Iron Mountain Encrypts Itself

After years of warning customers to protect their data, Iron Mountain is taking its own advice with 14 new security appliances from Decru, the Network Appliance subsidiary, to encrypt corporate information on internal backup tapes.

According to Iron Mountain CIO Kevin Roden, full-scale encryption will be implemented in April, across three data centers in northwestern Pennsylvania, Kansas City, and the U.K. These are all locations where corporate information is backed up. Information like human resources files.

In addition, extra security for data contained on laptops (accounting for roughly 60 percent of corporate information, according to Roden) is being secured through a partnership with Beachhead Solutions Inc., which makes software that encrypts laptop data and automatically destroys it when a computer goes missing.

It wasn't always this way. Formerly, Iron Mountain selectively encrypted internal data. But toward the end of 2005, the company had been part of at least one big story about compromised information -- the Time Warner Inc. snafu in which records on hundreds of thousands of employees were lost on the way to Iron Mountain's tape vault. (See The Year in Insecurity and Iron Mountain Keeps Truckin'.)

It was a wakeup call. Iron Mountain began encrypting all customer data it handled online and recommending the use of Decru appliances for tapes delivered to its sites. Internally, a review to better address what the firm was doing in house was begun.