Wednesday, July 16, 2008

Hardwiring Disk Encryption for Extra Protection

Industry analysts believe that security is no longer the number one priority. Security has been displaced by topics like business intelligence and performance management. Bear in mind though that all this means is that security remains a concern but just not number one.

Indeed Gartner’s 2008 survey of CIOs point to security as 6th in importance from a technology perspective and not in the top 10 from a business perspective. And yet we continue to read reports about security.

According to the Privacy Rights Clearinghouse (PRC), a nonprofit consumer organization in the US, there have been a total of 230,454,030 records containing sensitive personal information have been involved in security breaches in the US since January 2007.

“With industry reports estimating 700,000 laptops stolen every year and the associated costs reaching $5.4 billion, organizations face a clear and pressing security threat,” said Christopher So, General Manager, Volume Products Division, Fujitsu Hong Kong Limited.

Where should security start? Should it be at the servers that run business-critical applications? Should it be at the device level that houses the behavior of its owner? Should it be on the Web where a vast major of information flows today? Or should it be down to the individual components that make up the technologies we use today to make life simple and complicated at the same time?

There are those who believe that security must be deployed across as wide a spectrum of data entry points as possible. Some vendors have been working to integrate security measures down to the firmware that makeup part of the embedded intelligence in computing devices.

I recently spoke to a security expert who noted that no matter how many times you delete a file on a hard disk or portable memory media like a USB thumb drive, there is software available that can recover the data. The hour-long debate on what constitutes the protection of information boils down to using data encryption technology to keep confidential information private.

Data encryption falls under three broad categories: data-in-transit; data-in-use; and data-at-rest.

Encryption of ‘data-in-transit’ protects information as it moves from node to node across local networks, wireless networks and the internet. There are a number of widely adopted standards for this type of encryption, including SSL (Secure Sockets Layer), TLS (Transport Layer Security), and IPSec (Secure Internet Protocol). Encryption of data-in-transit prevents thieves from intercepting or ‘sniffing’ sensitive data traffic as it travels the network.

‘Data-in-use’ refers to data being accessed or processed by applications or databases. Efforts to secure data-in-use include digital rights management (DRM), content management and content filtering technologies.

‘Data-at-rest’ (‘DAR’) refers to data in computer storage (and excludes data temporarily residing in computer memory). Examples include data stored on a computer hard drive, a database on a networked server, and files copied to a USB drive. The recent stories in Hong Kong about theft of information via USB drives point to the uncontrolled proliferation of USB drives within enterprises.

There are 2 fundamental means of achieving encryption for data-at-rest. The simplest method is to encrypt individual data files and folders. A more comprehensive approach is to encrypt the entire storage media.

“Disk encryption, has emerged as the ‘best practice’ for protecting data-at-rest on endpoint devices – desktops, laptops, and removable storage media. By encrypting data at the sector level, full-disk encryption provides the most comprehensive safeguards in the event of the loss or theft of an endpoint device,” says Adrian Chua, Sales Director Asia Pacific for WinMagic.

Kelvin Lim, regional manager for South Asia at Check Point, notes that with disk encryption, a user will not need to employ file encryption on a file-by-file basis, and still obtain complete data integrity and security.

“Disk encryption renders the information on an entire disk unreadable to unauthorized third parties without the credentials. Disk encryption removes the security decision from the end user, ensuring compliance without any form user interaction or training,” Lim adds.

As employees become more mobile the incidence of notebook theft (and subsequent data loss) has been on the rise. While few organizations agree on the dollars lost associated with these theft.

David M. Smith, associate professor of economics at Pepperdine University in Michigan, believes there are three cost components associated with data loss: cost due to technical services, lost productivity and the value of the lost data. Together, this amounts to US$3,957 per incident. Click here for additional details on his findings.

Hard disk vendors like Seagate and Fujitsu have added encryption into a number of their products. Seagate partnered with encryption specialist WinMagic to provide additional protection for some of its Momentus hard drives.

