HEADQUARTERS: 1418 Aversboro Road, Suite 201 GARNER, NC 27529 TEL: +1 800 336 9793 (NORTH AMERICA)/+1 919 771 0657 FAX: +1 919 771 0457 EM: STAFF@PRISMINTL.ORG HTTP:/prismintl.org PRISM INTERNATIONAL EUROPEAN: SECRETARIAT KELLEN EUROPE AVENUE MARCEL THIRY 204 B-1200 BRUSSELS, BELGIUM TEL: +32 2 774 96 49 FAX: +32 2 774 96 90 EM: PRISM.EU@KELLENEUROPE.COM

PRISM Blog

Tape Encryption Eliminates Some Risks

posted on 04/23/2008

But Creates New Key Management Headaches
By
Jerome M Wendt

Pick up any major newspaper or check out any of the major news websites and it doesn’t long to find a headline about some company that has in some way had its data compromised. This can occur in any of a thousand possible ways: a hostile third party hacking into a company’s computer system through the Internet; a disgruntled employee copying data to a 32 GB flash drive; or simply a tape being lost or stolen. In any these scenarios, the immediate and long term impacts to a company of loosing control of data that is critical to its day-to-day operations are potentially significant.

I’ve personally been witness to one of these scenarios first hand. While working at a major financial institution a few years ago, some tapes that were in transit to a client site never showed up at their location. (In this case, it was not a records management provider that was handling the tapes but a third party shipping company.)

However what occurred internally at my company in trying to locate these tapes was almost comical if the situation had not been so serious. Individuals from my company were dispatched throughout the country to try to locate these missing tapes. Why? Because even though the shipping company had misplaced the tapes, the client still held my company responsible for locating them. These tapes had critical client data on them and my company had contracted with this shipping company to move the tapes. So our client held my company responsible for ascertaining what had happened to them.

Since these tapes were going to a remote destination by truck and plane, the individuals dispatched essentially had to check out every location that these tapes potentially could have been lost while in route to the client site. This included searching cargo holds in airplanes and trucks, shipping warehouses, airport runways and, if one individual is to be believed, even snow banks.

The point is that in circumstances like this, companies need a higher level of confidence that data stored to tape is inaccessible. In this case, if the data stored on tape had been encrypted, my company potentially could have been off the hook since no one could have theoretically accessed the data on the tapes.

This need for data security is prompting more companies to encrypt all of their data stored to tape. Accomplishing this is now easier than ever before. The latest versions of each of the leading tape formats (3592, LTO, T10000) give users the capability to encrypt data on the tape drive as it writes backup data to tape. Other options that companies also have for encrypting data include using enterprise backup software (CA ARCserve, CommVault Galaxy, EMC NetWorker, IBM Tivoli Storage Manager, etc) and encryption appliances (NetApp Decru, NeoScale, etc) especially built for this purpose.

Encrypting all data stored to tape sounds like a great idea but it’s not a no-brainer decision. On the surface, it’s easy to implement as it decreases the possibility of wild goose chases such as the one just described and companies can mitigate short and long term financial and legal risks since they can rightly claim to auditors and third party investigators that the data on the lost tapes was encrypted and inaccessible.

What companies can fail to account for when they encrypt the data is the difficulty in creating the encryption keys and then recovering the data later on. No matter which backup software, encryption appliance or tape drive that a company uses to encrypt the data, they all use essentially the same underlying encryption algorithm to encrypt the data. The differentiator in determining how secure the encryption is depends on the complexity and type of key provided to the encryption algorithm to encrypt the data.

Any of the available encryption algorithms (RSA, DES, Blowfish, IDEA, etc) need an encryption key provided to it in the form of a password. However if the password is one such as “password”, any potential hacker only needs to use the word “password” in conjunction with the appropriate encryption algorithm to access the data. This possibility is not so far-fetched. Though the likelihood of this scenario occurring using encryption appliances is almost nil, backup software and tape drives give users more flexibility in what passwords they create and use to encrypt the data.

Of course, any encryption is better than no encryption in terms of securing the data. The real concern is encryption key management which it the need to match the right key to the right backup tape. To recover the data, one must provide the appropriate password so the backup software, encryption appliance or tape drive can decrypt the data. While this is less of an issue if the same password is used all of the time for all of the backups, passwords are more than likely to change over time or even from backup to backup. In these circumstances, if the company fails to provide the right password for the backup, the data remains inaccessible and unrecoverable.

