Protecting Storage Panel -Storage Visions

 January 8, 2012, Storage Visions, Las Vegas—A panel looked at the issues associated with managing and protecting stored content. Michael Willett from Samsung moderated the panel. Presenters included Ben Thiel from Micron, David Duncan from imation, Aidan Herbert from Wave Systems, and Jorge Campello from Hitachi. Additional panelists included Chris Bross from Drivesavers and Tom Coughlin from Coughlin Associates.

Willett compared and contrasted SSDs and HDDs and noted that SSDs generally provide advantages of productivity and lower maintenance costs. They also have higher reliability and lower power. An IDC study found that using SSDs would lower annual operating costs by $176.

In parallel, integrating technologies like encryption offers a legal safe harbor to users and slows data breaches. Up coming legislation is likely to require more actions from companies experiencing data breaches, especially if the data is not protected with encryption. Self-encrypting drives integrate the hardware encryption engine into the drive, eliminating a potential software breach point. Together, this indicated that next-generation drive technology will be SED and SSD.

Thiel responded that an SED SSD might provide a full solution if it supported at least a 256-bit AES encryption. The Trusted Computing Group (TCG) Opal compliance criteria also require some encryption management software. Data at rest needs some type of SED to enable remote deactivation of the drive. Security in hardware is always more secure and faster than the similar function in software, and it is always on. An SED holds the encryption keys in the drive, so key control is easier.

Overall asset management for HDDs requires degauss, overwriting the space, and may even include physical destruction. In comparison, an SED only needs crypto erase to meet most data safety standards. This encryption and safe erase capabilities provide an advantage over software and prevents drive signature analysis. The biggest issue is drive theft. Opal allows remote crypto erase to prevent any data from being read upon reboot in a foreign computer. SEDs also ease the efforts to repurpose and retire older drives.

Duncan countered that if someone has a key, how do you protect the data? An alternative is to use removable media with encryption. IT functions are becoming more consumerized and bring-your-own-devices is the direction of choice for most companies. Currently, 85 percent of all mobile devices are unprotected and the cost of a breach is growing. The IT groups cannot know what is on those platforms, because they have no easy entry point.

Therefore, IT has to assume the worst case for data. Missing devices account for 42 percent of all data losses and 90 percent of all breaches. Use patterns have to change from flash to encrypted flash, to CDs and to something else in the future. IT has to do an audit to evaluate the regulated data to determine who uses it and where it is stored. They need both a data classification taxonomy and use some form of data loss prevention software. After evaluating the data, they need to locate the data and determine what to protect, encrypt, and manage. This scenario calls for some type of endpoint security solutions until the company can afford the next level of protection. Companies need a policy-driven, automatic, and transparent solution.

Herbert added that companies need a management infrastructure for trusted devices to move from existing devices to ones with harder security. They need to check data health before any use. At the endpoints, companies need to install some form of lifecycle device management to track all devices. Mobile devices and the cloud are making the issue more difficult in identity and access management. IT has to balance access management against storage with embedded data protection.

IT has to create trusted services and endpoints that are hardware-security based. Devices must have the ability to generate trust and identity information to enable data protection plus service access control. Unfortunately, the existence of multiple mobile users in a shared environment makes control much more difficult. Multi-tenant suppliers need to have data and application isolation to slow attacks.

The attack vectors are at network, OS, and user level, so all software layers are venerable. Companies need to have hardware to have a trust chain. The managers have a set of evolving needs and security requirements.

Campello updated the state of Opal drives as the chair of the TCG storage working group. The latest SED take raw data in and encrypt the data. From the user perspective, they get the same raw data out. The key is only in the drive and is remotely activated to address the primary attack vector, physical access. The Opal specification assures the ability to disable the encryption engine within the drive, rendering the data incomprehensible.

The TCG is growing to include more vendors and products and now has 5 new vendors. The vendors are shipping millions of products and include 3 PC vendors, 9 software vendors, 2 storage controllers, and one test equipment vendor.

Clouds and data safety?

Bross observed that data recovery is the primary issue. Clouds are based on HDDs while SSDs are still viable for some functions, like disk cache. A recent Poneman study lists breaches and data loss statistics which include the cloud.

Coughlin a recent Coughlin study showed that SEDs and TCG modules are gaining acceptance. The encryption engine is being integrated into the controller. One issue is that SED on SSD may not be able to do a full secure erase. Another issue is the adoption of security functions for all users.

Hot buttons?

Herbert replied management of SED. The credentials for the enterprise-level user management doesn’t have a data back channel, so archive and changes in passwords needs to be performed in an unsecure environment.
Coughlin opined that companies are working to not get sued. Tools to prevent access to unauthorized users and machines are needed.
Willett stated that crypto erase is becoming accepted by the US government and other agencies around the world.
Duncan stated that Stanford Medical Center does encryption and key control. Controlling the keys is important, especially if you have to provide a key to an outside source. People are the weakest link.
Bross suggested that data recovery in HIPAA environments depends upon key management. Recovery requires verifying up to a date and recovering everything before that date, or extracting the encryption key.
Campello added that there is a difference between keys and credentials. Recovery is hard because SEDs have no accessible keys or credentials.
Duncan offered the premise that users could extend the root of trust. Keys can only confirm identity, but access credential control is just as important. Encryption is only a partial solution.

Drive destruction?

Campello noted that even after physical destruction of a drive, some parts are still recoverable.
Thiel added that full security requires ctrypo and full erase.
Coughlin said that a quantum computer could easily break a 256-bit code. Longer code words are only a temporary solution.

File-based storage and head-end encryption?

Duncan offered hybrid gateway appliances to preprocess and encrypt the data before movement. This is a new area for development.

Data recovery?

Coughlin noted that many companies are farming out data recovery to multiple sources. This behavior drives a need for an end-to-end chain of custody through all areas and levels of restoration.

Number of keys in an SED?

Campello replied that there are 2 standards calling for a minimum of 4 keys. For an enterprise, the number of keys could exceed 1000, so the users need to have security management and policies.
Willett added users could create physical partitions and apply access control to the set.
Herbert considered augmenting and encryption with access control and management tools.

FIPS levels?

Because the drive makers have to endure a year for certification, which is about the duration of the product lifecycle, they have to target a level. Currently this is level 2. Certification labs can use the prototype as a first article, and can go to a short certification cycle if less than 30 percent of the drive has changed.
Duncan offered the number of secure communications channels limits the number of users for certified drives.
Thiel considered that the value is in the certification.
Campello FIPS levels -1 and -2 are changing so -3 will become the next standard.