Practically every week the news is filled with horror stories of poor data security. Someone loses a media tape and with it goes all of IBM's retiree information. A hacker gets into TJX's customer records and the firm is inundated with bad press and lawsuits. Yet protecting against these happenstances is actually fairly straightforward. Let's first look at where data storage policies have failed in recent years.

The folly of physical tapes

Not long ago, most companies simply stored all data, regardless of its sensitivity or importance, off to data tapes. However, storing data on physical tape and transporting those tapes is asking for trouble. Think of the myriad opportunities for the tapes to be lost, damaged, or stolen along the way. The system operator saves data to tape, and leaves the tapes at the receptionist's desk, where they languish for hours or even days waiting to be picked up by the records management company. Then the tapes are relinquished into the hands of a low-wage driver, who continues to pick up tapes from numerous other businesses along his route. At the end of the day, all of the tapes are transported into a huge warehouse, often the size of several football fields in length. If the record center administrator transposes one number when entering the tapes in the system, it becomes virtually impossible to track down the right media should it be needed down the road.

Such errors happen with alarming frequency. In January, GE Money, the firm hired by JC Penney to run its credit card operations, had to alert the public that it was missing a backup tape containing the personal information of approximately 650,000 shoppers of JC Penney and other merchants. It is unclear whether the data was encrypted. This was not the first time that the firm's records management company lost tapes.

This past fall a large records management company said one of its drivers lost an entire case full of backup data, which turned out to hold information about applications for federal student aid in Louisiana submitted between 1998 and 2007. This meant the bank account information and Social Security numbers of nearly all Louisiana college applicants and their parents had been compromised. And in 2005, Time Warner announced that personal information for approximately 600,000 current and former employees had been lost, when its record management company was transporting the company's backup tapes to an offsite storage facility.

Errors may occur simply by mistake, but the process is also rife with opportunities for someone with ill intention to destroy or steal company information should they be so inclined. While this may sound preposterous, it is an all too common occurrence. Companies the likes of Pfizer, Disney, and Morgan Stanley have been victims of data theft by individuals working within their own organizations. And according to a recent International Information Week survey, an astounding 45 percent of respondents admit that they've taken data with them when they left a job, either by means of email or walking out the door with a peripheral storage device in their bag or pocket.

Legislating data security

Businesses aren't reporting these security breaches out of the goodness of their heart. Recently passed legislation requires companies to promptly disclose unauthorized access to personal information, be it their clients' or employees'. And legislation won't stop there. The alarming rate of identity theft cases spurred Congress to propose a bill that would hold companies accountable for instances of identity theft within their own establishments. This national law would carry fines of up to $50,000 per day. In 2007, many states sought to strengthen consumer protections by expanding the definition of identity theft and law enforcement's role in investigating cases. The state of Illinois, for example, amended the criminal code to include identity theft. The state of New Hampshire passed a bill that empowers victims of identity theft to bring private action for damages.

A better approach to safeguarding information

To curb rampant problems with data loss and theft, many businesses are logically moving away from traditional tape storage and toward electronic data vaulting. This approach involves transmitting data via an open system communication link to a remote disk subsystem at a disaster recovery site. Data vaulting technology based on TCP/IP also has a major advantage in that there is zero chance of data being lost.

Data is encrypted before and after it is stored, preventing the opportunity for theft. Instead of relying on IPsec devices that encrypt data as it is being transmitted and unencrypted it when it is received at the intended location, it is prudent to encrypt data as it is being written initially-preventing unauthorized access to data, regardless of whether it's in transit or at rest.

This is not to be confused with "dual writes," which involves backing up data with tape drives at multiple sites. That approach is cost prohibitive, as it requires special channel extension equipment and costly bandwidth between the originating site and the recovery site.

Electronic data vaulting also enables companies to retrieve stored data much faster than previously possible. Typically, businesses backed up data once a night and then sent these tapes offsite. However, by the time the tape was retrieved, delivered back to the site, and restored in the system, this took up to three or four days' time. And much like an audio cassette tape, data tapes had no way to quickly hone in on exactly the bit of information you're looking for. Thus, finding the right data takes up even more time. Alternatively, with data vaulting, information sent to "virtual tape" is available for retrieval from the disaster recovery site immediately. Using virtual tape controllers that emulate traditional tape drives enables operators to continue to use the same backup processes they're familiar with, so it is transparent to them that they're using another device.

Virtual tape approaches

Virtual tape can take advantage of a number of storage approaches:

- Asynchronous replication, where the backup data is written to the local disk drive. After the backup is complete, a separate job is executed to copy the local disk drive to a disaster recovery site.

- Synchronous replication, where the backup file is written to the local disk drive and is immediately replicated to the disaster recovery site. In this instance, two exact images are retained at two sites. However, this method may prove slower since the replication has to complete before the next write is sent to the local disk. Transmission times become the gating factor in performance.

- Secure site storage, where the backup application writes to disk that is located in a secure bunker site, which is usually within a few miles of the primary site. If a disaster occurs, the company will "read" the data at the secure site from the disaster recovery site via an IP connection. Many vendors offer bandwidth-on-demand services, so that clients need only consume bandwidth and related costs in their recovery operation. This method is appealing because it minimizes transmission costs while keeping data secure.

Regardless of the method of data vaulting, it's important to compress data prior to transmission to drive down bandwidth costs. Uncompressed data requires up to two times as much space and takes twice as long to vault as compressed data. However, compressing and then encrypting data should be provided with your backup utilities and is easy to do. Some programs such as SQL Backup from Red Gate Software provide both compression and encryption.

Data can either be encrypted using software or specialized hardware. Encryption appliances offer greater speed and flexibility but at a higher price tag. Encrypting data with software is economical but takes longer. Encryption itself is a very compute-intensive process. Organizations concerned about tight backup schedules may prefer hardware encryption techniques. These devices can generally encrypt any type of data, no matter the operating system or file structure it originated from.

Segregating mission-critical data

Another useful approach for protecting sensitive information is the process of data classification. Traditionally, backups contain every conceivable type of data. This blanket approach to data storage results in highly sensitive information being intermixed with non-essential data. In recent years, however, we've seen the emergence of technologies that can segregate information based on its level of importance. This frees organizations to isolate top-priority data and assign archival and retrieval methods based on its level of importance. By classifying data, businesses can create virtual information silo.

A company might choose to mirror high-priority information and relegate very low priority records to tape. Archiving based on classification type not only cuts down on data archiving costs, it gives organizations the ability to enforce security guidelines. For example, mainframes have the ability to assign high-level qualifiers to data sets so that any sensitive information within the system is automatically identified and encrypted prior to transmission. This way the company no longer needs to be concerned about employees forgetting to encrypt a file.

Conclusion

It is all too easy for companies to discount concerns about data theft, thinking "it won't happen to us." But the sea of highly publicized security breaks, along with the associated public and legislative outcry, is putting the issue center stage. Tape storage is going the way of the dinosaurs. Thankfully, more prudent means of protecting information are readily at hand.

Jim O'Connor is the director of Product Marketing for Bus-Tech and has been at the company for more than 15 years. In this role, he helps set the strategic direction for both the company and two leading product lines while also driving visibility for the company. He has more than 35 years of experience in the computer industry.