|
Are you capturing sensitive customer information such as social security numbers, bank records, credit card information, or medical history? If you store this kind of information electronically, you need to take a serious look at how you protect your backups, especially if you store backup media offsite.
Who Needs AES Encryption for Backup Media?
Most organizations take considerable precautions to ensure the security of their computer networks. Physical access to the servers is limited. Networks are protected with cutting-edge technology. Access to data is restricted to authorized personnel. But these security measures protect data only when it is onsite.
Almost all backup strategies incorporate some form of offsite storage for disaster recovery purposes. Any entity that collects sensitive information-about customers, employees, business partners, or organization members-must closely examine how backup media is protected. How secure is your backup media when it goes out the door? Are you confident that your offsite data is protected if it falls into the wrong hands, or do you have a potential security breach waiting to happen?
If you are storing information on backup media that is not strongly encrypted, you could face damaging public disclosure, civil action, or even criminal penalties-not to mention public embarrassment and loss of confidence among customers-if offsite backups are lo st, stolen, or accessed by others. It?s amazing how easily tapes can disappear. The driver for a courier service forgets to lock the truck door, and a bump or a sharp turn in the road sends your tapes onto a city street. A forklift in a storage facility rips a hole in a storage carton, and your tapes tumble on to a loading dock.
Learning the Hard Way
In 2005, several high-profile financial institutions and corporations announced that backup tapes containing personal information about customers or employees were missing. The tapes were not encrypted and the personal information they contain remains in a potentially compromising position. Until the tapes are recovered, they could still fall into the wrong hands and the information they contain could be misused. The incidents were given extensive coverage in the news media. Time and effort were spent notifying individuals whose information was lost and ensuring that the lost information had not been used to gain unauthorized access to accounts.
Regulatory Compliance
As more personal data is being stored electronically, public concern is growing about the security of that data. In response, federal and state agencies-and even industry associations-are implementing regulations and guidelines to guarantee the safety of digital information and guard against identity theft.
These regulations affect not just large financial institutions or corporations. Many larger companies and institutions are requiring their business partners, associates, and contractors to implement secure encryption practices as part of the conditions for doing business. As more companies rely on electronically stored customer information, privacy and security regulations will affect more businesses over time. By using AES encryption to protect backup media, you can make it easy to comply with current regulations as well as any future regulations.
AES encryption is the strongest and most reliable method for complying with regulations governing the confidentiality of personal information on backup media. It prevents unauthorized individuals form accessing the information if media is lost, stolen, or misplaced. AES is the encryption standard selected by the U.S. government after a three-year competition. SMBs can be confident that their backups are being protected by using a strong encryption technology such as AES 128-bit or 256-bit encryption, the strongest cryptographic technology currently available.
The following sections describe major regulations and industry guidelines that can be successfully addressed using AES encryption.
Health Insurance Portability and Accountability Act (HIPAA)
California Senate Bill 1386
Payment Card Industry (PCI) Data Security Standard
Sarbanes-Oxley Act
Gramm-Leach-Bliley Act
Federal Information Security Management Act
|
