book

Getting Started with IBM Hyper Protect Data Controller

Name: Getting Started with IBM Hyper Protect Data Controller
ISBN: 9780738460031

by Bill White, Andy Coulson, Guillaume Hoareau, Jason Katonica, Roy Panting, Philippe Richard, Maxwell Weiss, Eva Yan

January 2022

Intermediate to advanced

268 pages

8h 15m

English

IBM Redbooks

Read now

Unlock full access

Front cover
Notices
Trademarks
Preface
AuthorsNow you can become a published author, too!Comments welcomeStay connected to IBM Redbooks
Chapter 1. Introducing IBM Hyper Protect Data Controller
1.1 The problem, context, and solution1.1.1 Fundamental data privacy elements: Govern, Move, Audit1.1.2 Security and trust: Data Centric Audit and Protection1.1.3 Referential integrity: Data processing with an encrypted object1.2 How Hyper Protect Data Controller works1.2.1 Regulating access to personal information1.2.2 Modes of protection: Masked and encrypted1.2.3 Modes of Access: Direct, static, and dynamic1.2.4 Securing with IBM Hyper Protect Virtual Servers1.3 Common business use cases1.3.1 More information
Chapter 2. Using Hyper Protect Data Controller
2.1 Introduction2.2 Benefiting from Hyper Protect Data Controller capabilities2.3 Scenario #1: Creating a single point of consumption2.3.1 Business problem and data privacy needs2.3.2 Persona and need-to-know2.3.3 Using Hyper Protect Data Controller2.4 Scenario #2: Cloud analytics and third parties2.4.1 Business problem and data privacy needs2.4.2 Persona and need-to-know2.4.3 Using Hyper Protect Data Controller2.4.4 How it applies to different industries2.5 Scenario #3: Securely retrieving insights from a third party for marketing2.5.1 Business problem and data privacy needs2.5.2 Persona and need-to-know2.5.3 Using Hyper Protect Data Controller2.6 Scenario #4: Static masking for business intelligence and data reporting2.6.1 Business problem and data privacy needs2.6.2 Persona and need-to-know2.6.3 Using Hyper Protect Data Controller2.6.4 How it applies to different industries2.7 Scenario #5: Call center agent usage of encrypted data2.7.1 Business problem and data privacy needs2.7.2 Persona and need-to-know2.7.3 Using Hyper Protect Data Controller2.7.4 How it applies to different industries2.8 Scenario #6: Changing roles within the organization2.8.1 Business problem and data privacy needs2.8.2 Persona and need-to-know2.8.3 Using Hyper Protect Data Controller2.8.4 How it applies to different industries2.9 Scenario #7: Revoking all access to encrypted data2.9.1 Business problem and data privacy needs2.9.2 Persona and need-to-know2.9.3 Using Hyper Protect Data Controller2.9.4 How it applies to different industries2.10 Scenario #8: Handling the audit process2.10.1 Business problem and data privacy needs2.10.2 Persona and need-to-know2.10.3 Using Hyper Protect Data Controller2.10.4 How it applies to different industries
Chapter 3. Getting started with deploying Hyper Protect Data Controller
3.1 Technology at a glance3.2 Deployment overview3.3 Planning3.3.1 System requirements3.3.2 Deployment architecture3.3.3 Identifying external connections to secure3.3.4 Data sources and targets3.3.5 Personas and data access3.3.6 Data policy3.4 Before installing Hyper Protect Data Controller3.4.1 Obtaining product installation files3.4.2 Implementing network changes3.4.3 Creating certificates for external connections3.4.4 Implementing LDAP changes3.4.5 Preparing the Linux management server3.4.6 Setting up the Secure Service Container partition3.5 Installing Hyper Protect Data Controller3.5.1 Installing and configuring the Hyper Protect Virtual Servers hosting appliance3.5.2 Installing Hyper Protect Data Controller3.5.3 Installing the Hyper Protect Data Controller Management Interface3.6 Post installation3.6.1 Uploading JDBC JAR files3.6.2 Setting up the JDBC client3.6.3 Creating and activating the data policy3.6.4 Creating data encryption keys for protected data elements3.6.5 Creating password labels for JDBC connections3.6.6 Enabling Crypto Express support3.6.7 Back up and restore
Chapter 4. Sizing the environment
4.1 Determining the number of instances4.1.1 Determining the number of IFLs and memory per instance4.1.2 Shared versus dedicated IFLs4.1.3 Monitoring the efficiency4.2 Performance4.2.1 Direct access4.2.2 Dynamic access4.2.3 Static access4.2.4 Selecting the optimal access4.2.5 Performance effect of table size and number of EDOs4.2.6 Effect of adding IFLs and memory4.2.7 Effect of number of rows and EDOs4.3 Analyzing the source table4.3.1 Extracting data from the source table to a temporary table4.4 Choosing the optimal workloads4.4.1 What constitutes a good fit for Hyper Protect Data Controller?4.5 Locating and classifying sensitive data4.6 Data Encryption Keys and key rotation4.7 General Data Protection Regulation: Right to be forgotten4.8 Maintaining Hyper Protect Data Controller4.9 Crypto Express7S support with Hyper Protect Data Controller
Chapter 5. Use case implementation examples
5.1 Overview5.1.1 Hyper Protect Data Controller environment5.2 Scenario 1: Creating a single point of consumption5.2.1 Use case summary5.2.2 Implementation flow5.3 Scenario 2: Cloud analytics and third parties5.3.1 Use case summary5.3.2 Implementation flow5.4 Scenario 3: Securely retrieving insights from a third-party5.4.1 Use case summary5.4.2 Implementation flow5.5 Scenario 4: Static masking for BI and data reporting5.5.1 Use case summary5.5.2 Implementation flow5.6 Scenario 5: Call Center Agent usage of encrypted data5.6.1 Use case summary5.6.2 Implementation flow5.7 Scenario 6: Changing roles within the organization5.7.1 Use case summary5.7.2 Implementation flow5.8 Scenario 7: Revoking all access to encrypted data5.8.1 Use case summary5.8.2 Implementation flow5.9 Scenario 8: Handling the audit process5.9.1 Use case summary5.9.2 Implementation flow
Chapter 6. Operations
6.1 Interacting with Hyper Protect Data Controller6.1.1 Python command line interface scripts6.1.2 REST API6.2 Data Controller management6.2.1 Containers and services management6.2.2 Configuration management6.3 Policies management6.3.1 Creating or updating a policy6.3.2 Submitting a policy by using the API method6.3.3 Approving a policy by using the API method6.3.4 Activating a policy by using the API method6.3.5 Disabling a policy by using the API method6.3.6 Resetting a policy by using the API method6.3.7 Deleting a policy by using the API method6.3.8 Listing all policies by using the API method6.3.9 Getting diagnostics about the active policy by using the API method6.3.10 Downloading a policy by using the API method6.4 Data Encryption Keys management6.4.1 Creating a key by using the API method6.4.2 Listing a key by using the API method6.4.3 Deleting a key by using the API method6.4.4 Listing all keys by using the API method6.5 Password labels management6.5.1 Creating a password label by using the API method6.5.2 Listing a password label by using the API method6.5.3 Deleting a password label by using the API method6.5.4 Listing all password labels by using the API method6.6 Managing keystores and certificates6.6.1 Uploading a keystore or certificate6.6.2 Getting certificate details by using the API method6.6.3 Getting a list of keystores and certificates by using the API method6.6.4 Deleting a keystore or certificate by using the API method6.7 Data administration6.7.1 JDBC driver management6.7.2 Provisioning protected data6.7.3 Consuming data6.7.4 Revocation of protected data6.8 Backing up and restoring6.8.1 Components to consider6.8.2 Backing up and restoring Hyper Protect Data Controller6.9 High availability6.9.1 High availability architecture6.9.2 Before building the high availability configuration6.9.3 Building a highly available configuration6.10 Automation6.10.1 The need for automation6.10.2 Automating API tests or consumptions6.10.3 Automation routine ideas
Chapter 7. Diagnostics, logging, and monitoring
7.1 Diagnostics7.1.1 Hyper Protect Data Controller status7.1.2 Container status7.1.3 First Failure Data Capture and collecting memory dumps for analysis7.2 Logs and audits7.2.1 Log types7.2.2 Viewing and downloading logs and audits7.2.3 Managing external logs7.2.4 Managing IBM Hyper Protect Data Controller external logs7.2.5 IBM Hyper Protect Data Controller integration by using QRadar7.2.6 IBM Hyper Protect Data Controller and the Elastic Stack7.2.7 Checking the Elasticsearch database7.2.8 Ideas for creating Kibana dashboards7.3 Monitoring7.3.1 Monitoring more events7.3.2 Monitoring systems activities

