Secure Tertiary Data Backup Guideline in Hong Kong

The Guideline covers the eight high-level Principles and embeds with nine Data Vault Characteristics under the headings of Governance, Design and Data Restoration. The HKMA considers STDB an effective measure to enhance the cyber resilience and data security of Authorised Institutions (AIs) in Hong Kong.

Thales enables Authorised Institutions (AIs) to align with the key principles in the Secure Tertiary Data Backup (STDB) and achieve:

• Simplify Data Security
• Accelerate Time to Compliance

Segregation of duties, access control, audit log and reporting

• CipherTrust Manager enhances key management for Authorised Institutions (Ais) by delivering a strong separation of duties for increased security. Additionally, it enforces very granular and least-privileged-user access management policies, enabling the protection of data from misuse by privileged users.
• Access logs and reporting: CipherTrust Security intelligence of the CipherTrust Data Security Platform provides Security Intelligence logs that specify which processes and users have accessed protected data, under which policies, and if access requests were allowed or denied.

Establishing the scope of their critical data

• Thales’ CipherTrust Data Discovery and Classification efficiently identifies structured as well as unstructured sensitive data on-premises and in the cloud for the AIs.

Protecting critical data in transit and at rest with encryption

• CipherTrust Transparent Encryption (CTE) delivers data-at-rest encryption with centralised key management, privileged user access control and detailed data access audit logging.
• Thales High Speed Encryptors (HSEs) provide network-independent data-in-transit encryption (Layers 2,3 and 4) ensuring data is secure as it moves from site-to-site, or from on-premises to the cloud and back.

Key Management & key lifecycle management

• CipherTrust Manager simplifies key lifecycle management tasks, including secure key generation, backup/restore, clustering, deactivation, and deletion by enabling organisations to centrally manage encryption keys for Thales CipherTrust Data Security Platform and third-party products — including IBM Security Guardium Data Encryption, Microsoft SQL TDE, Oracle TDE, and KMIP-compliant encryption products.

Protection of cryptographic keys

Luna HSMs from Thales provide a hardened, tamper-resistant environment for secure cryptographic processing, key generation and protection, encryption, and more.