Building An Encrypted (But Accessible) Archive
Posted by
Kelly Jackson Higgins
September 08, 2005
The last thing you need when auditors come to town is an encrypted e-mail message in your archive that you can't decipher. You have to locate the end user who encrypted it and pray that he still has the decryption key -- and that it hasn't expired.
Encrypted archiving may not be a regular practice today, but regulatory and legal pressures are forcing many enterprises to rethink how they archive their e-mail, file, and database data. If your data is sensitive or confidential, such as patient or client data or intellectual property, you're responsible for protecting it from prying eyes. Encrypting your archived data is one way to meet regulatory compliance (think HIPAA and SOX) and minimize liability risks.
Some organizations under the regulatory microscope, such as financial and healthcare firms and federal agencies, are already grappling with how to strike a healthy balance between securing their archives and making them readily available for audits, legal discovery, or even just in-house access. "If we archive all of this data and it's not in a usable format, did we really fulfill our requirement to archive it?" asks Steve Elky, technical director of information security for Software Performance Systems, a Falls Church, Va.-based integrator with federal government clients.
There's no magic bullet for building an encrypted archive. Encryption and archiving for the most part are still separate technologies and products today, although that is about to change.
Policy Matters
The key to building a secure but accessible archive is policy. That means defining enterprise policies for encrypting your e-mail messages or other data as well as for user access and data retention. If your policy is to encrypt data only when it hits the archive, you won't, for example, end up with an e-mail message that's unreadable because Joe in accounting used his own PGP key that has since expired.
Page: 1 | 2 | 3 | 4 | Next Page »
