No More Lost Backup Tapes: Chain of Custody Security Measures

Sending critical backup tapes to a storage facility isn't as simple as placing a package on a truck. Here are four points to consider when you're securing the chain of custody for your backup data.

For well-meaning couriers, even the most powerful security processes can hide a weak spot. At UPS, cutting-edge technology that tracks every move that every package makes couldn't prevent the Citigroup tapes from going missing. "It's so unusual. So rare. We have the technology now that we don't lose packages," says UPS spokesman Norman Black. "Citigroup showed that as good as we are, [the system] is subject to human error."

The backup process is much more complex than simply handing tapes over to a third party, and CSOs need to take charge. A risk assessment starts with a tape's path from point of origin to storage facility and assigns responsibility for each step, using both physical and IT security resources. There are options at each step of the way. Here are four strategies to consider for mitigating that risk. Have a safe trip.

Send the most sensitive data via secure escorts

Strategy no. 1

Securing sensitive data starts with the high-level security strategy of classifying data into categories, for example, highly sensitive for information such as Social Security numbers, account information and health data tied to a name; confidential for information such as business plans and customer data; and general for information such as correspondence.

At the Secret Service, Dale Pupillo, deputy special agent in charge of its Criminal Investigative Division, suggests that companies classify data similar to the way the federal government classifies information as top secret, secret and confidential (which presidential orders instituted more than a half-century ago). For instance, the government's test for assigning a top secret classification involves determining whether the information's "unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to the national security." Government regulations—such as what data a company is required to safeguard and archive according to Sarbanes-Oxley, Gramm-Leach-Bliley or the Health Insurance Portability and Accountability Act (HIPAA)—and considerations of corporate goals (keeping consumers' trust, avoiding brand-bashing publicity about a breach or safeguarding shareholder value) could drive judgments about classifying corporate information. Once the most sensitive data has been identified by the IT security staff and transferred to tape, there are several modes of secure transportation to consider. Pupillo says Secret Service guidelines make decisions clear-cut when handling archival sensitive information such as evidence in a criminal case. "If it is really valuable to us, we'll hand-deliver it," he says.

Couriers such as FedEx Custom Critical, a subsidiary of FedEx Corp., will transport a sensitive package in its own private climate-controlled van or truck. Two drivers provide constant surveillance of the cargo and never stray more than 25 feet away from the vehicle during the trip, according to the company's customer service department. The price tag for transporting a 100-pound, cooler-size container one way from Milwaukee to Madison, Wis. (about 80 miles): $688. (There is a 99-mile minimum charge. The regular rate for FedEx Express overnight delivery for the 100-pound intrastate package would cost $159, according to the company's website.)