While encryption of data for backups is a good idea, we are yet to see strong/universal support for hardware crypto accelerators from vendors - and software writers/vendors putting the senstive data into areas where it can be isolated (for encryption purposes) from the rest of the data.

The problem with this is in the implementation - you have a large database say 500Gb + and you want to back it up using encryption - a standard cpu will manage somewhere around 1-10Mbps - significantly less than the throughput of tape drives and networks.

This results in time to backup the data that is longer than the backup windows.

So what is the way forward ?

Support for hardware crypto accelerators is one step.

Working with vendors/software writers to encapsulate the sensitive information into

seperate items that can be backed up using encryption and the bulk of the data can be backed up using normal methods (for speed).

It would seem that these two items would help a lot in seeing sensitive data encrypted as a mainstream

process.

Lastly, people will then have to use these enhanced technologies for their backup, and as in the article - backup is often given to the junior staff who are less likely to be interested in getting this right because they haven't had to deal with what happens when backups go wrong.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11048/31767#31767