White Paper: Unlocking Encryption A New Key to Data Security

Transcription

1 White Paper: Unlocking Encryption A New Key to Data Security

2 Table of Contents Page Executive Summary 1 Overview: Encryption Defined 2 The Business Need For Encryption 3 A Banking Case Study 3 Real-World Examples 4 Implementing Encryption Successfully 5 Keys and Key Management 6 Encryption Methods 7 Implementation Methods 8 Planning a Successful Implementation 10 Unitrends InCrypt Tailored for Success in SMB 11

3 Executive Summary Encryption is an increasingly important set of technologies, used to safeguard private data in computers, across public or private networks, or in other machine-readable forms. The proliferation of data needing protection whether internal corporate data, or records containing information on customers or other associates means there is much more data at risk of being compromised than ever before. This, in conjunction with the increasing cost of a data breach, measured in both hard dollar terms like legal settlements, and soft costs such as loss of customer loyalty, makes the intelligent use of encryption and other data-protection technologies increasingly necessary for organizations of all sizes. In 2007, there were more than 320 cases of data loss documented by the Privacy Rights Clearinghouse, the largest of which affected more than 94 million credit and debit card account numbers, with breach costs estimated at $216 million, and an initial settlement with a single card issuer of $40.9 million. Clearly, the stakes are very, very large. There are specific and unique issues of data protection and encryption relating to data backup solutions; these need to be understood and integrated into an organization s broader businesscontinuity plans. And while the risk and cost of data loss through simple error or third-party theft continues to grow risks that encryption can mitigate there still exists far greater risk of data loss from issues of simple hardware failure, software corruption, or human error (in accidentally deleting a critical file, for example). For this reason, encryption should be thought of as an additional layer of protection, built on top of a solid core mechanism for data backup, protection, archiving, and disaster-recovery. All encryption methods depend on keys to perform the transformation of plain text (which is a term of art in cryptography, meaning unencrypted data, whether textual in nature or otherwise) into cipher text. Keys, like conventional passwords, can have varying degrees of strength. And like passwords, they must be carefully managed to ensure privacy, and to protect against loss of the key itself. Wellencrypted information simply cannot be unencrypted without the original key; for this reason, loss of the key represents an equally-large risk to the data owner as exposure of the underlying data itself may. For the small- and medium-sized market, the ideal data encryption approach would be both affordable and easily integrated into a comprehensive data backup and business systems continuity solution. It would include powerful, standards-based encryption, and offer a robust key management function. Unitrends InCrypt capability meets all these requirements, and is fully-integrated into the company s family of Data Protection Unit (DPU) and Data Protection Vault (DPV) appliances.

4 Overview: Encryption Defined In the world of information technology (IT), encryption refers to a process used to transform computer information into an unreadable form, yet one that can be reliably transformed back to its original state. In the 1940s, radio programs like Little Orphan Annie and Captain Midnight popularized decoder rings. These devices typically had two concentric rings, each of which had the letters A-Z, the numerals 0-9, and perhaps a period and a space character. The outer ring could be rotated around the inner ring. In the starting position, the letter A on the outer ring would be aligned with the A on the inner ring, and all the other characters would be aligned as well: B with B, 5 with 5, and so on. To scramble a message, one would turn the outer ring a certain number of characters clockwise relative to the inner ring. For example, three positions clockwise would align A with D, B with E, C with F, 5 with 8, etc. Then the letters in a plain text message could be mapped to the corresponding inner ring letters, producing cipher text. In this manner, D becomes G, A becomes D, and the phrase Data Protection Unit would be scrambled as gdwd#surwhfwlrq#xqlw. To unscramble the phrase, one needs a matching decoder ring, and needs to know how many positions clockwise the rings were turned relative to each other in the encoding process. In this example, the positional offset is what cryptographers call the key to the encryption algorithm. It s like the password that locks and unlocks your computer. The same principles apply to today s sophisticated encryption. There s plain text that is transformed into cipher text by an algorithm; the algorithm uses a key provided by person encrypting the data. Keeping the key secret while not forgetting it! is essential to the integrity and security of the process. But similarities aside, in today s world the decoder rings are, of course, much more technologically advanced.

5 The Business Need For Encryption Since the days of the Roman army, military organizations have used encryption methods to protect intelligence information. Today, enterprises of all sizes manage intelligence information. Any business that has a product or service for sale handles and stores its customers personally-identifiable information from names and addresses to more sensitive information like Social Security numbers, bank account and credit card numbers, etc. For most companies, the amount of information they retain has grown steadily over the years and the need for privacy of that information has also evolved. This smooth growth means that many companies fail to recognize the risk to which they re exposed. Imagine the information that a criminal could glean from a single backup tape from a florist shop: perhaps thousands of customer names, credit card numbers, and so on. Now think of the exposure a bank has with the customer information maintains. A set of backup tapes from a bank is potentially far more valuable than an armored car full of cash and unfortunately, also likely to be far more accessible. Businesses are increasingly looking to encryption technologies to meet the growing data security requirements, said Lauren Whitehouse, Enterprise Strategy Group analyst. With InCrypt, Unitrends is delivering a fully integrated, operationally simple solution that not only provides data security for data at rest and on its vault, but also for data in flight. This feature really sets Unitrends apart and provides its customers added protection. it The costs associated with data loss can be almost unimaginably high. Any loss of unencrypted data exposes a firm to severe damage to its customer relationships; creates a huge distraction to running the business; establishes potential legal liability for subsequent losses experienced by customers; and virtually guarantees significant damage to its reputation. Fortunately, encryption can protect against all these risks, and is easily implemented. Let s consider the extent to which a hypothetical regional bank might be at risk with respect to unencrypted data on its backup tapes. A Banking Case Study Imagine a bank with 20,000 customers, most with multiple accounts and bank cards. Every night, the bank makes a complete tape backup of its core information servers. In today s world, these servers would likely be Windows-based, and might contain Microsoft SQL databases. To capture all the data on tape, six to eight tape cartridges are used. These tapes are then placed in a storage box and prepared for pickup by a third-party tape storage company. Sometime during the day, a van driver from the tape storage firm drops off an older set of tapes (no longer needed), and picks up the box of new tapes. During the day, the van drives all over town making pickups and drop-offs. At the end of the day, the driver pulls into the storage warehouse where the day s pickups are unloaded and stored on shelves. The following day, the driver will repeat this process. Here are just some of the threats to the security of the bank s data in this scenario: The tapes are left in a box for pickup, without continuous supervision The pickup van is not armored

6 The driver is likely an hourly employee with uncertain reliability and commitment to his employer and the firm s customers Dozens of tape boxes are loaded and unloaded each day, in a manual process subject to human error and/or malicious intent Tapes are stored for an interval, not under continuous supervision, and then sent back to customers for reuse These risks could lead to: Tapes being mislaid or stolen from loading docks Tapes being accidentally dropped off at the wrong sites Tapes being lost or stolen from the delivery van Driver turnover leading to accidental misplacement or intentional theft of tapes Once the tapes are in the wrong hands, unencrypted data is easily compromised. Someone trained in basic information technology could, with little effort, capture, copy, post on the Internet, or sell data from the bank s backup tapes in as little as an hour. Real-World Examples Think these risks are theoretical? Let s take a sobering look at just two of the 320 cases of data loss documented by the Privacy Rights Clearinghouse in 2007, using information from the organization s Website: On June 15th, the State of Ohio reported that a backup computer storage device with the names and Social Security numbers of every state worker had been stolen earlier in the month from a state intern s car. The tape was initially reported to contain personally identifiable information of nearly 84,000 current and former Ohio state employees and more than 47,000 state taxpayers. But the news worsened in the next few days, when it was reported that the storage device also had the names and Social Security numbers of 225,000 taxpayers, a number that was later increased to 500,000. The state Hotline and the Ohio Consumers Counsel office were deluged with calls, and it is virtually certain that many of the individuals whose data was compromised suffered serious financial harm. On January 17th, The TJX Companies (the holding company for T.J. Maxx, Marshalls, and other retail stores) reported that it had, a month earlier, discovered an unauthorized intrusion into its computer systems that process and store customer transactions, including credit card, debit card, check, and merchandise return data. It was initially reported that about six months worth of data, covering 45.7 million credit and debit card account numbers, had potentially been compromised. But by February, the number of accounts had grown to more than 94 million, and it became clear that the hacking had begun as long ago as July In March, we learned that stolen information had been used fraudulently in an $8 million gift card scheme the previous November, one month before the company even learned of the breach. In April, three states banking associations filed a class action lawsuit against TJX to recover the costs of damages totaling tens of millions of dollars incurred for replacing customers debit and credit cards.

