Foil threats -- Secure storage on SoCs

BofA, Citigroup, Time Warner, Fidelity...There's plenty of evidence of data theft and tape loss. This article focuses on the security designs for 'data at rest' and the activities in the IEEE 1619 standards committee supporting storage security.

By Russ Baker and Al Hawtin, Elliptic Semiconductor
August 30, 2006 -- networksystemsdesignline.com

Information Security has been one of the primary focus points of IT strategy and spending over the past several years. This is due to the convergence of such factors as:

The dramatic increase in the volume of data being produced and processed by organizations (IDC reports that corporate storage requirements grow from 15-40% annually). Some of this growth is driven by legislative requirements mandating that data be archived for seven to ten years.
The geographic distribution of modern business with outsourcing, off-shoring and subcontracting making the protection of data much more complex.
Reliance on data mining as a business tool that relies on the detailed history of customer demographics, sales, product mix, margin and geography. Much of this information is highly sensitive.
Risk of data theft and recent, high-profile incidents, such as the highly-publicized loss of tapes belonging to Bank of America, Time Warner and Citigroup and lap tops with sensitive data from Fidelity Investment (sensitive data on 196,000 HP employees) and by UC Berkley (private information on 100,000 students and staff).

Threats to corporate data fall into multiple categories with each category requiring unique countermeasures to mitigate the threat. The main categories are:

Theft of storage media, including both primary active media (such as disks) and secondary backup media (such as tapes)
Compromise of host and/or client hardware or personnel to gain unauthorized access to information
Compromise of authentication and authorization systems to gain unauthorized access to information
"Snooping" of data moving across the network or within devices
Introduction of viruses, worms, Trojan horses and other parasitic programs designed to compromise systems

Figure 1. Typical Enterprise Network

Figure 1 illustrates a typical enterprise network, which spans multiple geographic locations leveraging the Internet. Storage security requirements impact the Storage Area Network (SAN), Tape Backup and RAID storage that is used in Network Attached Storage (NAS) as well as desktop computers and laptops.

Click here to read more ...