Encryption: The Business Case for Protecting Data at Rest

WHITE PAPER
Encryption: The Business Case for
Protecting Data at Rest
NO VE M B E R 2005Encryption: The Business Case for
Protecting Data at Rest
CONTENTS
Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Business Requirements for Encryption . . . . . . . . . . . . . . . . . . . . . . . . . 4
Problem: Adding Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Solution: Hardware Encryption in Spectra Logic Libraries . . . . . . . . . . . . 7
The Encryption Business Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
BlueScale and Endura are trademarks, and Spectra, SpectraGuard and the Spectra Logic are registered trademarks of Spectra Logic Corporation. All rights reserved worldwide. All other trademarks and registered trademarks are the property of their respective owners. All library features and specifications listed in this white paper are subject to change at any time without notice.Copyright © 2005 by Spectra Logic Corporation. All rights reserved.
2Encryption: The Business Case for Protecting Data at Rest
Executive Summary
While network and Internet security have been addressed through rigorous authentication and encryption to restrict access to sensitive personal, financial, and medical information, data at rest remains vulnerable. Restricting access to data backups has been accomplished primarily by restricting access to the backup media. Yet a single backup tape might contain millions of credit card transactions, thousands of medical records, and multiple copies of a company's public and not-so-public financial data. A single backup tape can also fall off a truck, be mislaid in a warehouse, fit in a jacket pocket of a disgruntled worker, or be retrieved by dumpster divers after a tape has been discarded.
Compliance with privacy regulations and explicit legal liability for accidentally exposed information are forcing many organizations to revisit their protection procedures for backup data and media.
Several high profile examples have underscored the difficulty of the fortress approach. Companies with the most data tend to be the companies with the most sensitive data. It's unreasonable to expect that many thousands of backup tapes can be transported, stored, and discarded without a few that end up exposed to misfeasance or malfeasance.
A better solution is to encrypt the backup data, in the same way data is encrypted in network transfers. Like encrypted network data, this gives authorized users easy access while making it nearly impossible for unauthorized users to access data.
Encrypting data prior to storage can be accomplished in several ways, but most have substantive disadvantages in cost, performance, scalability, or management. Spectra Logic Corporation's BlueScaleT Encryption integrates hardware encryption directly into the electronics of a tape library, offering a practical, affordable, and scalable option. BlueScale exploits elements in the modular architecture of Spectra® libraries to provide an easy-to-manage encryption solution.
3Encryption: The Business Case for Protecting Data at Rest
Business Requirements for Encryption
A backup tape can contain a treasure trove of information that a network hacker can only dream about: company e-mail, customer databases, support databases, detailed sales and accounting figures, and salary and payroll data-all well-structured, accurate and complete.
Several recent, high profile cases have underscored the exposure and even driven new legislation to hold companies liable. A USA Today article dated June 13, 2005 listed several events this year including:
Š "CitiFinancial, which blamed UPS for losing data tapes with personal data for 3.9 million people last week, intends to start encrypting backup data in July."Š "[Bank of America], which lost data tapes for 1.2 million federal employees - including U.S. senators - in February, is testing encryption on backup tapes" Š "Shortly after it lost track of Social Security numbers and other data for 600,000 current and former U.S. employees in May, Time Warner decided to begin encrypting backup tapes." Š "[Ameritrade] loses up to 200,000 personal records on l... [download for more]