7 In May, an article in the Wall Street Journal noted that thieves were able to access data streaming between hand-held price-checking devices, cash registers and the store s computers. This was because TJX had an outdated wireless security system, and had failed to install data encryption technology on its computers [emphasis ours]. Twenty-one U.S. and Canadian lawsuits were filed, seeking damages from the retailer for reissuing compromised cards. In July, U.S. Secret Service agents found TJX customers credit card numbers in the hands of Eastern European cyber thieves who created high-quality counterfeit credit cards. Victims were from the U.S., Europe, Asia and Canada, among other places. This story continued to unfold throughout 2007, with TJX agreeing to pay for credit monitoring services for affected customers, reimbursing customers who had to replace driver s licenses, and paying $40.9 million to fund an alternative recovery payments program for customers affected by the breach. At least 19 lawsuits have been filed, and there are investigations underway by the Federal Trade Commission and 37 state Attorneys General. TJX is a company with a $13 billion market capitalization, so it should be far better able to weather storms than most small- and medium-sized businesses. But in the days following the initial disclosure, its stock lost more than 13% of its value as daily trading volume nearly doubled; by the middle of March, shareholders had lost $1.75 billion in value. Clearly, no company is immune to either the risks or the costs of a serious data breach. So whether by simple theft of backup tapes from an intern s trunk, or a sophisticated multiyear hacking of corporate IT systems, unencrypted data is clearly at risk, and capable of producing potentially fatal consequences for the organizations that lose control of it. In Depth: Implementing Encryption Successfully Fortunately, encryption functionality can be easily integrated into an organization s backup processes, protecting all data on the company s servers and backup devices, and all data taken offsite for archiving. All encrypted data is rendered unintelligible until it is decrypted using the original keys. From a disaster recovery (DR) perspective, it is imperative to have your data backed up and stored offsite, preferably in a city far away. The historical approach to offsite backup using removable media such as disks or tapes is rapidly being supplanted by electronic data vaulting. But in either case, the data must be encrypted before it leaves your site. For small- and medium-sized organizations, the ideal data encryption approach must be both affordable, and easily integrated into a comprehensive data backup and business systems continuity solution. Let s examine the issues of keys and key management, and several alternative methods of encryption. Small and mid-sized companies face similar data security and protection challenges as their larger peers, but frequently have not implemented a reliable data protection and business continuity solution because of cost and implementation obstacles unique to smaller companies... - Laura DuBois, IDC Research Director for Storage Software.

