Con-way, Inc. is a leader in the transportation and logistics industry. With over 28,500 employees, this publicly-traded company generated $5.6 billion in freight and logistics service revenues in 2012. Headquartered in Ann Arbor, Michigan, it has over 500 operating locations spread across North America and another 20 countries spanning five continents. Within its market segment, Con-way has been named as a Fortune magazine “Most Admired Company.”
The company handles a large volume of personally identifiable information (PII) for customers around the world. However, its role as a provider of transportation services gives the company some unique and valuable perspectives. Praveen Sharabu, senior director of Con-way’s IT Infrastructure and Vendor Management Office, explained, “In addition to a customer’s PII our systems may contain information that is deemed confidential by our customers.
“It’s imperative for us to be able to secure all the information with which we’ve been entrusted: Without this trust, we don’t have a business. We’ve always had very stringent security measures in place – with best-in-class solutions for gateways, firewalls and anti-virus protection – but we knew we needed to stay ahead of increasingly sophisticated threats and malware attacks.”
The company’s IT infrastructure utilizes several operating systems, including Linux, AIX® and Windows®. “Our IT solutions utilize Oracle, SQL Server and other database platforms,” commented Sharabu. “In addition to the databases we also hold large amounts of data in unstructured formats, including a variety of log files and data transmitted through event processing and integration platforms. The environment is further complicated by our use of multiple partners, managed services, cloud services, etc. Our customers are sufficiently knowledgeable to appreciate the importance of encrypting their information – both at rest and in motion – everywhere across our infrastructure.”
Sharabu continued, “We did look at storage-level, operating system-level, and native database encryption for our infrastructure but these point products only addressed a limited part of our list of requirements, and would have created performance and operational inefficiencies.”
Con-way also evaluated key management options, assessing a variety of proprietary and homegrown tools. The shortcomings of these ad-hoc solutions quickly became very apparent, motivating Sharabu and his team to focus on identifying a consistent way to manage keys and establish a standard workflow to securely deposit and retrieve the keys as needed.
“Ultimately our analysis pointed to Vormetric as being the optimal answer for us. We felt that the Vormetric Data Security solution – which encompasses Vormetric Encryption and Vormetric Key Management – would give us more sophisticated and comprehensive capabilities than a combination of competing products,” recalled Sharabu. “Another significant factor was the way that Vormetric avoids us having to make any changes to our applications, storage or internal processes. We really liked being able use a single integrated solution for data encryption and key management to secure our diverse set of structured and unstructured data across the environment.”
Deployment throughout the Con-way infrastructure was very straightforward. The company used Vormetric professional services to assist in the implementation and the subsequent transition to becoming fully operational. Sharabu noted, “It only took an hour or two per server, depending on the number and size of files to be encrypted.
“The Vormetric solution’s lightweight footprint is clearly structured to minimize the effect on transactional throughput. The encryption appliances don’t impose any noticeable latency on application performance; we knew how important this is because, as we saw with some of the other products we evaluated, if you get it wrong you can compromise your whole environment. The Vormetric solution really is transparent to users.”
Sharabu concluded, “All the internal reviews we’ve conducted have been positive. What we really appreciate – beyond the advanced features and level of protection we’ve been able to deploy – is Vormetric integrating everything into a very intuitive package that met our goals for data-level security, operational simplicity and user transparency.”
Vormetric (@Vormetric) is the industry leader in data security solutions that span physical, virtual and cloud environments. Data is the new currency and Vormetric helps over 1100 customers, including 17 of the Fortune 25 and many of the world’s most security conscious government organizations, to meet compliance requirements and protect what matters – their sensitive data – from both internal and external threats. The company’s scalable solution suite protects any file, any database and any application — anywhere it resides — with a high performance, market-leading Data Security Platform that incorporates application transparent encryption, privileged user access controls, automation and security intelligence.