Welcome to the Toshiba Storage Blog

Because data security is a complex topic with many risk factors, we often lose sight of the core principles that form the foundation of data security. Fundamentally, there are "three pillars" on which effective data security is built – data encryption, access authentication, and data life-cycle management.

Data encryption helps keep the bad guys from reading protected data. Encrypting protected data may provide organizations with a legal "safe harbor" relative to laws and regulations governing data privacy and breach disclosure. For example, if a laptop PC is lost or stolen and the owner organization can prove the disk drive is encrypted, then the owner may be legally exempt from notifying those whose private data has gone missing. Strong encryption algorithms and protection of the encryption keys used are important components of data encryption.

Access authentication also helps keep the bad guys from reading protected data by, as the term suggests, denying them access to protected systems. Because user sign-on processes are so ubiquitous and often so automated we tend to take them for granted. Still, it’s important to appreciate what goes on at a system level. Specialized security applications running during pre-boot or system wake-up authenticate the user and unlock access to the user’s data on the storage device before passing control to the OS or application. Authentication is built on the concept of "attestation" – the ability to prove that you are who you say you are. This may utilize strong passwords, biometrics, "challenge / response" methods (questions such as, "Where were you born?"), and "certificates" (digital credentials that establish the legitimacy of a user) to build a strong authentication capability. Such methods and protection of the authentication secrets are important components of secure access authentication.

Data life-cycle management means simply that data is securely deleted when it is no longer needed. Sooner or later all computer and storage systems are going to be retired or re-purposed. As a result, any data stored on those systems will have reached the end of its life (on that system or storage, at least). As IT pros know, when you delete a file from the file system directory the "data" in all likelihood remains "written" on the storage media. Today the most common practice is to use lengthy and time-consuming data overwrite processes to sanitize data storage devices when they are retired or re-purposed.

Unfortunately, data forensics technologies keep improving and can often recover data that has been overwritten or erased – even if this has been done multiple times. Different government agencies and consultancies specify different methods for data sanitization – all requiring multiple overwrite passes of the entire disk and all of them very time consuming. In some cases, physical destruction of the storage device is the accepted best practice – even if that device has a lot of useful life left. Many organizations aggressively manage the life-cycle of data to minimize storage costs and to minimize the size and scope of potential legal data discovery actions.

Now that we’ve outlined our "three pillars" (encryption, access authentication and data life cycle management) – we have a foundational perspective for comparing different methods for securing data at rest. We’ll expand on this point in a future blog post....