Scrambling vs. Encryption for Oracle E-Business Suite Data Protection

Relevant Information

Scrambling Vs. Encryption

Many large, medium, and small businesses need ways to manage their business processes. From financial processes, to manufacturing, to human resources and payroll, businesses utilize packaged software from vendors like Oracle, PeopleSoft, JD Edwards, and SAP to manage all their business functions. Oracle’s E-Business Suite has a customer install base of approximately 30,000. Businesses turn to vendors because the cost to develop custom software to meet the business process is prohibitive. Each vendor provides a series of modules to fit certain business needed. These vendors provide viable solutions for all businesses at a reasonable return on investment.

Guardian Applications creates internal data loss prevention software products for all sized businesses storing sensitive data of employees, customers, and vendors. Guardian Applications core technology, Silhouette™, scrambles sensitive data from internal personnel who should not have access to this sensitive information. When evaluating approaches to protecting sensitive data, it’s important to understand the distinction between scrambling and encryption.

What is Scrambling?

Scrambling is the function of replacing a character (or byte) of data with a different character (or byte) of data. Simply put, typical scrambling technologies would replace, for example, an A with a G. While this example is very simple, it would be very easy for someone with a hacker mentality to figure out this simplistic way of scrambling. The Silhouette™ product from Guardian Applications actually uses random generation of characters to replace existing data with scrambled data. Because the characters are random in nature, a hacker will be unable to figure out what the original data was.

What is Encryption?

Encryption is a series of algorithms used to encrypt data into nonsensical characters (not in the English alphabet). Character strings are converted to a RAW type, and then passed to the encryption routine. The encryption routine uses a key to create a new pattern from the current data. The key is closely guarded by your administration staff and should never be given to any one. Because the encryption routine creates a new pattern, the encrypted data can be converted back to its original state with access to the key.

Recommendation for Oracle E-Business Suite (EBS)

While there are pluses and minuses to each way of protecting sensitive data, the preferred method to use with Oracle E-Business Suite is scrambling. The reasons are Oracle E-Business Suite has a difficult time interpreting the characters after using the encryption method. Ultimately, you want to be able to view and modify data through the Oracle EBS GUI. Once you have the encryption data in the database, the forms within EBS cannot use the data. The forms do not understand it causing many application errors. Since scrambling is just a character-to-character replacement, the Oracle EBS has no problems displaying the data and editing it.

The scramble method also makes it easier on the development staff in IT. A developer’s role is to support and develop code for the Oracle EBS. If the developer needs to write a report, they need to verify the output of the report has data exactly the same as what is on the forms. Encryption has nonsensical characters. Plus, a report has different values than what displays on the form. Thus, making it impossible to tie a report’s output to a form’s data. Scrambling the data will produced more desirable results.