Fujitsu introduced the world’s first 256 bit advance encryption standard (AES) technology offering secure, highly automatic hardware encryption at the drive level.

The built-in AES automatically encrypts data when writing to the hard drive and decrypts during read process. The Fujitsu FDE implementation also includes an advanced secure erase feature to help reduce risks associated with re-using hard drives.

Security, simplicity and ease of use are what users and IT managers expect of technology today.

For example the Fujitsu MHZ2 CJ drive series creates a simple-to-use and virtually impenetrable data lock down, with no encryption keys remaining on the machine when it is powered off. “The data on the disk drive remains inaccessible without the password, delivering advanced protection for the organization owning the machine, and the critical data for which they are responsible,” said So.

But in case you think that FDE is the answer to all of your encryption needs, there are those who think otherwise.

Chua cautions that full-disk encryption is not suitable for applications. File, folder and container encryption (collectively ‘FFCE’) extend cryptographic safeguards to shared files and folders on departmental servers and other common storage media.

“FFCE offer protection for data files in transit (e.g. e-mail attachments) as well as additional security against internal threats. Issues surrounding the protection of sensitive data or personal identifiable information (PII) are complex,” explains Chua.

In today’s age of community-based hacking and relentless threats coming from every conceivable route, data encryption should be part and parcel of an organization’s overall security policy.

Tuesday, July 8, 2008

Why ISO 14001 is relevant to a sustainable initiative

No one can be quite certain about the date of the “sustainable” revolution but it can be argued that the turning point came after Al Gore won the Nobel Peace Prize for 2007 for his work on Climate Change. Of course I am referring to the documentary film (docufilm): “An Inconvenient Truth”.

These days it is almost uncharacteristic of any company – big or small – not to have a program that addresses (or claims to) the issue of sustainable best practices or environmental friendly processes.

Within the IT community, I’ve seen my fair share of announcements among IT vendors of their “green” plans. I’ve spoken to a few senior executives who are more than happy to share their view as to what their companies are doing in terms of green. And you know what? I am still a skeptic because I’ve seen enough vaporware-type initiatives that get announced with a lot of publicity but no substance to back it up.

So it’s refreshing to know that there are a few companies that have embodied a green initiative quietly, internally, long before the Al Gore docufilm.

The Fujitsu-Way

Take the case of Fujitsu, a Japanese company specializing in semiconductors, computers, telecommunications and services. Historians claim that the company started its road to green in 1935 at the behest of its founder, Manjiro Yoshimura.

Although its green initiative wasn’t formalized until 1992, the company started deploying environmental control systems across its factories as early as 1972. (click here for a list of environmental activities) The company’s “Green Policy 21” provided the basis for the creation of environmental management system (EMS) framework which today offers a common management structure to deal with environmental regulations.

However, “Green Policy 21” is not restricted to Fujitsu’s internal operations. It has been extended to include business partners and suppliers that form part of the company’s supply chain.

Fujitsu joins the ranks of over 130,000 companies worldwide that have achieved ISO 14001:2004 certification since the standard was first published in 1996. Fujitsu achieved worldwide ISO 14001 certification in March 2006 with an EMS framework encompassing over 126,000 employees.

ISO 14001 – the guidepost of all things green

ISO 14001 is concerned with environmental management. “This refers to what an organization does to minimize harmful effects on the environment caused by its activities, and to achieve continual improvement of its environmental performance,” said Alan Bryden, ISO** Secretary General.

Why ISO 14001? Apart from recognition that the company has a “green” policy, what does a company gain from being certified?

Bryden notes that there is mounting pressure worldwide from both private and public sector to show responsibility towards the environment. “An environmental system based on ISO 14001 provides a structured, systematic approach which is internationally recognized,” adds Bryden.

ISO 14001 is a process-based, not a performance-based, standard. The focus is on establishing internal policies, procedures, objectives and targets. It is not a one-off project but one that calls for continual improvement.

