Standards Would Lock Up Data on Disk and Tape

Proposed standards for protecting data on disk or tape are gathering steam within the IEEE and could be supported in products as soon as next year, according to proponents.

The need to push through such standards has been made more urgent since high-profile companies such as Ameritrade and Bank of America earlier this year lost unencrypted tapes containing customer data.

“For businesses in regulated industries or that store personal financial information, encryption may very well be a requirement,” says Stephanie Balaouras, a senior analyst for Forrester Research. “For other businesses it’s a matter of managing risk, and encryption is one of many options that businesses must consider.”

The proposed standards for how data is encrypted on disk and tape are the IEEE P1619 and P1619.1 Standard Architecture for Encrypted Shared Storage Media. The IEEE’s Security in Storage Working Group is fine-tuning the standards, hopefully for approval in months to come.

“We have a draft standard for disk that is three years in the making and is very close to being complete. We have a stable draft for disk and a very preliminary draft for tape,” says Jim Hughes, Sun fellow and chair of the working group. “I expect both to be approved in 2006.”

The standards would address encrypting data at rest on disk or tape, whereas protocols such as IPSec, SSL and Secure Shell (SSH) are used to encrypt data in transit. While some storage-product companies already support some type of encryption, having standard implementations could make it easier for customers to safeguard data across heterogeneous storage environments, standards supporters say.

The proposed standards define three encryption algorithms and a method of key management designed to ensure the compatibility and interoperability of different storage gear. For encryption on disk the specification proposes using the new Liskov, Rivest, Wagner-Advanced Encryption Standard (AES) cryptographic algorithm.

For tape encryption it proposes using the National Institute of Standards and Technology’s (NIST) AES Galois/Counter Mode and AES Counter with Cipher Block Chaining-Message Authentication Mode (CBC-MAC) standards.

Each of these encryption modes is less susceptible to compromise or attack than current techniques such as counter-mode encryption or CBC encryption. CBC mode, for instance, is not resilient against attackers arbitrarily changing bits in plain text by manipulating bits of the ciphertext (the output of an encryption function), according to Hughes.

“If I know where my salary is on the disk, I can make changes to the ciphertext to increase my salary to any amount I want without breaking the algorithm,” Hughes says.

Defining a standard for encrypting data on tape has been particularly challenging, Hughes says. Encryption of data on disk deals with fixed-sized blocks of data. With tape, the block size can vary, and because data needs to be kept for longer amounts of time the encryption algorithms become more complex and require more keys to decrypt the data that is retained.

NeoScale, which makes storage security devices, says it will start implementing the storage encryption standards in its appliances when the standards have been published by the NIST as a Federal Information Processing Standard. Decru, another storage security company, says it will implement P1619 encryption in its DataFort appliance via a flash firmware upgrade. Sources say the standards also will be supported by Fibre Channel director switch vendors.

Cisco, HP, IBM, McData and the U.S. Army are members of the standards working group.

It is difficult to isolate the size of the storage security market from that of the general network security market. Jon Oltsik, senior analyst for the Enterprise Strategy Group, estimates it at less than US$50 million in 2005.

Whether delivery of standards-based storage security products will give the market a boost remains to be seen.

Mark Moroses, senior director of technical services and security officer at Maimonides Medical Center in New York, has adopted encryption to secure data used on laptops and PDAs, and is looking at extending encryption to safeguard the healthcare organization’s storage-area network. A law in New York that fines organizations that lose unencrypted data is putting pressure on companies that do business in the state, he says.

But he describes standards as a double-edged sword — even though they promote interoperability, they can make it easier for hackers to focus on a target.

“Regardless of what anybody comes up with today or tomorrow, the life span of it being considered secure is really small. As fast as they come out with something, someone is going to find a way to compromise it. You just want to raise the bar high enough so that people don’t think it’s worth going after your data,” Moroses says.

By Deni Connor – Network World (US)