In these circumstances records managers might be able to help. The need to manage and provide the appropriate encryption keys at the point of recovery may create management overhead that your clients may not have initially considered when they started encrypting data. While encrypting data stored to tape helps protect both parties short and long term, offering encryption key management as a service can help ensure that your client can recover their data regardless of where they recover it. In my next blog entry, I’ll go into some specifics about the pros and cons of offering this type of service.

---

Lower Costs and Encryption Requirements Contribute to Tape’s Re-Emergence

posted on 03/17/2008

By Jerome M Wendt

Last month I pointed out that anecdotal evidence suggests that the role of tape media in enterprises was shifting. Even as companies start to use disk in lieu of tape as their primary target for backup, they continue to rely on tape for storing their data long term in an unalterable format. Since last month, I’ve obtained more tangible evidence supporting this point as well as other evidence that this shift back to tape media is creating new problems for companies and may impact records managers in ways hard to predict.

Some of the tangible evidence I ran across that supported last month’s anecdotal evidence was the results of a November 2007 survey that Fleishman-Hillard Research recently shared with me. Their report examined buyer perceptions of tape and disk technology and surveyed 206 companies with the following characteristics:

• 79% of the respondents had annual MIS budgets of over $500,000 and annual corporate revenues of over $50 million.
• 83% of all respondents were system network administrators
• A sampling of all industries (healthcare, retail, financial services, industrial, etc.) was taken

There were some statistics in this report that are worth pointing out. One was the downward trend in those customer accounts that only used disk. In the last year, these accounts decreased their use of disk by 13% for interim storage and by 6% for long-term storage. The survey also uncovered that in those companies that only use disk for interim storage (36 companies), 58% plan to reintroduce tape in the next five years. In those companies surveyed that only use disk for long-term archiving (37 companies), 68% plan to re-introduce tape in the same time frame.

While these numbers are encouraging and help to reinforce the belief that tape is not going anywhere, keep in mind that another branch of Fleishman-Hillard also handles press relations for the Ultrium LTO tape consortium which includes HP, IBM and Quantum. So the fact that its report showed that tape is coming back in small, midsize and large enterprises is not necessarily surprising. However I have no reason at this point to question the accuracy or percentages cited in its report.

I did follow-up with the representative spokespersons for vendors represented in this consortium: Bruce Master, Senior Program Manager, Worldwide Tape Storage Systems Marketing, IBM; Tom Hammond, Product Marketing Manager, Quantum; and Laura Loredo, Marketing Product Manager, HP. These individuals provided me its perspective on how the LTO consortium was interpreting the re-introduction of tape into customer accounts that had previously fully switched to disk.

They cited three primary factors as driving tape’s re-emergence:

• Data becoming less valuable over time
• More energy efficient than disk
• Encrypting data sent off site

Apparently companies who standardized on disk underestimated just how much data they actual generate and how fast it is growing. While keeping archive and backup data on disk provides sub-second response times, older data has marginal or no value to the business on a day-to-day basis and keeping it all on disk short or long term can become prohibitively expensive.

Apparently one client who completed the survey said that they had to cut a PO for a new $200,000 disk-based storage system every couple of months with no end in sight. Expenditures of this magnitude and frequency were unacceptable and tape was the most logical, cost-effective option to correct the situation.

Tape’s power savings also are becoming more important, especially in the Northeastern United States and on the West Coast. Customers in these regions of the United States as well as in Europe no longer have unfettered access to the power needed for new disk-based storage. These customers are making more storage capacity purchasing decisions based on how much power a device needs. Tape is getting the nod since it requires minimal or no new power.

Yet the growing need to encrypt all data sent off-site is becoming one of the biggest, if not the biggest, motivating factor for companies to continue using tape. The inclusion of encryption as part of the LTO-4 tape drive technology has simplified the process of encrypting data as it is stored to tape. Though companies can encrypt data at other points in the backup process, such on the server, on the backup media server or using an appliance, using a tape drive to encrypt the data makes sense since it is fast and it occurs at the exact moment when companies are preparing to send the data offsite.

The need to encrypt data sent offsite was more clearly brought to light by a recent class action suit filed against TJX Companies, the parent company of TJ Maxx department stores. The suit files for damages the pain and suffering endured by credit and debit card customers as a result of security breach.

