New tape encryption options await you

Computerworld -

Over a year ago, I wrote a column questioning the level of commitment to storage security within organizations (see "Do We Really Care About Storage Security?"). With growing pressures to contain cost, manage growth, and improve data protection and availability, it's easy to understand why security gets pushed down the stack despite the huge potential business impact of a security breach.

The facet of storage security that is, by far, most likely to receive attention is backup tape encryption. Although there remains more talk than action even in this area, it is important to point out that vendors have not been standing still. A year ago, the most promising encryption options were via special purpose devices from companies such as Decru Inc. (now a division of Network Appliance Inc.) and NeoScale Systems Inc. These companies have continued to evolve and improve capabilities with particular emphasis on enhancing and simplifying key management, the most critical stumbling block in the encryption process.

At the same time, tape drive and library vendors are also making progress on the encryption front. Drives already perform functions like data compression, so doesn't it also make sense for them to encrypt data as well? As a result, vendors such as IBM, Sun Microsystems Inc. and Storage Technology Corp. have added encryption options to their top-of-the-line (those costing more than $35,000) tape drives, but what about encryption for the rest of us? First into the foray was Spectra Logic Corp. with library-based encryption, followed by other library vendors, some in partnership with the aforementioned encryption appliance vendors.

However, the most widely anticipated advancement in the midrange tape drive arena of late has been the embedded encryption capability in the newest generation of linear tape open technology, LTO 4 (see "New Tape Specification 50% Faster With 800GB"). Last week, IBM became the first to deliver on this promise both with its own LTO 4 drives and libraries as well as a Dell-branded variant. IBM's Java-based key manager, which provides the key management for its TS1120 drives will also support their LTO 4 offerings (see "IBM Introduces LTO 4 Technology, New Virtual Tape Library"). I expect other LTO vendors to quickly follow suit.

Until recently, some organizations may have felt justified in maintaining their wait-and-see attitude toward encryption, and even now some reluctance may remain pending finalization of the IEEE P1619 encryption standards. However, as more vendors are stepping up to the challenge, the time for procrastination is waning. The risks and regulatory exposures aren't going away, and the day will soon be here when if you're still not encrypting critical data, you'd better have a good answer to the question: why not?

Jim Damoulakis is chief technology officer of GlassHouse Technologies Inc., a leading provider of independent storage services. He can be reached at jimd@glasshouse.com.

Read more about Storage in Computerworld's Storage Topic Center.