in control of their data's security.

Keeping these challenges in mind, we released The Vormetric Cloud Encryption Gateway, the latest extension of the Vormetric Data Security Platform. This new product offering encrypts data on premise before it reaches the cloud and remains encrypted while in the cloud. When the data returns on premise, the gateway then decrypts it for the authorized user.

VMblog:  Recently, Vormetric partnered with Teradata.  How does this partnership aim to address challenges in the cloud?

Tumulak:  Teradata is a leader in data analytics as data warehousing and big data continue to converge in the marketplace. Vormetric's offerings provide robust security solutions for Teradata's customers as the platform extension provides a seamless integration for organizations that already work with both companies. Vormetric protects Teradata's Hadoop Distribution as well as its integrated data warehouse. For enterprises who make the investment in Teradata's infrastructure, it only makes sense to also use Vormetric to provide a layer of security for this crucial data.

Through the integration, customers can take advantage of tools like sophisticated file encryption, tokenization, field-level encryption, privileged user access controls, centralized key management and file access logging to maximize their Teradata environments. This platform extension creates documented, standards-based application programming interfaces (APIs) and user-defined functions (UDFs) to perform key management operations.

The largest security-conscious organizations in the world rely on the Vormetric Data Security Platform. Now, Vormetric enables organization to leverage these robust data-at-rest security capabilities in Teradata environments.

VMblog:  I've noticed a number of breaches lately, any thoughts on why so much data is getting compromised?

Tumulak:  While data is crucial to enhance company product offerings and capture increased market share, when it's not properly protected, it can be exploited. Data now comes from a variety of sources such as CRM systems, files and spreadsheets which can all contain sensitive information that's desirable to insiders and hackers.

Ensuring that data is secure when deploying a cloud environment can be a daunting task. As the adoption of cloud services continues to grow, the risk of data breaches grows with it. The fear of a new data breach is so high, that preventing them tops the list as the number one spending priority. With that, we're seeing more and more data and system vulnerabilities.

More data means more problems. So naturally, data is defenseless and has an increased for protection. As a result, it is critical to establish strong security controls over these sensitive assets without compromising the value of big data analytics.

VMblog:  What do you consider top cloud security challenges?

Tumulak:  Someone will fail to connect the dots in the cloud world. Increased threats and the storage of large amounts of critical data create a large bulls-eye directly on certain cloud environments. 

Earlier this year, we conducted a survey on data security in cloud environments. According to Vormetric's Insider Threat Report, Cloud environments are now seen as the largest perceived risk to data (40%) above databases (38%) and file servers (29%). When we asked "Which of the following locations are at the greatest risk for loss of sensitive data in your organization? ", the results showed that cloud is now perceived as the highest risk environment that enterprises use for sensitive data.

With that, the survey indicated that the three top cloud security concerns were:

1.       Lack of control over the location of data

2.       Increased vulnerabilities from shared infrastructure

3.       Privileged user abuse at the cloud provider

When it comes to SaaS security concerns, cloud storage also tops the list. In fact, 83 percent of U.S., and 72 percent of global respondents were very or extremely concerned about the protection of sensitive data within online storage environments, according to the 2015 Vormetric Insider Threat Report: Cloud and Big Data Edition.

VMblog:  Vormetric claims to be the defenders of data, can you expand?

Tumulak:  We live in an information-hungry world. Data has no natural defenses - it cannot save itself. Data can't fly away, grow teeth or wield a sword. Data needs a knight in shining armor.

The Vormetric Data Security Platform aims to defend data. It makes it efficient to manage data-at-rest security across your entire organization. Built on extensible infrastructure, the Vormetric Data Security Platform features several products that deliver capabilities for transparent file-level encryption, application-layer encryption, tokenization, cloud encryption gateway, integrated key management and security intelligence logs.

Within the platform, we have five different heroes, (technologies), that we call the Data Defense League: transparent encryption, application encryption, integrated key management, tokenization with data masking and the cloud encryption gateway.

VMblog:  Can you tell us what's next for Vormetric?  What's on the horizon?

Tumulak:  As a leading data and cybersecurity company, one of our mantras is to follow the data. So as new and disruptive technologies enter the market we are continually innovating to ensure that that any information that an organization is managing can be properly secured and that only authorized users and applications can gain access to that information in the intended manner. You've seen us launch several new products in the last three years and looking forward the next three years you'll see us continue to introduce new features and products that will ensure that organizations can continue to maintain control of their data.

##

Once again, thank you to Derek Tumulak of Vormetric, for taking time to speak with VMblog.

Derek Tumulak (@Tumulak) joined Vormetric in June 2012 because he felt Vormetric was the best place for him to leverage the product management and engineering expertise he'd amassed over 15 years in the information security industry.

As head of the product management organization, Tumulak is responsible for product direction and strategy, working closely with Vormetric's enterprise, government and cloud service provider customers to develop and deliver products that meet their data security needs in the face of a rapidly intensifying threat landscape and the corporate mandate to leverage cloud technologies.