Keeping stored data safe within company walls

BECU, Washington state's largest credit union, used to keep its stored data locked down using an appliance to encrypt data before it was stored to tape. But when it had the opportunity to upgrade storage equipment, the company chose a simpler, cheaper and perhaps more secure option -- an application that encrypts tapes in the tape library.

The appliance "was the best solution at the time," says Kathryn Antonetti, IT systems and security manager at Tukwila-based BECU, a not-for-profit financial cooperative with assets of more than US$8.5 billion. "Now encryption is being offered at virtually every layer." The switch eliminated maintenance and training costs for the appliance, and other headaches. "I had [three vendors] pointing fingers at each other" when the system had problems, she adds.

Protecting stored information is the next wave in data security. "We're starting to see more emphasis on data at rest," says Robert Rosen, former president of IBM user group Share and CIO at the National Institute of Arthritis and Musculoskeletal and Skin Diseases in Bethesda, Md. "It's kind of a no-brainer. If you've done it, your [data is] protected and you don't have to worry about it."

As companies upgrade their storage equipment, many are taking advantage of technological advances such as tape drive encryption, tape library encryption and enhancements in the way encryption keys are managed. There has also been progress in adopting the disk and tape encryption specifications of the IEEE P1619 standard, says James Damoulakis, chief technology officer at storage services provider GlassHouse Technologies Inc. "Still, it's fair to say that storage security has lost some momentum " because of policy and process limitations, says Damoulakis, who is a Computerworld columnist.

"There's a feeling that [data in storage] is a locked door -- so it's not a high priority," Rosen says. "But I think that's ultimately going to change with the turnover of equipment."

"Unfortunately, most companies wait until the problem exists before fixing it," says Ari Kaplan , a senior consultant at Datalink Corp. in Chanhassen, Minn., and former president of the Independent Oracle Users Group.

With data security breaches now costing companies $202 per compromised record, according to the Ponemon Institute, it's time to start locking down data at rest. Here are three techniques for protecting stored data.

Encryption

Gartner Inc. has found that companies that encrypt stored data do so because they have to, not because they want to. "There are regulatory compliance pressures -- PCI or HIPAA," says Gartner analyst Eric Ouellet, referring to the Payment Card Industry Data Security Standard and the Health Insurance Portability and Accountability Act. "Or it's the fear that the tape will fall off the back of the truck and you'll have a disclosure issue."

What's more, most encryption systems can get pricey. "When you're looking at the cost associated with this, whether it's the time to deploy or the amount of [labor] or the actual cost in dollars of the solution -- these things are not cheap," Ouellet adds.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.