FedRAMP Compliance

Thales e-Security assists with data security compliance and encryption for FedRAMP.

FedRAMP

The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. Thales e-Security helps Federal Government agencies and their suppliers meet these data security compliance standards. Read the white paper.

FedRAMP Compliance
FedRAMP Goals

According to FedRamp.Gov the goals of the program are as follows:

  • Accelerate the adoption of secure cloud solutions through reuse of assessments and authorizations
  • Increase confidence in security of cloud solutions
  • Achieve consistent security authorizations using a baseline set of agreed upon standards to be used for cloud product approval in or outside of FedRAMP
  • Ensure consistent application of existing security practice
  • Increase confidence in security assessments
  • Increase automation and near real-time data for continuous monitoring
Key Processes

Also according to FedRamp.Gov, FedRAMP authorizes cloud systems in a three step process:

  • Security Assessment: The security assessment process uses a standardized set of requirements in accordance with FISMA using a baseline set of NIST 800-53 controls to grant security authorizations.
  • Leveraging and Authorization: Federal agencies view security authorization packages in the FedRAMP repository and leverage the security authorization packages to grant a security authorization at their own agency.
  • Ongoing Assessment & Authorization: Once an authorization is granted, ongoing assessment and authorization activities must be completed to maintain the security authorization.
Facets of FedRAMP Compliance Thales e-Security Can Help With

Core Thales e-Security capabilities that help meet FedRAMP compliance standards include:

  • Encryption and Key Management: Strong, centrally managed, file, volume and application encryption combined with simple, centralized key management that is transparent to processes, applications and users.
  • Access Policies and Privileged User Controls: Restrict access to encrypted data – permitting data to be decrypted only for authorized users and applications, while allowing privileged users to perform IT operations without the ability to see protected information.
  • Security Intelligence: Logs that capture access attempts to protected data, providing high value security intelligence information that can be used with a Security Information and Event Management (SIEM) solution and for compliance reporting.

In addition to helping you comply with FedRAMP; FIPS 199; FIPS 200; FISMA; NIST 800-53, Revision 4, and FIPS 140-2; Thales e-Security solutions are designed to help you comply with:

The Vormetric Data Security Platform

The Vormetric Data Security Platform from Thales e-Security is the only solution with a single extensible framework for protecting data-at-rest under the diverse requirements of Federal Agencies across the broadest range of OS platforms, databases, cloud environments and big data implementations. The result is low total cost of ownership, as well as simple, efficient deployment and operation.

Vormetric Transparent Encryption

Vormetric Transparent Encryption from Thales e-Security provides file and volume level data-at-rest encryption, secure key management and access controls required by regulation and compliance regimes.

Vormetric Key Management

Vormetric Key Management from Thales e-Security enables centralized management of encryption keys for other environments and devices including KMIP compatible hardware, Oracle and SQL Server TDE master keys and digital certificates.

Vormetric Data Security Intelligence

Vormetric Data Security Intelligence from Thales e-Security provides another level of protection from malicious insiders, privileged users, APTs and other attacks that compromise data by delivering the access pattern information that can identify an incident in progress.

Vormetric Application Encryption

Vormetric Application Encryption enables agencies to easily build encryption capabilities into internal applications at the field and column level.

Vormetric Tokenization with Dynamic Masking

Vormetric Tokenization with Dynamic Masking from Thales e-Security lets administrators establish policies to return an entire field tokenized or dynamically mask parts of a field. With the solution’s format-preserving tokenization capabilities, you can restrict access to sensitive assets, yet at the same time, format the protected data in a way that enables many users to do their jobs.

Vormetric Cloud Encryption Gateway

The Vormetric Cloud Encryption Gateway from Thales e-Security safeguards files in cloud storage environments. It encrypts sensitive data before it is saved to the cloud enabling security teams to establish the visibility and control they need around sensitive assets. Because Vormetric’s Cloud Encryption Gateway relies on Thales e-Security's Vormetric Data Security Manager for encryption key and policy management, customers never relinquish control of cryptographic keys to the provider and data never leaves the enterprise premises unencrypted or unaccounted for.

Research and Whitepapers : Vormetric Cloud Encryption Gateway

As organizations grow increasingly reliant upon cloud storage offerings like Amazon Simple Storage Service (Amazon S3), Box and Caringo, the need to secure sensitive data in these environments grows increasingly urgent. With the Vormetric Cloud Encryption Gateway, organizations can encrypt files in cloud storage, enabling a secure and compliant file sharing and storage environment....

Download

Research and Whitepapers : Vormetric FedRAMP / NIST 800-53 Requirements Mapping

Critical to certification for meeting FIPS, is the implementation of security controls from NIST 800-53, Appendix F. Focusing on the capabilities needed to meet these requirements, this paper provides background about the Thales Data Security Platform and the Thales Transparent Encryption product that is delivered through that platform....

Download

Research and Whitepapers : Encryption as an Enterprise Strategy

By Dave Shackleford, IANS Faculty Member and SANS analyst

This report is a survey and offers analysts on creating an enterprise-wide encryption strategy and explores the growing “encrypt everything” philosophy....

Download

Research and Whitepapers : Cracking the Confusion: Encryption and Tokenization for Data Centers, Servers, and Applications

By Securosis analysts and industry experts, Rich Mogull, CEO and Adrian Lane, CTO.

This paper cuts through the confusion to help you pick the best encryption and tokenization options for your projects. The focus is on encrypting in the data center: applications, servers, databases, and storage. It also covers cloud computing (IaaS: Infrastructure as a Service)....

Download

인터랙티브 동영상 시청하기 자세히 보기
라이브 데모 예약하기 예약하기
전문가와 상담하기 연락하기