What's the Key to Excellent Encryption?

Extend access controls to the storage infrastructure. Dont incorrectly assume that data residing within the "four walls" of the data center will remain safe as long as network and server access controls are in place. To secure data at rest, be sure all corporate access control policies, processes, and tools extend to the storage infrastructure as well.

Determine which datasets to encrypt. You can encrypt application data with disk encryption technology. However, this introduces additional latency and cost to the environment. It is therefore important to do a cost/benefit analysis based on corporate risk management priorities and data classification policies to help prioritize targets for encryption.

Encrypt data stored offsite. The most obvious security risk for the storage manager is data stored offsite, which is typically backed up onto tape media. Currently, data written to tape is almost never encrypted -- but it should be. There are mature products available for encrypting data as it is written to tape, including many backup software platform add-on modules. Again, this introduces additional latency and costs, and should be evaluated and prioritized on an application data-set basis, and validated against corporate risk management and data classification considerations.