According to Russell V. Thornton, manager of environmental certification for Det Norske Veritas (DNV*), ISO 14001 does not explain how to achieve goals, nor does it quantify a necessary level or type of performance improvement. Compliance with applicable laws is mandatory, but the use of the standard is voluntary. Self-declaration is an option.

Thornton says “certified companies report increased operational efficiency, marketing advantages, more organized or systematic regulatory compliance, greater regulatory flexibility, and community recognition. Certified companies have identified financial benefits, such as improved stock value, and have experienced some reduction of trade barriers”

The pressure to pursue a green initiative is not always voluntary. IT vendors are increasingly under pressure by their enterprise customers to be seen as green or faced being left out of the list of accredited suppliers.

“Over the past few years, environmental regulations on products have become stricter in Europe and other regions of the world,” said Atsuhisa Takahashi, President, Corporate Environmental Affairs Unit at Fujitsu. “Recognizing the importance of having a common management structure to deal with environmental regulations, Fujitsu took the initiative to obtain integrated ISO 14001 certification.”

“Within the next few years it may not be possible to conduct business in most of the world unless you can prove your ‘green’ credentials,” says Bob Hayward, Director of IT Advisory at KPMG.

Hayward notes that being green is seen as a competitive differentiator. “Many organizations are prepared to pay more for green products and services, since in the long run this will save them money,” he adds.

As an industry that has long been accustomed to hyping new capabilities, one would wonder if this ‘green’ initiative among IT vendors is nothing more than a fad.

Hayward believes that vendors like Google, HP, Dell, Microsoft and Fujitsu have embarked on major programs and investment to design, build and deliver more environmentally-friendly products. Pursuing a green initiative is neither trivial nor cheap. It’s a commitment with serious investments involved.

For example, Fujitsu invested 19.43 billion yen in FY2007 on a range of green initiatives including pollution prevention, global environmental conservation, R&D and environmental remediation.

The certification has strengthened corporate governance for the entire Fujitsu Group by enabling the systematic collection and sharing of essential information as our supply chains expand rapidly worldwide. “With a stronger governance system, we are more effective at implementing environmental measures such as fighting global warming, eliminating the use of hazardous substances in our products, and building product recycling systems outside Japan,” adds Takahashi.

Can you sell green without being one yourself?

Phillip Sargeant, Managing Vice President for Gartner reckons it is possible but IT vendors that have themselves deployed a green initiative have a stronger story to tell to enterprise customers looking to understand how to design, build and deploy a sustainable or green initiative.

The right approach to green

You can’t be green unless you are willing to spend some “green” (bucks). Like all other certification exercises ISO 14001 doesn’t come cheap. “If the sole objective is to obtain a certificate to hang on the wall, then the cost may indeed be high and the organization may well find that the certificate is not the passport to business which it imagined,” said Bryden.

Sargeant worries that green equating green solely on energy savings – in other words, saving money. It is much more than that. “Green can be associated with recycling, better supply chain management, better use of technology to reduce overall operating costs – such as using telepresence technology in favor of physically travel to conduct business meetings,” says Sargeant.

Cost savings should not be the be-all and end-all of a green initiative. “Going forward, they need to give thought to sustainability. Organizations need to change their mindset from simply saving dollars to being able to do something for the rest of society – social responsibility. A lot of organizations are not yet there,” adds Sargeant.

Bryden concurs and offers his thoughts.

“If implementation, with or without certification, is seen as an investment on which there should be a return, then the cost can be balanced against savings made in the use of materials, energy and transport, reduced waste. Whether or not an organization implements ISO 14001, it will become more and more difficult for the management of organizations to ignore environmental issues – and such ignorance has a high potential cost,” concludes Bryden.


* DNV is a supplier of accredited management systems certification services worldwide.

** ISO (International Organization for Standardization) is the world's largest developer and publisher of International Standards with a network of the national standards institutes of 157 countries, one member per country, with a Central Secretariat in Geneva, Switzerland, that coordinates the system.

