Protecting Backup Media with AES Encryption

Protecting Backup Media with AES Encryption Abstract: Although most businesses scrupulously protect the personal customer information that they collect and store onsite, companies often do not consider the security issues involved when sending backup media to offsite storage for safekeeping. As recent news coverage has shown, offsite media can be lost or stolen while in transit, exposing sensitive information to potential misuse. By using AES encryption on backup data, a business can feel confident that sensitive customer information will remain safe and secure, even if the backups tapes are lost of stolen.
11/07/05
Applied Technology 0 Copyright © 2006 EMC Corporation. All rights reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. 2EMC , EMC, and Retrospect are trademarks of EMC Corporation. All other trademarks used herein are the property of their respective owners. All other brand names are trademarks or registered trademarks of their respective owners. [S70140106V1]
Protecting Backup Media with AES Encryption Applied Technology 1
Table of Contents Introduction.........................................................................................................3 Who Needs AES Encryption for Backup Media? .............................................3 Learning the Hard Way................................................................................................................ 3 Regulatory Compliance................................................................................................................ 4 Health Insurance Portability and Accountability Act (HIPAA) .................................................. 4 California Senate Bill 1386....................................................................................................... 4 Payment Card Industry (PCI) Data Security Standard............................................................. 4 Other Regulations .................................................................................................................... 5 Using Backup Software Certified for AES Encryption.....................................6 How AES Encryption Works ..............................................................................6 Common Sense Guidelines for Pass Codes.....................................................7 Selecting a Strong Pass Code..................................................................................................... 7 Avoiding Weak Pass Codes......................................................................................................... 7 Guarding Your Pass Code........................................................................................................... 7
Protecting Backup Media with AES Encryption Applied Technology 2
Introduction Are you capturing sensitive customer information such as social security numbers, bank records, credit card information, or medical history? If you store this kind of information electronically, you need to take a serious look at how you protect your backups, especially if you store backup media offsite.
Who Needs AES Encryption for Backup Media? Most organizations take considerable precautions to ensure the security of their computer networks. Physical access to the servers is limited. Networks are protected with cutting-edge technology. Access to data is restricted to authorized personnel. But these security measures protect data only when it is onsite. Almost all backup strategies incorporate some form of offsite storage for disaster recovery purposes. Any entity that collects sensitive information-about customers, employees, business partners, or organization members-must closely examine how backup media is protected. How secure is your backup media when it goes out the d... [download for more]