Iron Mountain partners with Decru for data encryption

Computerworld - Iron Mountain Inc. announced this week that it has signed a deal with Decru Inc. to use its technology to encrypt all of its internal data backed up to digital tape. Iron Mountain executives said the move is in part designed to set an example for customers.
"We're trying to make sure the industry is aware that encryption is a key technology to be embraced," said Kevin Roden, CIO of Boston-based Iron Mountain.
Since February, security breaches have led to the loss of unencrypted data from a number of companies, including Bank of America Corp., Ameritrade Holding Corp., ChoicePoint Inc., LexisNexis Group and Time Warner Inc. In Time Warner's case, tapes that contained private information on 600,000 former and current employees were lost in May during a routine shipment to an Iron Mountain off-site archival facility (see "Missing backup tapes spur encryption at Time Warner").
Roden recommended that large companies use a hardware-based encryption device like Redwood City, Calif.-based Decru's DataFort appliance, because it balances efficient backup and recovery with the need to secure data via encryption. Decru is currently the market leader in the technology, Iron Mountain said.
Even with Iron Mountain taking a stand on the issue, some users at the Storage Decisions conference in New York this week remained unconvinced of the need for encrypting data at rest.
"My company doesn't have regulatory issues with things like Sarbanes-Oxley. I don't have those concerns," said Daniel Sze, vice president of infrastructure at the Courtroom Television Network LLC in New York. Sze said his IT department manages about 50 servers and 10TB of data on direct-attached storage.
Leonard Lu, a network architect at TD Waterhouse Group Inc. in New York, said his data network provides security for data while it's in transit. In weighing whether to encrypt data while it's at rest, Lu said he saw that as simply too much of a hassle. "The question is, do we want to encrypt data right down to the last digit?" he said.
Iron Mountain said that while there are several options for implementing encryption -- including backup software and application-based technology -- large companies with expanding volumes of information and shrinking backup windows need faster throughput for backing up data.
"We had to find a solution to encrypt our data and still maintain backup windows. That ruled out software-based encryption, which introduces substantial overhead," Roden said. "That led us down the path to appliance-based solutions."

Read more about Security in Computerworld's Security Topic Center.