The suit alleges that TJX Companies failed to maintain adequate security of consumer credit and debit cards and did not disclose a data security breach that occurred in 2003 for more than a month after the breach occurred. While the data hacked at TJX Companies was accessed through an online database, it is not stretch to believe that similar lawsuits could result from the loss or theft of tapes with unencrypted data. These types of cases are prompting more companies to act now and encrypt any data stored to tape.

Yet what companies may fail to consider as they react to these cases is that by encrypting data it makes the recovery of the data more difficult. A tape drive relies on something or someone external to it to provide it with a key to encrypt the data. The problem that exists now is that there is no standard method of creating encryption keys or managing them. Once companies encrypt the data, unless they have policies to ensure the key is available to decrypt the data when and if they need to decrypt it, this data becomes unrecoverable.

Encryption key management is already becoming a major point of concern for enterprise companies and may impact how they store and manage tapes long term. In what ways encryption key management of encrypted tape drives may impact records management providers will be examined in more detail next month.

---

Anecdotal Evidence Suggests the Role of Tape in Enterprises is Shifting

posted on 02/27/2008

By
Jerome M Wendt

In the last year an increasing amount of my workload as an analyst has turned to studying and analyzing new disk-based data protection technologies. Though this may come as no surprise to anyone who regularly follow the monthly blog entries that I prepare for PRISM International, it is easy to wonder when and if any of this will come to pass. Each month I tend to cover some new disk-based technology and then include some cautionary note about how disk will gradually replace tape. However some of you are undoubtedly wondering about the accuracy of this forecast since many of you continue to see your clients steadily increasing the number of tapes that they store with you.

So why should you heed my continual warnings that companies will backup more data to disk in the near future and that the amount of data backed up to tape may drop, possibly precipitously, in the next few years? Here are a couple of interesting stories to consider:

•Last week I spoke to Rick Clark, the CEO of APTARE. APTARE is a company that started out about five years ago providing backup reporting software for enterprise backup software products such as EMC’s NetWorker, Symantec’s NetBackup and IBM/Tivoli’s Storage Manager among others. Essentially what APTARE does is centralize reporting on the success and failures of enterprise backup jobs and help pinpoint why backup jobs failed. Because of this role in enterprise companies, APTARE is extremely close to the backup process in many enterprise companies. It also stands to loose much of its business should companies switch from tape to disk since much of their software’s revenue is based on monitoring tape-based backup. So it caused them to reconsider the direction of their company when, in a recent survey of its enterprise companies, APTARE found that 90% of them are planning to replace disk with tape as their primary target for backup in the next few years.

•A number of individuals who are members of PRISM International also participate in an email thread distributed by BareMetal Data. These email threads discuss topics ranging from how to handle the termination of client services to the site of the next BareMetal Data conference. However it was a recent post in an email thread that caught my attention. The individual who wrote the email stated that in the last few years his company started acting as a managed service provider providing online disk-based backup services to his customers. While he continues to experience single digit growth in his paper and tape business, he reports his online disk-based backukp business has grown by 3.5X in the last year. Of course, one needs to keep those numbers in perspective since at the beginning of any new service statistics can appear skewed since growing from 20 customers to 90 customers can produce these types of numbers but which are impressive nonetheless.

Granted, both of these stories are somewhat anecdotal and by themselves do not provide empirical evidence that the end of tape is just around the corner or that tape will ever die the death. However, I never get on the phone or meet with any vendor or user who tell me what a great experience they had with tape in the past week or how they wish they could expand their use of tape to more places in their enterprise. Rather all storage vendors are ramping up their disk-based data protection offerings while almost all users are taking a hard look at disk and trying to figure out how soon they can work disk into their data protection budget.

This also does not mean that every early adopter of disk-based backup that I speak to is thrilled about moving from tape to disk or that all of their experiences are positive. Many are finding new issues when they move to disk such as it costing more than they initially forecast, they cannot scale disk the way they can scale tape and there is no easy way to move data off-site when stored on disk. But these types of problems are, for the most part, not deterring these users from continuing to use disk. They are simply sucking it up and paying for additional capacity or features that deliver these functions because they do not view going back to tape as a viable option.

