It sometimes seems as though we can't get through a week without reading a news story—frequently topped with a blaring headline—about critical data being lost by or stolen from a large company or government agency. Customer data, including credit card information, is stolen from a retail chain. A large organization compromises thousands of employees' confidential information. A government department mislays copies of taxpayer data. A big corporation loses a tape containing financial data and social security numbers for millions of customers. A healthcare organization mislays storage media containing private health-related information and identifying data for thousands of people. The stories keep coming, each often more frightening than the previous.

With the increased focus on security issues these days, those organizations that weren't vigilant in protecting data in the past are moving in that direction rapidly and aggressively. As an added, powerful impetus, if organizations don't take vigorous actions to secure their data and systems, their executives may find themselves in jail for up to 10 years, and the organization and/or the responsible employees may incur penalties amounting to millions of dollars. This is a result of a growing list of strict regulations in the United States and around the world that make data security and privacy protection a legal requirement for most enterprises. Among the American laws that contain clauses dictating data privacy and security are the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Sarbanes-Oxley Act of 2002 (SOX), the California Security Breach Information Act of 2003 (CA SB 1386), the Fair and Accurate Credit Transaction Act of 2003 (FACTA), and the Gramm-Leach-Bliley Act of 1999 (GBLA).

To address their business and regulatory data privacy and security needs, organizations install firewalls that are as close to bulletproof as possible while still allowing legitimate access to their systems. They use 128-bit security on their Web sites wherever appropriate. They put security software in place to validate every transaction and user. They impress upon their employees and other system users the importance of choosing impossible-to-guess passwords, safeguarding them scrupulously, and changing them regularly. They encrypt data on devices that may migrate outside the firewall, such as notebook computers. Instead of or in addition to passwords, they might use biometric recognition for applications with particularly high security requirements. Despite these strenuous and wide-ranging efforts to implement rigorous precautions, organizations frequently forget one thing. These measures protect online data, but companies generally keep a copy, and often multiple copies, of absolutely all of their vital data on offline tape. In most cases, those tapes receive nowhere near as high a level of protection as online data, despite the fact that the online and offline media contain the same data and, therefore, have identical privacy and security requirements.

For most companies, tape is—and for the foreseeable future, will be—the last line of defense to protect critical data from loss due to disasters, storage media failures, or human error. And for some organizations, tape is the first and only line of defense. These backup tapes are usually shipped, possibly using commercial courier services, to locations that may or may not be under the company's control. Along the way, the tapes often receive little or no protection from loss or theft. Because the data on them is typically unencrypted, if the tapes fall into the wrong hands, an unscrupulous individual is free to read all of the data on them at will. Any stringent measures that the organization has put in place to secure its networks, systems, and online data do not protect the privacy and security of any data written to these offline tapes, tapes that typically contain a complete backup of all of the organization's customer, employee, sales, and other sensitive data.

It will be many years before most organizations will feel comfortable eliminating tape backups. In the meantime, those tapes must be protected. One answer is the BOSaNOVA Q3 storage encryption appliance, which eliminates the security threat created by tape backups.

Data Encryption Appliance

The Q³ device sits between a host system and a tape drive or library, with an Ultra Fast Wide SCSI LVD, S/E or HVD (differential) interface linking the tape device to the Q³ unit and the Q³ unit to the host system. When it is powered on, Q³ automatically detects the SCSI ID of the tape device and assumes that ID. Thus, to the operating system, the Q³ device looks exactly like the tape device, thereby rendering Q³ transparent to and independent of the operating system.

With a Q³ unit in place, data written to the attached tape device first passes through the Q³ unit. Q³ then encrypts the data and pre-compresses it before writing it to tape.

Key Protection

Q³ splits incoming data into two streams and independently encrypts each stream, using interlaced Dual-DES or Dual-DES3 encryption. The use of 112-bit encryption allows for more than 52 decillion—that's 52 with 32 zeroes after it—keys for each stream. Because the two streams are encrypted separately and then merged, decryption requires both keys (in addition to the encryption chip, which is also required.) If deemed appropriate, you can entrust responsibility for each key to different people so that gaining unauthorized access to the data would require collusion between at least two people.

