Choosing the best way to encrypt data

Choosing the best way to encrypt data

Besides storing the media in a safe place, what security preparations would you recommend someone use who is planning to archive data for more than 10 years? Specifically, I would like to encrypt the data and I am wondering about the best choice of algorithm, key generation and length, and key management.

    Requires Free Membership to View

    Login

    When you register for SearchStorage.com, you’ll also receive targeted emails from my team of award-winning editorial writers. Our goal is to keep you informed on the hottest topics, the latest news and the biggest challenges you face as a storage professional today.

    Rich Castagna, Editorial Director

    By submitting your registration information to SearchStorage.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchStorage.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Before answering your question, I would suggest you analyze the "safe place" for the media storage. Is it just (only) physically secure or do you have intercepts such as firewall and intrusion detection protections?

Back to your question - for data archive, encryption is the first step. Here, the challenge is the storage of keys for long periods of time. One approach is to let the customer own and retain the keys - which can be done on some of the smart cards. However, key storage, both the number of keys and the duration of key storage, can pose a challenge. For encryption algorithms, 3-DES in CBC mode is commonly recommended for storage data (of course, it all depends on how secure you want your data to be). AES in CBC mode is another possibility. DES in CBC mode is now considered weak.

The next step after encryption is the support for ensuring data integrity using digital signature technologies. While encryption protects the confidentiality, it does not ensure integrity of the data.

There are also some aspects of the recent HIPAA regulations that specify certain levels of security for the healthcare records. You may want to consider that for your data archives.

Finally, you must develop and enforce sound security policies that meet the customer requirements.

Sorry, there are other considerations too, but this should give you the high level picture.

Editor's note: Do you agree with this expert's response? If you have more to share, post it in our .20PdajkXdac^0@.ee83ce2!viewtype=&skip=&expand=>Administrator Central discussion forum.

This was first published in January 2002