Evaluating a Storage Security Solution

Evaluating a Storage
Security Solution Considerations and Best Practices for Securing Sensitive Data August 2006
© 2006 Decru. All rights reserved Evaluating a Storage Security SolutionIntroduction..................................................................................................................... 3 Why Should You Encrypt Your Data? ........................................................................... 3 How Much Would a Breach Cost Your Company?........................................................ 4 Vendor Evaluation .......................................................................................................... 4 Technology Solutions ..................................................................................................... 5 Infrastructure Support ................................................................................................. 5 Performance ................................................................................................................ 6 Cost ............................................................................................................................. 6 High-Availability ........................................................................................................ 6 Day-to-Day Management Overhead........................................................................... 7 Role-Based Administration......................................................................................... 7 Encryption Strength .................................................................................................... 7 Encryption Placement ................................................................................................. 7 Auditing and Logging................................................................................................. 9 Certifications............................................................................................................... 9 Vendor Interoperability............................................................................................. 10 Long-term Key Management.................................................................................... 10 Obtrusiveness to Infrastructure................................................................................. 10 Obtrusiveness to Your Processes.............................................................................. 10 Summary....................................................................................................................... 11 Appendix A - Other considerations when investigating Storage Security................... 12 Your Data...................................................................................................................... 12 What Portion of Your Data is Sensitive?.................................................................. 12 How Long do You Keep Your Data? ....................................................................... 13 What Rules and Regulations Must You Comply With? ........................................... 13 Your Processes.............................................................................................................. 14 What Processes are in Place Today?......................................................................... 14 Your People .................................................................................................................. 14 Appendix B- Storage Security Solution Comparison Checklist .................................. 15
© 2006 Decru. All rights reserved
Introduction The purpose of this document is to provide guidance into some of the factors you should consider when evaluating storage security technology and solutions. As with any security project, acquiring technology is not the only step to properly protecting your data. Part of this process should include an evaluation of the current processes and security controls in place, such as physical access controls, environmental controls, and administrative controls. While there is no single set of requirements that applies to all organizations, this document can provide some baseline considerations.
Why Should You Encrypt Your Data? Data in networked storage environments is significantly more vulnerable to unauthorized access, theft... [download for more]