The move to disk as the primary media and target for data protection is undoubtedly beginning to occur. While this trend may not hit its full stride for another couple of years and does not spell the end for tape, records managers who derive much or all of their revenue from managing backup tapes need to understand and monitor how the use of tape is likely to evolve in the coming years. My opinion is that tape and other forms of removable media will more than likely taking on a greater role in the archiving and long-term preservation of corporate data. How removable media will play a greater role in corporate data archiving and how it affects you will be the focus of my next blog entry.

---

Legal Discoveries and Disk Storage Go Hand-in-Hand

posted on 01/28/2008

By Jerome M Wendt

In early January I received an email message from a concerned records management provider in the Midwest. He had just received notification from one of his largest clients – an insurance company in this case – that they no longer needed his company’s services. While he had lost clients before, this time the impact to his business was substantial as they were removing over 10,000 document boxes with archived records from his warehouse. His question to me: “Where do I go from here?”

The reasons behind his client’s decision to suspend the service are varied but can undoubtedly be traced back to two major factors: Rapidly dropping disk prices and laws that inadvertently punish companies for retaining records too long. This combination of improvements in disk storage prices and corporate interpretations of new laws are prompting companies to re-evaluate what media they store their data on or if they need, or should, keep their archived paper records at all.

While obviously the cost of storing data on disk has dropped significantly, that is probably not the primary driver for businesses storing more of their data on disk. Rather it is the cost of accessing and managing data not stored on disk. These costs and risks come to light should a company ever go through a legal discovery.

Many companies outside of government, healthcare and financial verticals are, for the first time, more directly affected by laws that stipulate how quickly they need to produce data. The recently updated Federal Rules of Civil Procedure (FRCP) defines more explicitly the time frame in which companies need to produce electronically stored information (ESI). Failure to produce corporate data that satisfy these legal discoveries that can result in additional penalties which outweigh whatever upfront savings storing data to paper initially provided.

During these legal discoveries, companies may need to pore over hundreds or thousands of paper documents. While that may not sound like a big deal, the reviewers are typically auditors and lawyers who are either internal staff or 3rd party firms. These reviews can take inordinate amounts of time for internal staff to perform while using 3rd party legal firms or experts can generate inordinately large fees.

Turning over all paper documents to the requesting party isn’t really an option either. These documents may contain and inadvertently expose information about the company that is not germane to the case, reveal corporate trade secrets or simply put the company at risk since the paper records may be needed during the daily course of business.

While moving all data to disk may sound like an easy out, this creates new data management issues that may exceed the costs of managing data on disk. Storing data on disk makes the data more accessible but companies still need software that manages the life of these files. This software needs to support policies that can define how long to keep specific files, who can access them, under what conditions, and when to delete and/or remove these files for access.

So what is a records management provider in this situation to do? Advising your clients to keep all of their archived paper records is probably not in your client’s best interest while recommending that they convert all of their data to disk is still a long way from a “push button” conversion. If anything this may cause your clients as many problems as it solves. So while there are no simple answers, here are a couple of action items you can take.

First, recognize that your clients are going to examine ways to keep less data and then better manage the data they are retaining. This may mean a transition to disk, keeping it all on paper or some combination of both. However expect them to put in motion plans to destroy all data beyond a certain age regardless of what media on which it resides – disk, paper, optical or tape. Regardless of what course of action they pursue, make sure your current and future service offerings match your clients’ needs. Ensure whatever systems that your clients use to track their data can interface with your systems so if and when your clients transition to use new forms of media that you are prepared to meet their needs.

Second, understand that the revised FRCP rules pose a new corporate liability for all archived corporate records. Even if you have not yet received that dreaded phone call that your client plans to pull hundreds or thousands of their boxes out of your warehouse, realize that large companies are studying the liabilities that these revisions to the FRCP and other laws pose their business and are ascertaining how to best manage and store their data long term. As your clients perform these studies, stay in close contact with them – including your client’s attorneys – so you know what sort of services that they need, how you need to be preparing to respond and possibly even provide them with some guidance.

My firm belief is that the most profitable and successful companies will, in the next few years, transition to storing more data on disk storage driven largely by new legal discovery requirements and only in part by lower disk prices. Though paper, optical and tape will clearly never go away, growing and profitable companies will want and need to store as much of their data on disk. This is driven by their need to satisfy these new legal requirements and making their data easily accessible to keep their knowledge workers as productive as possible at the lowest possible cost. Records management firms who are putting in place infrastructures and services to meet the needs of these clients should be well rewarded in the coming years.

---