Story image

Software or Hardware Based Encryption Solutions: Which Is Better for Your Customers?

01 Aug 11

Digital content is growing exponentially and user demands for portable data are only increasing. As a result of this combination, laptop and portable storage media use has proliferated. But by definition, portable devices are vulnerable. What happens when they go missing? What happens if they are taken? In the past few months, we have seen a marked increase in high profile data breaches due to the loss or theft of portable devices:
July 08, 2011 Morgan Stanley - Morgan Stanley has warned 34,000 investment clients that their personal data may have been stolen. The data was on two CD-ROMs that have been password-protected, but not encrypted.
June 06, 2011 Healthcare partner – 14,000 patients had their records exposed when a portable storage device was stolen in an office burglary.
May 27, 2011 Spartanburg Regional Hospital - 400,000 patient records were exposed when a laptop computer was stolen.
(Source: Privacy Rights Clearinghouse)
Significant data breaches such as these have caused an increased interest in encryption solutions for data protection. Encryption is widely regarded as the best method for securing data at rest or in transit.
New Zealand companies are just as worried as their international counterparts about data breaches. The time is right for New Zealand resellers to offer their customers compelling data protection solutions. But which encryption implementation is right for your customers, software-based or hardware-based?
Software Based
Software based encryption is performed by an installed program run on a host system that encrypts and decrypts data as configured by the operator. The software utilises the system’s CPU and OS to perform all cryptographic functions such as encryption and authentication. Software-based encryption can be configured to encrypt individual files, directories, entire disks and portable storage devices. 
Examples: Windows BitLocker, PGP, TrueCrypt, Lumension Santuary
Advantages: Low initial cost, highly configurable, can be used to encrypt internal and external devices.
Disadvantages: Degrades system performance, difficult to install and configure, susceptible to compromised host systems, operating system dependant.
Use Case: A large company that requires only specific employee generated forms to be encrypted and stored locally, other data does not need to be encrypted.  Software such as TrueCrypt would be an ideal solution.
Hardware Based
Hardware based encryption is performed by a device dedicated to perform all cryptographic processes. In most cases they operate independently of the host system and are not dependant on the system’s processing power or resources. Hardware based encryption products include self encrypting hard drives, external hard drives or flash drives.
OPAL compliant self encrypting internal hard drives, DataLocker external hard drives, Check Point Abra Secure Flash Drives
Improved system performance, easy to deploy and scale, increased security
Higher initial cost, difficult to centrally manage,
Use Case:
A law firm that needs to deliver a 1TB of client data to an overseas branch office. An encrypted external hard drive would be an ideal solution.
Impact for Resellers
The current climate will continue to drive customers to seek encryption solutions. When recommending a software or hardware based encryption solution a reseller should remember the following:

  • Take a ‘Who, What, Why, When, Where’ approach to evaluating your customer’s needs, and you will be able to make appropriate recommendations for encryption solutions. In short: tailor your recommendations to your client’s individual needs.

  • A solution is only effective as its implementation. Proper installation and training is essential.

  • Consider offering services rather than just products. Encryption solutions as well as all data security systems require continuous auditing and updating.

  • If evaluating a software based encryption solution, make sure the customer’s hardware meets the minimum requirements.

  • Encryption solutions only secure data at rest or in transit and are only a part of a comprehensive data security policy. Be prepared to meet all of your clients related data security needs. 

Kiwis make waves in IoT World Cup
A New Zealand company, KotahiNet, has been named as a finalist in the IoT World Cup for its River Pollution Monitoring solution.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
How SMBs can use data to drive business outcomes
With the right technology, companies can capture consumer, sales, and expense data, and use it to evaluate and construct future plans.
Survey shows that IoT is RoI across Asia Pacific
A recent Frost & Sullivan survey across Australia, Hong Kong and Singapore shows that IoT deployment improves business metrics by around 12%.
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.