Self-encrypting drives: Understanding the Strategy of Security

By Anne Haggar - 2016-05-23

Several months ago I attended a call with the analysts at Enterprise Strategy Group (ESG) to learn about the results of a survey they conducted among IT professionals. They told us that the number one concern of IT today is security. This was no surprise as security has been a top concern in every survey of IT professionals in the past few years. The point that the analysts wanted to emphasize is how big and very serious this concern is across the enterprise—it represents a real tipping point.

We hear these concerns every day from our customers. Both the number of threats and the sophistication of the bad guys is increasing exponentially. Compliance adds another layer of requirements and non-compliance can result in fines, lost customers, a diminished brand and legal ramifications. Clearly it’s critical to make security a priority with every purchase you make.

While the majority of data breaches are caused by criminals outside of an enterprise, security experts report that 10-20% of reported data breaches are caused by the physical loss of data storage devices—even in the data center! Not only have drives been stolen from data centers, there are reports of entire servers missing.  And there’s another reason to consider providing encryption—retirement. No one wants to be the decision maker who decided to cut encrypted drives from their budget when a retired drive that has not been properly sanitized ends up in the wrong hands.

So what is considered enterprise class security when it comes to SAS solid state drives (SSDs) for the data center?

  1. Self-encrypting drives (SEDs) provide strong security for data at rest on your SED, preventing unauthorized data access. The Trusted Computing Group, which creates and manages specifications for encrypted data storage, has developed a list of the features and benefits of self-encrypting drives for both HDDs and SSDs. The list includes:
    • Transparency: No system or application modifications required; encryption key generated by the drive itself, using an on-board true random number generator; drive is always encrypting.
    • Ease of management: No encryption key to manage; software vendors exploit standardized interface to manage SEDs, including remote management, pre-boot authentication, and password recovery
    • Disposal or re-purposing cost: With an SED, erase on-board encryption key
    • Re-encryption: With SED, there is no need to ever re-encrypt the data
    • Performance: No degradation in SED performance; hardware-based
    • Standardization: Whole drive industry is building to the TCG/SED Specifications
    • Simplified: No interference with upstream processes

    The TCG provides a standard that is called the TCG Enterprise SSC (security subsystem class) and is focused on data at rest. This is a requirement of all SEDs. As the name implies, the TCG Enterprise SSC spec applies to data storage devices and controllers which operate in enterprise storage, anywhere from server-based storage to NAS and large storage arrays.

  2. An additional benefit that SSD SEDs provide is the ability to cryptographically erase the drive. This means that a simple authenticated command can be sent to the drive to change the 256-bit encryption key stored on the drive. This ensures that the drive is wiped clean and there is no data remaining. Even the original host system can’t read the data, so it absolutely will be unreadable by any other system. It’s really a speedy approach to purging data as the operation only takes a couple seconds, as opposed to the many minutes or even hours that it takes to perform an analogous operation on an unencrypted HDD and avoids the cost of expensive HDD de-gaussing equipment or services.
  3. FIPS (Federal Information Processing Standard) 140-2 is a U.S. government standard that describes the encryption and related security requirements that IT products should meet for sensitive, but unclassified, use. This is often a requirement for government agencies and companies in the financial services and health care industries are adopting is as well. An SSD that is FIPS-140-2 validated uses strong security practices including approved encryption algorithms. It also specifies how individuals or other processes must be authorized in order to utilize the product, and how modules or components must be designed to securely interact with other systems. In fact, one of the requirements of a FIPS-140-2 validated SSD drive is that it is a SED. Bear in mind that although TCG is not the only way to get a certified encrypted drive, the TCG Opal and Enterprise SSC specifications provide us a stepping stone to FIPS validation.
  4. Another essential feature you need is Secure Downloads and Diagnostics. This firmware feature protects the drive from software attacks through a digital signature that is built into the firmware. When downloads are needed, the digital signature prevents unauthorized access to the drive, preventing counterfeit firmware from being loaded to the drive.

Ultimately, we are all aware that security threats are not going away any time soon. At Micron, our security task force has been researching data security threats with a laser focus on potential attacks on stored data and on storage devices.  We have engineered our storage solutions to protect your data. And—no surprise—we have SAS SSDs that meet all the enterprise security standards and guidelines I just described. We want to make it easy for you to protect the data on your drives so you can focus on making the rest of your data center secure and ready to face the next round of attacks.

I want to hear from you. Leave a comment below and connect with us on Twitter @MicronStorage and on LinkedIn.

Bruce Franklin

Anne Haggar