8 Keys and Key Management A key is a piece of information, or parameter, which controls the operation of a cryptography algorithm. Modern encryption algorithms typically use either symmetric or asymmetric keys. Asymmetric key encryption uses a pair of keys, called a public key and a private key. The private key is kept secret, while the public key may be widely distributed to users. The keys are related mathematically, but the private key which is required to decrypt the data cannot be derived just from knowledge of the public key. Data encrypted with the public key can be decrypted only with the corresponding private key. Asymmetric key encryption is best suited for protecting data that has a wide audience, like web sites with secure access established for many users. Symmetric key methods use the same key for both encryption and decryption. Symmetric key encryption algorithms are typically much less CPU intensive, and therefore operate more quickly as much as 100 times faster than asymmetric key encryption algorithms. Symmetric keys are excellent for use with devices and appliances in which the need to share keys is very limited. This is the case with data backup devices, where one specifically does not need to have many parties with access to the key. It s Called the Key For a Reason If you lose your house key, a locksmith can pick the lock mechanically and help you regain access. If you lock your keys in the car, there are many specialized tools that can help you open the door. But any encryption method that allowed this kind of alternative access in the event of a lost key would be fatally insecure. The nature of today s methods is that well-encrypted data is essentially indecipherable to thieves and completely lost to the owner in the absence of the necessary key for decryption. This puts enormous pressure on the owner to not forget the key; at the same time, it s important to pick a strong key, often many, many characters long, which makes it harder to guess, but also harder to remember. And writing the key down brings its own obvious security risks. Unitrends recognized the importance of key protection and key management early in the development of its InCrypt product, and built a unique and powerful set of features to ensure the keys stay secure, and also help users avoid the loss of a key that could be so devastating to their business. We ll discuss this in more detail later. Key Escrow Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow by a third party, like a legal firm, so that a designated employee or executive can obtain the keys if they are otherwise lost. The process of placing encryption keys in escrow protects a company from any single employee being the sole access to vital, encrypted data. Using an outside party, like an organization s law firm, may present security risks, and should be implemented with great care. There are legal firms that specialize in this type of security management. Breaking a Key The simplest method of unscrambling encrypted data is what s called a brute force attack simply using computers with very high computational power to attempt decryption using every possible key. Let s go back to the decoder ring example under Encryption Defined. If the two rings had only the letters A-Z and the numbers 0-9, there would be only = 36 possible combinations of outer-ring position and inner-ring position. This is equivalent to having only 36 possible keys in this encryption algorithm. Obviously, it would be easy to try each combination on the first handful of scrambled letters, and it wouldn t take long to stumble upon the correct key. So short keys those with a limited number of possible combinations give less protection against brute-force attacks than longer keys.

9 Key lengths are measured in the number of binary digits ( bits ) they contain. Currently, key lengths of 128 bits (for symmetric key algorithms) and 1024 bits (for public-key algorithms) are thought to be adequate to render a brute force attack impractical, and the encryption algorithm essentially uncrackable. Nonetheless, Unitrends approach uses symmetric keys of double this length (256 bits) for extra security. Changing Keys Brute force attacks mean there is at least a theoretical risk of one s encryption being broken. But more often, the real risk comes from human compromise action by a disgruntled employee, an accidental publication of the key, etc. One of the best defenses against these risks is a simple periodic change of the key being used to encrypt information. By changing keys frequently yearly, quarterly, or even monthly, depending on the nature of the data and the needs of the organization the odds are in the user s favor that the key will have been changed before it is accidentally published or available to a malicious user. The best approach to encryption key management is to make your key or keys moving targets for potential threats. But: the more often keys are changed, the more the complexity of an encrypted backup solution increases. Which backup was encrypted with which historical key? Which vault data needs to be re-encrypted with the current key before new, changed blocks are added to the existing structure? Users need a solution that contemplates all these complexities and handles them without placing an unreasonable burden on the individuals involved humans with fallible memories. Encryption Methods Different types of encryption Encryption can be performed using a multitude of algorithms to protect the data. It can also be implemented at a number of different points in the data management process. Let s call these implementation algorithms and implementation methods, and examine several of each. Taken together, the software algorithm and the unique process that converts plain-text data into encrypted data are called, in cryptography, a cipher a cryptographic system. Implementation Algorithms Several different encryption algorithms are in use today, including Data Encryption Standard (DES) and Advanced Encryption Standard (AES). DES DES has been one of the prevailing encryption standards for the last 10 years. It was originally created by IBM, partly based on a request from the U.S. Federal government for a standardized data encryption tool that could be widely used by both the public and private sectors. DES was the first commercially-available cipher that used the concept of multiple, sequential encryption passes, with unique keys for each (also known as a multipass encryption method). In this approach, a single block of data is run through an encryption cipher initialized with a key. The results from this encryption cipher pass are then run through another cipher initialized with a different key. This process can be continued from one to 48 times (passes) in a row. Each pass makes it more difficult to crack the encryption. The number of passes is mostly dictated by the time available, since large amounts of processor (CPU) time are needed for the series of passes. AES In 1998, the National Security Agency (NSA) held a contest to find a new data encryption standard. Out of the three finalists, the Advanced Encryption Standard was selected. In 2001, the U.S. Federal government made AES its standard encryption process, and its official recommendation for all public and private data encryption efforts. Unitrends uses the AES approach.

