Computerworld - Events such as the theft of a laptop PC containing personal information about thousands of a Rhode Island bank's customers have put a spotlight on the importance of encrypting stored data.
But IT security professionals said that substantial logistical and management issues, as well as the relative immaturity of encryption support in databases and operating systems, make the task a daunting one.
In the Bank Rhode Island case, the names, addresses and Social Security numbers of about 43,000 customers were stored in a laptop that was stolen from the Providence-based bank's principal data-processing provider, Fiserv Inc. The data was password-protected but not encoded . After the theft, Bank Rhode Island's CEO said its IT department will install encryption software on all computers.
That incident came on the heels of one at the Los Alamos National Laboratory in New Mexico in which nine floppy disks and a large-capacity hard disk containing classified information were reported missing after a routine inventory check .
The growing problem of identity theft lends urgency to the need to protect stored information, said Gartner Inc. analyst John Pescatore. Regulatory requirements for data confidentiality are also driving changes, Pescatore said. For instance, companies that encrypt data are exempt from the provisions of California's SB 1386 privacy law in the event of a database breach.
The potential for data theft by insiders—an even more serious problem than virus attacks and network intrusions by hackers—is another incentive, said Kevin Brown, a vice president at Decru Inc., a data encryption technology vendor in Redwood City, Calif.
Washington-based SwapDrive Inc., which provides online data backup and storage services to more than 150,000 corporate and individual users, is using Decru's DataFort device to protect medical and financial information as well as other customer data.
DataFort encrypts and decrypts data flowing between SwapDrive's application servers and its EMC Corp. storage systems. The process is transparent to end users, with all key management functions being handled by Decru's appliance, said SwapDrive CEO David Steinberg. "It's given our users a lot of peace of mind," he said, noting that DataFort also boosts SwapDrive's ability to attract higher-end customers that need more robust security.
Vormetric Inc. in Santa Clara, Calif., also sells encryption technology designed to safeguard data on devices such as PC disks, said Van Nguyen, director of IT security at a Mountain View, Calif.-based high-tech firm that he asked not be named. The company, which has more than 300TB of stored data distributed across offices in 30 countries, uses Vormetric's CoreGuard products to protect its own intellectual property and that of its customers.
"It protects our data while it's stored, while it's in transit and while it resides on a developer's workstation," said Nguyen. CoreGuard encrypts and controls access to the data and also logs and audits any attempts to compromise the information, he said.
But using encryption to protect stored data isn't easy, said Dennis Szerszen, an analyst at Hurwitz & Associates in Cambridge, Mass. The process can involve substantial changes in the way data is stored, accessed and backed up, he said. Large-scale encryption can also change how applications interact with one another, Szerszen added. And the management and administration of encryption keys can be another big issue.
"There have been a number of very large logistical issues that have prevented people from taking an interest in this," Szerszen said. Until recently, many IT managers thought that not encrypting data was a better option than encrypting it was, he said.
Free Insider Guide