Once entered, the two encryption keys are stored in the Q³ unit, allowing it to run unattended. The device is password-protected so that keys cannot be entered and the configuration cannot be changed without the password. If the Q³ device is disconnected, the software encryption keys are lost after the unit has been without power for more than two minutes. Consequently, if the device is stolen, the thief cannot gain access to the passwords.

Hardware Protection

Software encryption keys aren't the only protection that Q³ offers. Each Q³ comes with a unique encryption code chip. Tapes can be decrypted only on a device with a chip identical to the one that was used to create the tapes. Thus, even if someone should gain access to a tape and manage to get a hold of the encryption keys, he or she still won't be able to read the data on the tape.

BOSaNOVA ships a duplicate encryption chip with each Q³. BOSaNOVA recommends that customers send the duplicate chip offsite. Then, if a disaster destroys the data center, the chip on a Q³ unit at a recovery site can be replaced with that duplicate chip, allowing the encrypted tapes to be read so the data on them can be loaded onto a backup system. Should such a disaster occur, BOSaNOVA will immediately ship a replacement device to the recovery site, or to reduce recover times, you can buy a second Q³ and keep it at your disaster recovery site.

The duplicate chip also provides backup should the operational chip fail. If the duplicate chip needs to be used to replace a failed operational chip or to recover from a disaster, BOSaNOVA can have a replacement chip created so that you'll always have a backup on hand.

No Strain on Host Resources

The Q³ is a small device that comes in desktop and rack-mountable versions. The desktop version measures 14.2"(D) x 17.3"(W) x 4"(H). The rack-mountable version has a 1U form factor and measures 14.2"(D) x 20"(W) x 3.5"(H).

Because all of the encryption and pre-compression is performed by the Q³ device rather than by the host system, Q³ does not put any strain on the host system's resources. In fact, if the host system currently compresses data before writing it to tape, host resource usage may decline when the Q³ device takes over the compression work. Q³'s dedicated compression chips are rated at 80 MB/sec. The device is capable of a sustained data rate of up to 72 MB/sec.

Easy Setup and Maintenance

Because Q³ looks like a tape drive or library to the host system and it looks like a host system to the tape device and because the Q³ device automatically detects and adopts the SCSI ID of the tape device, setup is essentially plug-and-play. Installation can often be completed in minutes.

Q³ offers a number of configuration options, all of which can be set using the provided GUI program. Once the cables have been connected and the configuration is complete, users enter their passwords using either a GUI program or a green-screen terminal to begin using the Q³ device to create encrypted tapes. For more information, contact BOSaNOVA or visit the Q3 Web site.

About BOSaNOVA, Inc.

BOSaNOVA is a privately held company headquartered in Phoenix, Arizona. The company is principally engaged in the design and development of security solutions, thin-client devices, and iSeries connectivity products. BOSaNOVA recently announced its new Security Solutions Groups, which include two new security products that were added to the existing line of award-winning thin-client and iSeries connectivity solutions. The newest solutions offered by BOSaNOVA include the Q³, a hardware encryption appliance to secure data at rest, and the iSecurity software suite for the iSeries. The company's products are sold through a worldwide network of IBM and CITRIX Business Partners. Industry affiliations include membership in IBM's PartnerWorld for Developers, Citrix Global Alliance Partner Program, and the Microsoft Partner Program.

Joel Klebanoff is a consultant, a writer, president of Klebanoff Associates, Inc., a Toronto, Canada-based marketing communications firm, and author of BYTE-ing Satire. Joel has 25 years experience working in IT, first as a programmer/analyst and then as a marketer. He holds a Bachelor of Science in computer science and an MBA, both from the University of Toronto.

BOSaNOVA, Inc.
2012 W. Lone Cactus Drive
Phoenix, AZ 85027-9919
USA
Web: www.bosanova.net
Tel: 866.865.5250