10 In many ways, AES is an evolution of DES. It s based on the same principles, like multiple pass transforms and unique keys. But AES is unique in the degree to which the data is changed during each transform pass. While DES encryption is fairly linear, in that each transform pass operates in the same manner (but with a new unique key for that pass), AES adopts a new encryption pattern or methodology with each subsequent pass through the data. This makes reconstructing the original data far more difficult for someone on the outside. AES operates on data that has been brought into an array. Imagine taking 16 playing cards and placing them in a series of four rows and four columns to make a table. This is similar to the process AES encryption uses, placing 16 bytes of data (equal to 128 bits) in a 4-by-4 array. Each array then undergoes a series of transformations (or rounds, as they are referred to by AES), in which the actual order of the 16 bytes of data is altered using a pattern specific to that round. The new data pattern is then encrypted. The different types of rounds in AES encryption include: SubBytes a non-linear substitution step in which each byte is replaced with another according to a lookup table. ShiftRows a transposition step in which each row of the array is shifted (offset) a certain number of steps. MixColumns a mixing operation which operates on the columns of the array, combining the four bytes in each column. and others. The number of rounds used is controlled by the size of the key used. AES conducts 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys. This combination of structure change and encryption removes the ability to calculate patterns, and renders the encryption virtually unbreakable. Implementation Methods Data encryption can be incorporated into your workflow in a variety of different ways, each with its own advantages and disadvantages. When implementing data encryption on a network, there are four basic ways to approach the process: File System Encryption on a Server File system encryption is probably the easiest to implement; the tools needed are often included with new Windows Server operating systems. But this type of encryption places very heavy CPU demand on the server, which often makes it impractical for a busy Exchange or SQL server because of the computing power required. Additionally, server file system encryption doesn t allow for centralized management rather, it must be implemented on a per-server basis, and managed only with respect to that system. And in a multiple-os environment, this kind of file system-based encryption may not be available for each OS used.

