News
6/30/2010
11:07 AM
George Crump
George Crump
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Keeping Data Forever vs. Data Retention

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.The alternative to a keep it forever strategy is to have a very specific data retention strategy, something that I used to be a promoter of. The challenge with implementing fixed data retention strategies is that first you have to get various non-IT departments to decide exactly how long their data needs to be retained. Herding cats may be an easier task. Many will say they want their data kept forever anyway. Which then you need to convince them why they shouldn't. Obviously in the keep it forever strategy you are giving them exactly what they want. Giving people what they want is always popular.

Other departments will want their information deleted rather quickly or to follow some obscure guideline. Reality is that different types of data needs to be stored for varying lengths of time and the regulations that dictate those timeframes are often vague and change frequently. The challenge is most people don't store or tag their information by how it should be retained, they either don't have the time, don't know how to tag it or wouldn't know what the retention policy is even if they could tag it. The odds of you properly categorizing all the data in all its forms into the right retention windows are stacked against you. The man hours to properly identify up front and as an ongoing bases all the data which is being created in your enterprise, and then to properly move that data into the right retention buckets at just the right time are going to be staggering.

Finally and probably most condemning to retention policies is the fact that digital assets are too portable. As a result even if you build the perfect data retention strategy, are able to maintain it and verify that data is deleted at just the right time, employees have a tendency to look after themselves first, not the organization. It is difficult to stop an employee that finds some condemning data that may hurt the organization but helps or protects them. They can for example email the data to a personal email address or copy it to a USB stick. You have to assume if the data was going to hurt the organization it is going to get out somehow. It seems like it always does. The organization's best bet, other than never doing anything wrong, is to at least know about potential threats and be prepared to defend itself. If the data is deleted as part of a retention policy, that is hard to do.

In our next entry we will wrap up this series with looking at the costs associated with a keep data forever strategy and how to keep those costs under control. The strategy needs to be accomplished while meeting the typical cost challenges beyond hard costs; power, cooling and space.

Track us on Twitter: http://twitter.com/storageswiss

Subscribe to our RSS feed.

George Crump is lead analyst of Storage Switzerland, an IT analyst firm focused on the storage and virtualization segments. Find Storage Switzerland's disclosure statement here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio