Security Panel at Storage Visions

January 6, 2013, Storage Visions Conference, Las Vegas—A panel looked at the challenges of security and protection for stored content. Michael Willett from Samsung and the Trusted Computing Group moderated. Speakers were Chris Bross from DriveSavers, Robert Day from Linuxworks, Bob Thibadeau from Wave Systems, and Dave Anderson from Seagate. Allison Boerum from Kroll Ontrack filled out the panel.

Willett presented the TCG position that SSDs wit self-encryption have AES encryption and a management interface. The rationale for TCG’s SED is that encryption can address issues of breach, physical loss, and control features. Encrypting through the hardware provides benefits over software encryption, among them is crypto-erase, which meets the FITS requirements. Their standards enable easier implementation for users.

Bross noted the overlooked risk of data security in a data recovery mode. Data has to be protected even when not in your possession. The value of ideas and data need full-time protection. The risks are clear. The Ponemon Institute found that 85 percent of companies use an outside data recovery provider, 54 percent have no IT security, and 87 percent had a data breach in the last 2 years. To make matters worse, 21 percent had a breach attack by or at the recovery facility.

Prevention requires gap analysis. First, determine the needs, timing, incident reports, vendor choice, and vendor security protocols. Second, revise internal and external procedures and set of criteria for vendors. Third, develop and operate and enforcement mechanisms and hold annual reviews of all vendors. Fourth, develop contracts and change existing ones to match internal protocols. And finally, monitor vendors closely.

Day suggested a high-security separator kernel for better online production. The solutions for online protection include VPN, which excludes social media and the rest of the Web, or have no data residing on the laptop by putting everything in the cloud, which requires connectivity. A virtual laptop could have separate partitions in the disc and laptop for personal and enterprise functions. A thinned Type-I hypervisor can be placed between the hardware and the operating system and becomes a secure device server.

Integrating all of these functions provides a secure server, firewall, etc. in front of windows or any other OS. Drive bands are linked to special virtual machines and specific bands while the hypervisor provides application security. All the physical devices become virtualized and can even separate cores within a multicore machine.

Thibodeau offered independent key servers for storage and program security. In addition to other security issues, managers need to address data ownership and the potential for outside agencies like governments and courts to intrude upon potential privacy and security settings. An independent key server can hold key separately from the machine and the user so others cannot access any of the information on the machine.

Anderson described the functions of a self encrypting drive that’s more than just hardware encryption. It also needs a random number generator to create seed numbers. The TCG has the Opal specification for single users and an enterprise specification for those systems with many drives. Both of these specifications include capabilities to encrypt ranges of the drive as well as setting functions such as lock, unlock, read write, read only, or write only into any of those ranges.

Challenge to recovery?
Boerum provided in the SSD failure perspectives. They have to keep up with changes in technology. The challenges to create awareness within the drive manufacturers of the need for access for recovery, a backdoor some type, because a third of drive losses and failures are due to human error. The drive industry is fairly slow in responding to these concerns

Data recovery?
Bross admitted that it’s not getting any easier, but still good for those users who need the services. Backup is still the best solution.

The security challenge?
Anderson emphasized the need for good user practices and discipline. A terrifying problem is the proper disposal of old equipment.
Thibodeau decried the proliferation of storage volumes and types.

Encrypted drives?
Boerum acknowledged they can recover a drive image, but need the key to recover actual files. In some cases, the user prefers just retrieving the image.
Bross agreed that encryption prevents full recovery. Software or self encrypting drives require credentials to recover the files, so often they can only provide a disk image.
Anderson noted that Opal self encrypting drives have built-in IT management capabilities that can be used for remote access to the encrypted drive.