11 In-line Encryption In-line encryption is typically performed by a dedicated hardware appliance, and is fairly simple to implement. The appliance normally has two network connections, with plain text coming in through the network, and cipher (encrypted) text coming out of the device. These systems operate on the individual Internet Protocol (IP) packet level, and encrypt the non-header portion of each network packet (i.e., the payload, or the information that s being carried to its destination) as it passes through the device. Encryption appliances can also be set up between a company s servers and a backup device, to provide encryption of all the data that s about to be saved on tape or other media. In-line devices provide wire speed encryption, meaning that the servers and backup devices can operate at their own natural throughput, as if there was no encryption being performed. There are, however, important and intrinsic characteristics of this encryption methodology that make it a poor choice for some firms. These include the cost of implementation, and certain risks and time delays in the event of a real disaster. Due to the sheer CPU horsepower needed to keep up with a busy gigabit Ethernet segment, in-line devices require lightning-speed hardware to operate. This pushes the typical cost up to a base price of at least $25,000. And in the event of a real disaster, one affecting the functionality of the encryption appliance itself, a new unit must be procured before any file or system restoration can occur. This is because the encryption appliance provides the only means of decrypting the data that is now stored on the company s servers or backup media. Backup Media Encryption The most commonly used type of encryption takes place on the backup media either on the server driving the tape backup device (for example, the media server in a Veritas environment), or on the tape drive itself. When implemented on the tape server, encryption can dramatically reduce the performance of the backup system, since a large portion of the server s CPU resources are diverted to perform the encryption. Using a tape drive that provides its own encryption processing (such as certain IBM LTO units, in which each tape drive has a separate CPU responsible for encryption) can reduce the overall load on the tape server. These drives are expensive, however, and require that all tape units be of the same model or family to achieve full encryption. Backup Device Encryption The key difference between backup device encryption and backup media encryption is where the encryption is performed. Encryption at the backup device level provides much stronger overall data security. This is true because the data can be encrypted once (at the device), remaining encrypted regardless of its location at any future time. It remains fully encrypted on the online backup system; it s also encrypted when transferred to an archive disk or tape, or otherwise sent offsite (for example, electronically vaulted to a Unitrends Data Protection Vault in another city). If data is encrypted as it arrives at the device, than the data stored on the backup device for local rapid recovery is also protected from inside attacks. Although this does not secure the original data (still presumably residing on the company s servers), this approach avoids the performance degradation associated with file system encryption, and also removes the complexity of applying encryption tools across multiple operating systems. This is the approach that Unitrends offers in its InCrypt product. It offers the best combination of strength, ease of use, and cost efficiency for small and medium-sized businesses.

12 Planning a Successful Implementation There are six keys to implementing an encryption capability within your overall data protection and disaster recovery strategy. These represent the true critical success factors for most SMBs. Get these six right, and you ll have a very high probability of success. 1. Maintain universal data recovery Thought it seems obvious, this first rule is not automatically satisfied by some other encryption solutions. Simply put: wherever the encrypted data resides (local backup device, remote data center, offline media, or archive media), you must be able to reliably reverse the process and produce un-encrypted data. This can be proven by the testing protocol discussed below. 2. Select a single approach for all your sensitive data Encryption is too important, and too complex, to implement in multiple methods. Some systems only work with certain operating systems; some require dedicated hardware; some work only for local machines. Be sure to pick an approach that allows you to implement encryption once, and protect all your sensitive data through a single, integrated capability. 3. Minimize resource impact Encryption can come at a price. Be sure yours is acceptably small. For example: Device throughput be sure the CPU load from the encryption process is sufficiently lightweight to avoid a material decay in the rate at which your systems process their normal work. Network bandwidth Unitrends InCrypt saves network bandwidth in two ways: by compressing data before transmission, and by sending only changed blocks of data. 10 Disk space usage the same compression algorithms and changes-only vault synchronization help minimize disk usage at a time when data volumes are already growing almost 100% per year. Impact on IT staff a simple, powerful, and intuitive user interface like Unitrends Central Management Console allows your IT staff to implement encryption quickly, and keep your data secure without diverting excessive time from their main operational tasks. 4. Prevent unauthorized access to data Data should be encrypted so that a clear text copy may be reproduced only after proper authentication has been provided. And all possible scenarios including the potential theft of the backup device containing the encrypted data must be contemplated and planned for. 5. Have a key management strategy You should choose a solution with powerful key management capabilities, making it easy to change keys frequently, recover old files for which the original keys may have been lost, and otherwise strike a balance between safety and accessibility. 6. Test in advance Like testing your ability to actually recover information from your backup systems, testing the process of reversing your encryption system is critical. You need to prove that your solution can both encrypt (and store encrypted data in all the locations under #1 above), and also successfully create clear text from any of those encrypted sources. Only then can you truly sleep well, confident that your firm won t be the next TJX story to appear in the press.

