|
Major data losses by large corporations have grabbed headlines and created a surge of interest in encryption.
In the past year, IT professionals have grown accustomed to opening their morning papers to stories about companies
losing backup tapes.
A sampling: In February, banking behemoth Bank of America Corp. confirmed it lost backup tapes containing the account information--including credit card and social security numbers--of 1.2 million government employees, including U.S. senators. In May, media and entertainment company Time Warner Inc. announced that 40 backup tapes containing data on 600,000 employees were lost during a routine shipment to an offsite storage facility by Boston-based storage and records management firm Iron Mountain. Citigroup Inc. followed suit in June with another tale of lost backup tapes, this time containing records for 3.9 million past and current customers, lost in transit by United Parcel Service (UPS).
Was data actually compromised? Perhaps. Were these companies' images tarnished? Most definitely.
IT professionals are starting to put in place technologies and procedures that will help their companies avoid becoming the next lost-backup-tape headline. "You watch the news, and you get very nervous about the data you're trying to protect," says Charlie Fulks, CEO at Credit Union Data Processing (CUDP) Inc., Farmington, UT, an application service provider that offers outsourced IT to credit unions in the Mountain States. CUDP began providing an encrypted backup service to its clients this year. "There was no regulation forcing us to do this, it was more of a preemptive thing," he notes.
Anecdotally, vendors also report a surge in interest in encryption products. "Before, there were people who had a specific need for encryption," says Mike Adams, group manager of Symantec Corp.'s Veritas NetBackup product marketing. "Now it's more for the masses."
The good news is that technologies to prevent data stored on backup tapes from getting into the wrong hands are readily available. Whether you use host-based software, your backup software's encryption capabilities or specialized encryption appliances, it's possible to keep information confidential if tapes are lost or stolen.
Furthermore, if you can demonstrate that encryption technologies are being used effectively, your company may be exempt from having to comply with legislation such as California's SB 1386. That law requires any person or organization doing business in the state, and that keeps personal information, to disclose any security breaches when there's a danger of personal privacy being compromised--but not if the data is encrypted. Similar bills have also been proposed in the U.S. Senate.
The bad news is that encrypting backup data degrades performance and requires additional management procedures. According to the Milford, MA-based analyst firm Enterprise Strategy Group, only 7% of businesses encrypt all their backup tapes. One reason for the low number may be storage professionals' lack of awareness of the problem and available solutions. But another reason may be that encrypting backup tapes is simply too onerous a task relative to what you stand to gain from it.
|