Tuesday, July 1, 2008

Rising PC adoption is translating into higher software piracy rates in Asia

Software piracy remains the scourge of many a software vendor. Through the efforts of lobbyist organizations such as the Business Software Alliance (BSA) governments in Asia are taking positive steps in reducing illegal software use both at the consumer level and in some cases even at the corporate and government levels.

The recently completed “Global Software Piracy Study” conducted by IDC and sponsored by the BSA commends combined government and industry anti-software efforts in slowing down software piracy. Click here to read the report [http://global.bsa.org/idcglobalstudy2007/]

“However, rapid PC growth in higher-piracy emerging markets translates into an overall increase in global piracy,” said John Gantz, chief research officer at IDC. “We expect this trend to continue, meaning industry and government must increasingly focus their efforts on combating piracy in these emerging economies.”

Leading the industry charge is the Business Software Alliance (BSA) – a a trade group established in 1988 and representing the interests of some of the world's largest software manufacturers.

Roland Chan, Director of Marketing for BSA Asia, claims that the joint efforts by BSA and local government bodies is helping change the perception about the value of intellectual property.

“The success of the awareness building process stems from the close cooperation between the relevant government agencies and the BSA in rolling out marketing program,” says Chan.

What sort of success are we looking at?

In Hong Kong, the BSA worked with the Hong Kong Government’s Intellectual Property Department to launch the Genuine Business Software Campaign in October 2006. Chan claims that the GBSC has resulted in “tremendous awareness being created in the corporate sector of the virtues of software asset management.”

Similarly, in Malaysia, the BSA works closely with the Malaysian Government’s Ministry of Domestic Trade and Consumer Affairs, to conduct enforcement related PR and rolling out marketing/educational programs each year. Likewise in Singapore, the BSA works closely with the Intellectual Property of Singapore to conduct educational awareness programs. In Indonesia, the BSA works with closely with the Police as well as the Directorate General of Intellectual Property Rights.

Asked what remains as the biggest stumbling block to a wider acceptance of IP and significant reductions in software piracy, Chan says there is still work needed to increase appreciation for the role and importance of software as an invaluable productivity tool of a business today.

“It may be obvious to some, but for others, they still consider computers as a productivity tool rather than software. The simple answer is that you need software for a computer to function as a productivity tool. Once there is full appreciation of the role and importance of software, that is when an organization would attach full value to the productivity it brings about, and be better prepared to pay for it,” notes Chan.

The mantra of the BSA hasn’t changed significantly from its early days but the scope of the effort has expanded with the widespread and growing adoption of the Internet.

Chan notes that “Today, with the wide penetration of the internet, the threat of virus attacks is prevalent everywhere with hundreds of new threats introduced each week.” Chan encourages everyone to go to the organization’s website to get a glimpse of the BSA’s range of work.

Two things might change the software piracy landscape in the coming years: Software as a Service (SaaS) and Open Source Software.

In the movie, “Sum of All Fears” a scared and angry American President is playing Chicken with his Kremlin counterpart. In the middle of the war of testorone is CIA analyst Jack Ryan. Seeking to thwart the threat of world annihiliation Ryan communicates to the Russian President using the Internet. The American President ordered his aides to cut off Ryan but was bluntly told that it is the nature of the Internet to be indestructible.

While the Internet has had its glitches, it has found a strong following with business users of all size and shapes. This low cost, highly reliable platform for conducting business is finding new found meaning to businesses in the form of business software sold on a pay-as-you-go model.

Not quite farther away is Open Source software. Once the playground of students and the education community, Open Source software that mimicks many of today’s proprietary software is starting to take root. And someday, businesses will find reliable and low cost or almost “free” software that can run their operations just as effectively as they do today with current generation of applications.

What will work best for your business? Chan advises companies thinking of about what software path to take to do their homework. “Do your research, find the best solutions that fill your needs, and evaluate the total cost of ownership when considering investing into IT,” he says.

“Software is a productivity tool, and the right selection, usage and management will result in businesses realizing maximum productivity and security in their use of IT,” concludes Chan.