Backup encryption = easy. Key Management easy. Many articles, like this one, have hailed the need for backup encryption because of recent events but fails to mention the very hurdle which prevents backup encryption from being implemented.

Financial institutions have a difficult enough time keeping backup hardware around long enough to perform a restore (remember the old reel-to-reel backups, Magneto Optical, or even 4mm is becoming antiquated). Banks have to keep data around for years. Seven years is usually the minimum, for some it is life-of-contract plus seven. How do you keep the encryption keys around that long, have them organized so you know which key goes with which backup, and stop those same "tape monkeys" from compromising the keys?

Key management is a very complex issue. If any company gets it wrong their ?backup? will be worthless. (You?ll need a backup of your backup)

Scott

IT Security Geek

Anonymous Bank in Utah

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11048/31749#31749