Today's focus: Don't be the IT manager who lets unencrypted data go

By Mike Karp

Capturing top position in last week's Stupid IT Tricks
Competition are the good folks at CardSystems Solutions in
Atlanta. This company processes credit card and other payments
for banks and merchants and, inadvertently, for hackers as well.
Its unencrypted data was hacked last month, with the likely
result that information on 40 million credit card accounts was

America Express, Discover, MasterCard, Visa, take your pick
(somebody else apparently already has) were all affected. Check
this month's credit card statements carefully when they arrive.

Questionable management of "secure data" is in the news far too
frequently these days. Ameritrade, Bank of America, Citigroup,
Lexus/Nexus, Time Warner, most of which I reported on last
month, have all dropped the ball in recent months when it comes
to data security. Oftentimes the data just "disappears" in
transit to a third-party data repository like Iron Mountain;
sometimes it goes missing when being shipped between facilities
within the same company, and on frequent occasions, it is
actively attacked from both inside and outside the firewall as
was the case with CardSystems. In all instances listed above
none of the data was encrypted, which certainly leads us to
wonder about the seemingly cavalier attitude assumed by the
companies to whom it was entrusted.

IT managers tend to avoid encrypting data for any of several
reasons. In some cases, there is no corporate emphasis on
security to support investment in encryption technology. More
frequently, they are concerned that encryption will add to the
time it takes to access or back up data, so amid all their other
time constraints they avoid adding what seems to be another
"cycle-sucker" to their operations. Most frequently, I suspect
they just keep their fingers crossed and hope that when
something hits the fan it won't occur at their shop.

Lots of alternatives are available to support encryption of data
at rest. Security software vendors like Decru (acquired last
week by Network Appliance), Neoscale and Vormetric offer
solutions that can be dropped-in, appliance-like, in most
environments. These will take care of protecting data on your
storage-area network.

If your concern is about encrypting tapes to protect them while
they travel offsite, consider the offerings from FalconStor and

If you are one of those companies whose back-up windows have
been compressed to the point where you feel can't afford the
extra time involved in encrypting your tapes, look at
FalconStor's virtual tape libraries, a product set that would be
suitable for medium and larger sites. They provide encryption
capabilities on the VTL with the result that encryption can be
done after the data has been transferred from the production
systems. Because encryption is done on the nearline system,
there is no impact on the back-up window.

Also, there is now no reason smaller companies should be less
well protected than their larger competitors. Intradyn, maker of
the RocketVault and ComplianceVault appliances that are aimed at
smaller companies, is now bundling strong encryption (128 bit)
software at no added charge into their products. They partner
with Sony to provide a back-up solution that hangs off the back
of their small appliances. As a result, now even a mom-and-pop
shop can protect their back-up tapes more successfully than
those very large companies mentioned earlier seem capable of


Security breach may have exposed 40 million credit cards
IDG News Service, 06/20/05

Copyright Network World, Inc., 2005

Questions or problems regarding this web site should be directed to abeckman@outdoorssite.com.

Copyright 2008 Art Beckman. All rights reserved.

Last Modified: March 9, 2008