Don't be the IT manager who lets unencrypted data go

Capturing top position in last week's Stupid IT Tricks Competition are the good folks at CardSystems Solutions in Atlanta. This company processes credit card and other payments for banks and merchants and, inadvertently, for hackers as well. Its unencrypted data was hacked last month, with the likely result that information on 40 million credit card accounts was compromised.

America Express, Discover, MasterCard, Visa, take your pick (somebody else apparently already has) were all affected. Check this month's credit card statements carefully when they arrive.

Questionable management of "secure data" is in the news far too frequently these days. Ameritrade, Bank of America, Citigroup, Lexus/Nexus, Time Warner, most of which I reported on last month, have all dropped the ball in recent months when it comes to data security. Oftentimes the data just "disappears" in transit to a third-party data repository like Iron Mountain; sometimes it goes missing when being shipped between facilities within the same company, and on frequent occasions, it is actively attacked from both inside and outside the firewall as was the case with CardSystems. In all instances listed above none of the data was encrypted, which certainly leads us to wonder about the seemingly cavalier attitude assumed by the companies to whom it was entrusted.

IT managers tend to avoid encrypting data for any of several reasons. In some cases, there is no corporate emphasis on security to support investment in encryption technology. More frequently, they are concerned that encryption will add to the time it takes to access or back up data, so amid all their other time constraints they avoid adding what seems to be another "cycle-sucker" to their operations. Most frequently, I suspect they just keep their fingers crossed and hope that when something hits the fan it won't occur at their shop.

Lots of alternatives are available to support encryption of data at rest. Security software vendors like Decru (acquired last week by Network Appliance), Neoscale and Vormetric offer solutions that can be dropped-in, appliance-like, in most environments. These will take care of protecting data on your storage-area network.

If your concern is about encrypting tapes to protect them while they travel offsite, consider the offerings from FalconStor and Intradyn.

If you are one of those companies whose back-up windows have been compressed to the point where you feel can't afford the extra time involved in encrypting your tapes, look at FalconStor's virtual tape libraries, a product set that would be suitable for medium and larger sites. They provide encryption capabilities on the VTL with the result that encryption can be done after the data has been transferred from the production systems. Because encryption is done on the nearline system, there is no impact on the back-up window.

Also, there is now no reason smaller companies should be less well protected than their larger competitors. Intradyn, maker of the RocketVault and ComplianceVault appliances that are aimed at smaller companies, is now bundling strong encryption (128 bit) software at no added charge into their products. They partner with Sony to provide a back-up solution that hangs off the back of their small appliances. As a result, now even a mom-and-pop shop can protect their back-up tapes more successfully than those very large companies mentioned earlier seem capable of doing.