Data Protection

Home > General > Data Protection

September 4th, 2009

We are currently going through a fairly large project internally, and part of this is a “risk register” against the business. Now this includes a lot more information than just simply data on disk, but also people, reputation and so on. For me, now that I have started this project, that is a key part of data protection.

It’s an interesting topic, and something that I’d like to share with you at this early stage in my own project as it makes you look at the storage aspects in a different light.

What affects a piece of data’s risk class?

Who has access to it?
How confidential is it?
Does it have a tangible value?
How portable is it?
Could it potentially damage the business reputation?
Is it protected?
… probably a lot more!

Some of these are all questions we already have asked about the data sets as we need to define snapshot, replication and tape policies, but data protection goes a lot further than just this. Interestingly the Zemanta plugin for my blog has linked “data protection” with “Information Privacy”, which is a key point!

Who has access to it?

Not just from a front-end authorised point of view, although you do need to know this. Payroll for instance, generally it would just be HR and Accounting that have access to this, but is there a mechanism for anyone else to gain access to it? If so, is there any audit control to check who has been granted access, or who has gained access? The audit control is almost more important than the security in the first place. Security can and will always be broken, but if you can prove it was broken, then you can fix it!

How confidential is it?

Most of us have a fair grasp on what is confidential and what is not. Employee data, Customer data, Payroll, Accounting, are all obvious candidates for highly confidential data. But other things are still confidential, even if they are not classified as highly confidential. External IP schema’s, low level system passwords, although they may be freely accessible by the technical teams, they are not available to the secretaries for instance, so this makes them confidential in some way. Are they marked as confidential? Other than applying common sense, have you ever told anyone that they shouldn’t email a domain administrator password around for instance?

Does it have a tangible value?

Very difficult one to play and the analysts will love this! But some things have a real immediate tangible value, purchase order or a signed contract maybe. There is scope for defining a cost scoring system against data, but it is very difficult to calculate. Something will cost money in very indirect ways, for instance if something damages the company’s reputation, it could cause loss of revenue. This should really be assessed in other areas and not necessarily spend time putting a tangible value on every piece of data (I want to finish my project this year!!!).

How portable is it?

With the age of Virtual Machines, portability is very important, and very dangerous. Someone can literally just walk off with an entire database system now on a portable hard drive! How do you protect against this? Is there any way to bind key systems, or police raw access to them? As much as technology and WAN speeds have come along, it’s still fairly unreasonable to assume you could email an entire system. However it is very easy to email spreadsheets and documents around. Preventing this from happening can be restrictive on day-to-day running of a business, so we fall back to auditing and monitoring. There are a lot of bases to cover, portable media, email, file shares, etc.

Could it damage the business reputation?

This is a good one, and not something you might immediately think of. Not just necessarily “dirt” on the business, but perhaps the business has a key technology or system that means they are unique in the market. If this is leaked to another company, it could damage the reputation as others could then start doing the same. Could the business reputation be damaged if the data were absent? If a key system was offline for a period of time, how would the business reputation be damaged (take a look at some start-up Cloud companies!). A damaged reputation could sink a company. Naturally company ethics and business practices are a good way of destroying a reputation. I have many friends that still won’t buy Nestle!

Is it protected?

And this is an amalgamation of all of the above really. The questions above help you to define the business value on a particular data asset. So if it has a high value, how protected is it? How protected should it be? How long can the business survive while it is being recovered? How much would data loss actually cost the company?

Depending on the risk class and business value will greatly affect the protection and auditing you deploy around it.

Putting this into action

I’d love to hear from people about how you put the above into action. We use NetApp ourselves (definitely practice what we preach), and this gives me a great level of control over my data sets and the protection we employ. Protection goes further than just snapshots and tape backup however; we need to protect it from more than just data loss. While NetApp have some great tools for protecting against data loss, there is a requirement to help with the other areas of data protection, and I’d love to see NetApp build on this space.

I have some experience using tools like Varonis, Acopia, Northern Storage Suite, NTP QFS, TekTools, to name a few, and these have all helped us in the past in deploying a complete solution. I have said on several occasions, and it’s something I really believe in so I’ll say it again; a complete solution is a combination of many different technologies that complement each other.

I’d like to revisit this topic again in a few months when I have progressed my project further, but I’d like to hear from the field to see what other people are doing to gain complete data protection.