Western Digital Safeguarding Your Data with Hitachi Bulk Data Encryption Internal Solid State Drive English (US) White Paper

Safeguarding Your Data with Hitachi Bulk Data Encryption

Larry Swezey, Director, Mobile HDD Product Strategy and Marketing Jim Wong, Software and Security Product Planning Richard New, Research Manager

The growth in use of notebook computers as business The HDD itself may also have a password, whose behavior

machines has lead to an increase in the number of is defi ned by the ATA security feature set. If enabled, the professionals carrying private customer data during their drive cannot be used without this password. In most travels. It comes as no surprise that personal computers, this represents the strongest security this trend leads naturally to an increase method available. A search of the Internet, including in laptop theft. Pound for pound, a some forums where people routinely discuss how to laptop computer is one of the best defeat security schemes, reveals information that HDD passwords are very tough to crack. However, there are

targets for thieves—easy to carry, easy

two potential weaknesses. First, a skilled technician could

to sell. And, if the thief is lucky, access

develop a custom tool to swap the electronics cards on

to private data that can be used for

the fl y from two HDDs—one password protected, the other

identity theft. Desktop PCs are being targeted for thefts

not—after startup in order to potentially defeat the pass-

from locked offi ces and homes as well.

word. Second, a person determined to read the contents

Personal computers currently have four levels of security

of the hard drive could pay a data recovery service to

that can be utilized to protect content. These are listed

physically dismantle the hard drive and then attempt to

below in order of what many consider “easiest to crack”

directly read all of the data from the disks using commer-

to “hardest to crack.” cially available tools. 1) Operating system-based system password These examples of circumventing security are a bit

extreme. It is reasonable to assume that most computer

2) BIOS password

thefts occur with resale of the system as the primary

3) Hard disk drive (HDD) ATA password

motivation. However, systems providers who support major 4) Data encryption through either HDD hardware fi nancial institutions, for example, cannot afford to take or system software this level of risk. If a thief knew that there was a strong likelihood of gaining access to thousands of credit card

The OS-based password works when the system is up

numbers and social security

and running to prevent people from using the computer.

numbers by paying someone

It is effective for an offi ce environment where a user would

to recover data from a stolen

like to prevent others from using—and potentially chang-

HDD, then the return in selling

ing—his computer without permission, or gaining access

that information could be

to confi dential and personal data. However, in the case

enough motivation for the thief

where a computer has been stolen, it is easy for someone

to take that step. Furthermore,

to gain access to all the content on the system by simply

security and identity theft

removing the HDD from the system and inserting it into

issues have been the subject

another machine or booting from a Linux CD.

of legislation, thus showing a recognition of the importance The BIOS password is set in the system BIOS, resident on of protecting sensitive and important data. In the US for the personal computer’s motherboard. It is more effective example, California enacted The Information Practices Act than the OS-based password because a user has to enter that relates to the security and confi dentiality of personal information, see California Civil Code § 1798 et seq. With

the password to even start up the system. However, there

specifi c laws addressing data security, companies are likely

appear to be utilities on the Internet that claim to permit a

to evaluate their security measures for protecting data.

user to overcome a BIOS password. Furthermore, as in the previous case, if a thief removes the hard drive and plugs it A useful and strong solution for providing data security into another system without a BIOS password, the thief can is encryption of the data on the disk , either by use of

easily gain access to the sensitive contents of the drive. software or hardware. In other words, if the data on

www.hitachi GST.com WHITE PAPER