Who’s minding the data store?

Encrypting e-mail is a good start, but it doesn’t address the security of data sitting on servers and back-up systems. And it doesn’t protect data being transported to offsite back-up facilities, a lesson several companies learned the hard way this year when their tapes containing sensitive customer information were lost in transit.

That is one reason many analysts recommend that companies encrypt sensitive data wherever it sits on the network. According to Gartner analyst Rich Mogull, encryption makes sense for backup tapes, laptops, PDAs or other portable storage media containing sensitive information, as well as credit card numbers stored in databases.

Losing tapes is nothing new, says Dave Ellard, senior vice president of corporate development at GlassHouse Technologies. “We’ve been moving and losing tapes for 30 years, but we never had to issue press releases before when we lost a tape.”

In other words, the key difference today is regulations. Privacy regulations include legislation that either strongly encourages some form of encryption of sensitive data or, as is the case with the credit card industry’s latest Payment Card Initiative (PCI) standard, formally prescribes the use of encryption.

Then there’s California Senate Bill 1386, which requires that companies publicly disclose instances where they believe unencrypted personal information about California residents might have been compromised. The bill has led many companies to believe that encryption could keep them out of the headlines.

A 2004 Gartner report predicted that by the end of 2007, 80% of Fortune 1000 companies would encrypt most of their critical data at rest. “We’ve since updated this assumption and now predict that by the second quarter of 2006, 85% of large enterprises will have initiated encryption projects,” Mogull says.

Slow on the uptake

Yet statistics on the current state of encryption, show surprisingly low current adoption rates. Research conducted by the Enterprise Strategy Group (ESG) showed that 60% of respondents never encrypt back-up data going to tape (see graphic, below). A March report on database security by Noel Yuhanna, a senior analyst, also showed only four of the 24 companies surveyed used encryption of data at rest (see graphic, right).

Jon Oltsik, an ESG analyst, says companies underestimate the potential risk of a data breach and overestimate the amount of work and cost required to encrypt tapes. He also acknowledges that the sheer number of ways to encrypt data at rest contributes to slow adoption.

Chuck Hollis, vice president at EMC, says the decision about what data to encrypt should stem from a data classification exercise.”If I had just one application that talked to credit card data, I might make the case of having that application encrypt the data. If all applications do that . . . you might want to go with a [storage-area network ]encryption alternative,” he says.

Other encryption hurdles include issues of management and potential performance. Oltsik says performance has been addressed by hardware-based encryption appliances from Decru, NeoScale and Kasten-Chase, which encrypt data as it is being backed up to a tape.

The emergence of more native database management systems and third-party encryption products also might encourage more organizations to bolster database security,Yuhanna says. He cites Application Security, IBM, nCipher, NetLib, Oracle , Protegrity and Vormetric as some of the DBMS players that provide encryption of data at rest for database systems. Oracle has also strengthened its own database-level encryption functionality.

Encryption in action

Many service providers who store customer data have tackled the encryption issue. Phase Forward stores and manages clinical trial data for many of its customers in facilities across the country and is subject to Food and Drug Administration privacy rules.

Brian Dodds, a senior infrastructure architect, says Phase Forward decided to use Veritas NetBackup 5.0 software to provide host-based encryption of all data going to back-up tapes.

Dodds found that total back-up time did increase, but he was able to recoup much of the performance hit by optimizing his backup routine and reducing the number of full volume backups he performed.

On the plus side, Dodds found implementation of NetBackup easier than other methods, because it did not require changes to current applications. “We get audited quite a bit. All of the machines and the software we use for customers needs to adhere to standards. To change our product is generally a lot more intensive work on everyone’s plate than it is to add something new on the backend. We decided encryption on the backups would be easier to implement, as it was just a matter of flipping a switch on NetBackup.”

At the Center for the Evaluative Clinical Sciences (CECS) at Dartmouth Medical School in Hanover, N.H., researchers conduct studies using several years of Medicare patient data. According to operations director Vincent Fusca, CECS also receives quarterly updates of Medicare patient data shipped on standard IBM cartridges. These updates represent an additional 18G bytes of data to be added to the CECS Medicare data collection, which totals more than 7T bytes.

Because the data includes sensitive personal and healthcare information, it naturally falls under the Health Insurance Portability and Accountability Act, guidelines aimed at protecting the privacy of medical records. This is the main reason Fusca looked at encryption with security vendor Decru, which has since been acquired by Network Appliance . Given the nearly $11 million that the center had received for ongoing research involving the data, Fusca says his encryption costs, which he estimated at about $75,000, were well worth the investment.

Once the Medicare data arrives, it is backed up to Sony AIT tapes. In the process, the data passes through a cluster of Decru DataFort E-series appliances, where it is subsequently encrypted. Thus, CECS can maintain a fully encrypted library of more than 7T bytes of Medicare data on tape. Fusca and his team have also designed the CECS architecture, which includes Network Appliance network storage, to take advantage of DataFort’s combined access controls, authentication and encryption capabilities.

“Data now flows all through the system, encrypted up until the time it comes out on the user’s Linux box,” Fusca says. “The process is totally transparent to the users, and there is no lag time in the processing of the data to their screen.”

Fusca favors hardware-based encryption, largely because of his prior experiences with software-based approaches. “We’d been through all those games before [with software-based encryption], and thought there had to be a better way to do encryption,” Fusca says. He was referring to prior challenges managing encryption keys, the ongoing risk of keys being compromised, and the difficulty of synchronizing clients to ensure all ran the latest version.

Canadian accounting firm RSM Richter decided to use Application Security’s DBEncrypt to encrypt a few SQL Server database fields in its Microsoft Great Plains software-based human resources system. DBEncrypt met one of the key requirements of HR to protect sensitive employee and salary data stored in the system, guarding against potential access by a database administrator.

“At the time of implementation, some users in the HR department preferred the option of supporting the product themselves,” says Margarita Muratova, system administrator. “They didn’t want IT to be involved, because they wanted to keep the data totally confidential. DBEncrypt allowed us to do that.”

MonsterCommerce.com, an e-commerce hosting service provider for more than 5,000 online merchants, recently upgraded its security architecture to better meet the PCI standard. It turned to Nigel Tranter, a partner at Payment Software Co. (PSC) of San Jose, which performs certified PCI audits for card companies. Tranter recommended that MonsterCommerce switch from its homegrown credit card encryption system to one using Linux-based proxy servers installed with a nShield encryption card, or hardware security module, from nCipher.

Multiple proxy servers now sit between the Web front-end servers and the company’s SQL Server database. Each proxy server handles more than 11,000 transactions per minute for customers of MonsterCommerce.com. An API allows the proxy server to send an encrypted string of user’s credit card account number straight to the underlying database. This data remains encrypted when the database is backed up to tape. Encryption key management, a big challenge with MonsterCommerce’s prior system, now is handled entirely by nShield using such features as “smart cards” to safely reconstruct a key. Initial cost to implement this system was about $25,000.

Megan Buckley, head of software development at MonsterCommerce.com, adds, “As an e-commerce industry leader, it was important to increase the confidence of our clients that we were doing the best for security, and also help consumers feel comfortable that their online transactions are safe. A smaller company without much experience with encryption now has this process taken care of for them,” she says.

Hope is a freelance writer who covers IT issues in enterprise storage, networking and security. She can be reached at mhope@thestoragewriter.com.