Crypto Agility at Meridian Claims

Encrypting every column is a large, slow change that mostly duplicates protection TDE already provides. TDE protects data files and backups if the media or storage account is stolen; application-level encryption on top adds protection against a DBA reading plaintext, but it does not stop an attacker who compromises the application, because the app holds the keys and decrypts on the way out. SQL injection through the application returns plaintext just as before. Encrypting all columns also breaks range queries, indexing, and reporting, which explains the 30% performance estimate, and it expands the key management problem from one key to hundreds.

A better target is field-level protection for a small set of high-value attributes: Social Security number, bank account, and free-text clinical notes, using tokenization or deterministic encryption where exact-match lookup is needed and randomized encryption elsewhere. Keep TDE as the at-rest baseline, add TLS enforcement for transit, and invest in database activity monitoring, least-privilege accounts, and row-level access controls. That addresses the regulator's question about at-rest and in-transit protection while keeping performance and scope manageable. Present the eight-month estimate honestly, but propose a four-week pilot on the three highest-risk fields to prove the model.

The scanner cannot speak TLS 1.2, so terminate TLS in front of it. Put a reverse proxy or load balancer that supports TLS 1.2 and 1.3 between the scanner and the partner endpoint, and place the scanner on a dedicated branch VLAN with an ACL that permits only the proxy. The proxy enforces modern cipher suites and certificates; the scanner-to-proxy hop stays inside a controlled segment. That satisfies the contractual requirement for the partner-facing connection while the firmware is pending, but it must be documented as a compensating control with an expiry date and a risk acceptance signed by the CISO. Add certificate pinning or mTLS to the proxy where the partner supports it, log all sessions, and monitor for anomalous claim volumes. In parallel, hold the vendor to a written remediation date and test firmware in a lab first. Do not simply enable TLS 1.0 on the partner side or ask for a permanent exception, because the regulator is already asking about transit encryption. If the proxy cannot be deployed in time, the fallback is to move scanner traffic to a managed file transfer service, which changes the integration but removes the legacy device from the partner path.

The concrete risk is loss of separation and blast radius. One key for 14 applications means a compromise in the least sensitive application yields decrypt capability over all 14 datasets, including claims data. Developers with kms:Decrypt in production can read any ciphertext they can obtain, which defeats the purpose of encryption against insider and credential-theft threats, and it leaves no attributable trail beyond CloudTrail entries that are rarely reviewed. Manual rotation four years overdue compounds it, because a leaked key cannot be retired without re-encrypting everything at once.

Target architecture: per-application, per-data-classification keys under envelope encryption, with a distinct key for claims data and separate keys per environment and region. Grant decrypt only to the application's runtime role, never to human identities, and remove standing developer access in favor of break-glass with approval and alerting. Enable automatic annual rotation, and use key policies plus grants to enforce separation of duties between key administrators and key users. For the regulator, produce evidence: key inventory mapped to data sets, access reviews, rotation logs, and CloudTrail alerts on decrypt by unexpected principals. Crypto-shredding becomes possible when each dataset has its own key, which also helps with deletion requests.