13 Unitrends InCrypt Tailored for Success in SMBs Without going into great detail, we designed Unitrends InCrypt technology to satisfy each of these six keys, and to outperform other commercially-available encryption technologies in small and medium-sized businesses. Here s a quick overview of our approach, and the key benefits. The original data is typically transmitted from the customer s computers ( clients ) to the Unitrends DPU in clear text, and uncompressed. If these clients are connected to their DPU through an encrypted tunnel such as IPsec or VPN, their data is automatically encrypted in flight, without any involvement or configuration of the DPU software. Unitrends customers generally prefer that the security parameters of their LANs and client systems be defined and controlled by the customer, not by our devices. The Data Protection Unit appliance both compresses and encrypts your data, all in one pass. Compressing data before encryption results in less data to encrypt, and also obscures repeating patterns in the data. We do this through a special hardware co-processor, using a blockbased encryption algorithm, to avoid impacting overall device performance. As all businesses know, even in the most secure environments, backup data can be lost or stolen. That s why we believe it is smart to add an extra layer of security by encrypting sensitive data, said Richard J. Reiffer, Trivalent Group CTO/ Solution Delivery Manager. Unitrends continues to deliver innovative, marketleading data protection solutions. We are excited to add its turnkey encryption capabilities to our customers existing Unitrends Data Protection and Rapid Recovery systems, providing them with the utmost security and protection. This encryption is performed before the data is ever written to disk in the DPU, ensuring that all downstream instances of the data (for example, in flight to a remote Data Protection Vault, on that vault, or on a removable archive disk) are also fully encrypted. If the customer uses a tape drive attached to the DPU for archiving, the data will be automatically encrypted before being written to the tape. 11 For key management, Unitrends has developed a unique design that both offers unmatched security and protects the user to the greatest extent possible from inadvertent key loss. We ve designed a master key file, holding a history of encryption keys that were used at various points in time to encrypt the user s data. This file has its own master key, which is used only to lock and unlock the master key file, not to encrypt or decrypt user data. Upon creation of the master key file, the user is prompted to store it on removable medium such as CD- ROM, flash disk or any other media used for backup purposes. Unitrends strongly encourages users to store their master keys on a separate form of media. Using this scheme, a user with the most current master key can always decrypt old data, using the history of prior keys kept in the master key file. This provides important protection against loss of prior encryption keys, a real risk in a world where IT employees move on to other positions or other companies. Finally, we offer additional layers of protection, such as requiring the master key to be entered when the DPU is powered up. This ensures that, in the event of a DPU theft, the encrypted data remains inaccessible to a thief without the master key.

14 The key benefits of Unitrends approach to data backup and encryption include: Our DPU appliances offer integrated encryption, avoiding the need for additional hardware purchases. Encryption is performed automatically; no unencrypted data ever exists on the DPU. Unitrends uses standards-based AES 256-bit encryption, supported by the Federal government and the National Security Agency. Encryption is performed in co-processor hardware, minimizing the impact on CPU performance. Data is fully encrypted on all downstream media offsite vaults, removable archives, etc. We minimize network bandwidth requirements through compression and block-level synchronization. InCrypt includes a sophisticated key management capability, protecting the data while protecting the user against inadvertent loss of historical keys. The entire integrated system is simple to install and simple to use. Every day, we see more media stories of data breaches. A visit to indicates that data security breaches occur nearly every day in the U.S. Historically, the cost and difficulty associated with implementing encryption to augment a firm s data security was simply too daunting, especially for small and medium-sized enterprises. But now there s a solution that brings enterprise-class encryption technology to businesses of all sizes. Ask your Unitrends Regional Sales Manager about InCrypt an affordable, efficient and highlysecure encryption method, fully integrated into our family of Data Protection Units and Data Protection Vaults. 12 Visit for further product releases and enhancements. We welcome your suggestions. Please us anytime at sales@unitrends.com.