Appendix A. Transport Layer Security setups for z/OS LDAP server
A.1 Generating certificates on z/OSA.2 TLS troubleshootingA.3 Implementing LDAP TLS/SSLA.4 Installing the LDAP server certificate in the keystoreA.5 Securing REST APIs
Appendix B. Managing certificates with Hyper Protect Data Controller
B.1 Verifying validity end dateB.2 Certificate online checkingB.3 Root certificate expirationB.4 Renewing and replacing Hyper Protect Data Controller certificates before expirationB.5 When the HPDC TLS certificate expires
Appendix C. Example Hyper Protect Data Controller policy
Back cover

Overview

IBM® Hyper Protect Data Controller is designed to provide privacy protection of your sensitive data and give ease of control and auditability. It can manage how data is shared securely through a central control. Hyper Protect Data Controller can protect data wherever it goes—security policies are kept and honored whenever the data is accessed and future data access can be revoked even after data leaves the system of record.

This IBM Redbooks® publication can assist you with determining how to get started with IBM Hyper Protect Data Controller through a use case approach. It will help you plan for, install, tailor and configure the Hyper Protect Data Controller. It includes information about the following topics:

Concepts and reference architecture
Common use cases with implementation guidance and advice
Implementation and policy examples
Typical operational tasks for creating policies and preparing for audits
Monitoring user activity and events

This IBM Redbooks publication is written for IT Managers, IT Architects, Security Administrators, data owners, and data consumers.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

IBM Power E1080 Technical Overview and Introduction

Publisher Resources

ISBN: 9780738460031Other

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills