Voltage Security - Encryption that Just Works.

Voltage SecureData Web
End-to-End Protection for Web Transactions

 

Voltage Products
Voltage SecureData
SecureData Web Contact us for pricing! Get a Quote!

 

Overview:

Voltage SecureData Web™ protects payment data captured at the browser, from the point the customer enters their cardholder information or personal data, and keeps it protected all the way through the web tier, the application tier, cloud infrastructure, and upstream IT systems and networks to the trusted host destination. This shields data from theft in all intermediate systems in merchants or enterprises, reducing risk to data and enables full end to end data protection. Payment information, Tax ID’s, authentication credentials, or any structured field can be protected from capture, only accessible by trusted systems even in sophisticated distributed web applications.

Voltage SecureData Web works without user interaction and without compromising the customer experience. It is designed to work in any browser whether on a laptop or a mobile phone, without browser add-ons or plug-ins. Voltage SecureData Web uses Voltage’s patented Page-Integrated Encryption™ (PIE) technology to encrypt data directly in the browser the moment it is captured, using random single-use keys that are dynamically and transparently generated. Protected data can only be decrypted at the trusted host system at the destination – for example at a payment processor in the case of payment card data, or in a trusted data processing system in the case of personal data.

For e-commerce payments which are subject to PCI DSS, Voltage SecureData Web can help merchants significantly reduce PCI DSS scope for the systems and applications that previously handled cardholder data. Voltage SecureData Web has been independently assessed to reduce PCI DSS scope by a leading PCI DSS QSA.

For cases involving personal data, Voltage SecureData Web can reduce the exposure of live information and simplify compliance with applicable privacy laws. Voltage SecureDataWeb securely enables adoption of cloud based services which reduce scale and compliance costs. By enabling protection of the data itself from capture all the way to its destination, compensating controls required to secure data where SSL sessions terminate can be eliminated.

The Challenge – Data Streams Must be Protected End-to-end

Today, many organizations are using the internet to collect sensitive data from their users such as payment data for e-commerce transactions, personal information for electronic medical records (EMR) and user credentials for access to systems and services. When sensitive data is entered into a browser, security gaps exist between systems, networks, and applications. These security gaps present opportunities for hackers to steal data. In browsers on desktop and mobile devices, the sensitive data can be protected while in transit between systems by Secure Socket Layer (SSL), but data remains in the clear in application servers, back office systems and databases. Point solutions such as database encryption can be used to protect data at rest, but information is still exposed as it enters and leaves each system. Without protecting the data from the browser all the way to the trusted host destination, hackers have more vulnerabilities to target, and compliance costs and risk of data theft rise. This problem will intensify as e-commerce, cloud computing, and mobile applications grow in popularity and use.

The Solution – Voltage SecureData Web

Voltage SecureData Web protects sensitive data at the browser and keeps it protected all the way to the trusted destination where it can be decrypted. This shields data from theft in front-end and intermediate systems, and also reduces audit footprint. E-commerce merchants required to comply with the PCI DSS can significantly reduce compliance costs and scope as systems and applications that previously handled payment data no longer have access to payment data. Voltage SecureData Web also protects Personally Identifiable Information (PII) typed into the browser, so PII and Primary Account Number (PAN) data is protected from the point of capture through the data life-cycle of processing, use and storage.

Benefits:

  • Reduced risk for e-commerce transactions
    Payment data is no longer exposed to hackers on web server infrastructure, networks and other systems between the browser and payment processor. This reduces the risk to data loss as data moves between systems.
  • End-to-end security for sensitive personal data capture
    Personal and sensitive data remains secure while passing through web and cloud infrastructure, reducing the risk of exposure in third party systems and cloud applications in the data flow.
  • Seamless customer experience
    Data protection is transparent to end users, and lets the owner of the data control the whole end to end customer experience without resorting to page re-directs, disruption, or confusing workflows.

Features:

Page-Integrated Encryption

Voltage SecureData Web uses Voltage’s Page-Integrated Encryption (PIE) technology to encrypt data in the browser at the moment of capture. PIE technology uses Voltage Format-Preserving Encryption (FPE) to protect data in the most transparent manner possible, allowing for quick deployment with minimal change to existing applications. Voltage Format-Preserving Encryption encrypts structured data like credit card numbers without changing the format or length, minimizing change to the associated applications, databases and

other systems. The encryption employs a unique single-use key, and the data is decrypted only at the trusted host destination. Voltage SecureData Web works without user interaction and without compromising user experience. It is designed to work in any major mobile or desktop browser, without add-ons or plug-ins.

Data Security That Starts in the Browser

Voltage SecureData Web uses standard browser features for compatibility across systems including mobile and desktop. Browsers must be SSL-capable and have JavaScript enabled. The static JavaScript performing the encryption is provisioned to the browser via SSL from a trusted site, such as a secure server in your environment, and is invoked with just a few lines of HTML on the web page.

Voltage SecureData Web allows full control of user interaction and avoids third-party handoffs. The user experience is seamless, without complex iframes or redirects. Every step of the transaction can be monitored for analytic purposes without disruption. Users have the same improved experience on mobile device browsers as on conventional desktop browsers.

Most important, front-end and intermediate systems no longer handle sensitive data in the clear. Sensitive data stays encrypted from the beginning to the end of the transaction, substantially reducing compliance costs and risk.

The end-to-end protection provided by Voltage SecureData Web is unique in the industry. It provides an elegant and easily delivered solution to a pressing and escalating security challenge in e-commerce.

Voltage SecureData Web includes:

  • Voltage Key Management Server: Generates and manages single-time keys; supports key management across the Voltage SecureData suite; optionally supports FIPS 140-2 hardware key management through hardware security modules
  • Voltage SecureData Web Front End Server: Delivers the key, key ID, and associated JavaScript to browsers
  • Voltage SecureData Host SDK: Decrypts payment and PII data in backend hosts; supports HP-UX, HP NonStop, Solaris, Linux, AIX, Windows, Stratus, and z/OS operating systems
  • Voltage SecureData Management Console: Built into the Voltage Key Management Server; enforces centrally defined policies and audits usage; provides robust and flexible authentication via centralized role-based control system, including dual controls.

Documentation:

PDF File
Download the Voltage SecureData Web Data Sheet (PDF).

 

Voltage Products
Voltage SecureData
SecureData Web Contact us for pricing! Get a Quote!