Norman,

 

I think you have missed the point here.

 

People don't send tapes offsite just for the heck of it. They send tapes
offsite to protect the enterprise.

 

I did not mention any vendor in particular, so I don't see why you have felt
the need to defend any particular party.

 

I personally have no problem with encryption, even without dedicated
acceleration I doubt that it could be shown to significantly degrade backup
throughput.

I can also tell you that it is not common for people to send encryption keys
to their offsite provider; but I don't think this is a show stopper either.

 

I think you will find that as time progresses the fact that a tape was
encrypted will not be enough to absolve companies of their obligations to
inform parties who may have had their privacy breached.

 

Encryption can be broken, and over the years it has been necessary to
implement new and stronger ciphers as the technology required to crack the
key becomes available.

 

Remember the signal on a modern day tapes such as an LTO is said to be good
for at least one hundred years.

 

This is why I think you will find (to use your analogy) that the military
actually destroy the hardware, rather than the key when the physical
security of the device is compromised.

 

At the end of the day, security is all about risk minimization. 

 

Despite the fact that IT people are often well paid, I would put my money on
data being stolen by an IT guy over a vault driver any day.

 

If I had concerns about my tapes being lost, I would be more concerned about
the potential impact on my business caused by data loss than I would for my
statutory or moral obligations relating to privacy.

 

Gerard

 

 

 


List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance