On Nov 18, 2005, at 12:00 AM, RECMGMT-L automatic digest system wrote:
> From: "Gerard J. Nicol" <[log in to unmask]>
> Subject: Re: Risks to Computers.......and Encryption
>
> Hugh,
>
> I did not see your previous post; but people need to understand that
> whilst
> encryption has its place in most instances encryption does not stop
> hacking.
>
> Once a hacker has access to a system there is really little benefit of
> encryption, and from a risk management perspective most access is
> gained not
> from the interception of unencrypted data but from various phishing
> techniques and ineffective security.
>
> If I had ever other base covered I would look at encryption, but the
> sad
> reality is that most IT infrastructure is poorly protected and the
> money/effort would be better spent improving security in other areas.
>
> For instance, before I spent a dollar on encryption, I would be
> looking at:
>
> (1) Running proper background checks on my employees.
> (2) Training my employees not to click every URL that confronted them.
> (3) Installing effective security on the front door and giving staff
> ID.
>
> Gerard
I totally agree with you. My earlier posts had to do with the fact
that their is a huge publicity campaign by certain companies to
encourage encryption to protect their organization from the offsite
storage company losing the tapes. My feeling is that this is a red
herring to distract people from the inefficiency demonstrated by
several very large negative publicity events caused by lost tapes.
Where is the discussion about utilizing a more accurate tracking
software to avoid the lost tapes? If a trucking company can use RFID to
track shipments and GPS to track the trucks, media is not difficult to
track. Why tell the entire world to switch encrypt, why not just fix
the internal problems that keep leading to lost tapes??
Storage Magazine (November Issue) just ran an article talking about
the trend toward encryption, which is understandable from an IT
oriented and IT equipment selling magazine. But even in an article
that started with a positive spin, every IT Manager they interviewed
stated that software encryption slows the system down to unacceptable
rates and there is fear that data once encrypted might become
inaccessible as no one knows how reliable this technology
is............and a big problem is that no one knows how to protect the
Encryption Keys. Losing the keys is equivalent to showing up at work
and finding your vital records are no longer in the facility.
The great thing is that some of the RM's are now opening discussion
with IT about this. And I know that IT is not very happy about RM's
sticking their nose in on this, but this is such a great entry. Your
points above:
> For instance, before I spent a dollar on encryption, I would be
> looking at:
>
> (1) Running proper background checks on my employees.
> (2) Training my employees not to click every URL that confronted them.
> (3) Installing effective security on the front door and giving staff
> ID.
are a great door opener as well. And from what I saw at the recent
technology summit, IT is worried enough about SOX that they are now
more likely to want an RM to provide some input and solutions.
Peter, maybe you could provide the RAIN link for the article on Page 44
"Storage" entitled "Secure Your Backups" as the article ended with a
headline at the last page that stated "IT'S IMPORTANT TO REMEMBER THAT
ENCRYPTION BACKUPS SHOULD ONLY BE A SMALL PART OF AN ORGANIZATION'S
SECURITY STRATEGY." Then Dennis Hoffman of EMC states that ".....the
rush to encrypt backups is a massive knee-jerk reaction within the
storage industry."
This one article could be the primer for the pump to allow records
managers to enter the IT arena with a serious discussion.
Questions you might start with:
If the higher security encryption keys slows down the system more (50%
estimated) than less secure keys, how much speed do we want to trade
off for security?
If the encryption key is stored on the system and the system is down
how do we access the key?
If password protected files are stored on transferable, portable media,
don't we have the same risk as losing a lap top?
Encryption slows back up, if we face a disaster such as a storm or
hurricane, won't slowing down the back up create more risk?
If we are in disaster recovery, won't the slowness of the system create
recovery problems?
Can't the $50 - $100,000 be spent more effectively?
As always my role on this Listserv is to open dialogs that promote
Records Managers and increase their scope of influence. But then the
really good records managers start send me email poking holes in my
arguments and I get a free education. This then makes me more effective
in the market place.
Hugh Smith
FIRELOCK Fireproof Modular Vaults
[log in to unmask]
(610) 756-4440 Fax (610) 756-4134
WWW.FIRELOCK.COM
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
|