News
6/30/2010
11:07 AM
George Crump
George Crump
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Keeping Data Forever vs. Data Retention

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.The alternative to a keep it forever strategy is to have a very specific data retention strategy, something that I used to be a promoter of. The challenge with implementing fixed data retention strategies is that first you have to get various non-IT departments to decide exactly how long their data needs to be retained. Herding cats may be an easier task. Many will say they want their data kept forever anyway. Which then you need to convince them why they shouldn't. Obviously in the keep it forever strategy you are giving them exactly what they want. Giving people what they want is always popular.

Other departments will want their information deleted rather quickly or to follow some obscure guideline. Reality is that different types of data needs to be stored for varying lengths of time and the regulations that dictate those timeframes are often vague and change frequently. The challenge is most people don't store or tag their information by how it should be retained, they either don't have the time, don't know how to tag it or wouldn't know what the retention policy is even if they could tag it. The odds of you properly categorizing all the data in all its forms into the right retention windows are stacked against you. The man hours to properly identify up front and as an ongoing bases all the data which is being created in your enterprise, and then to properly move that data into the right retention buckets at just the right time are going to be staggering.

Finally and probably most condemning to retention policies is the fact that digital assets are too portable. As a result even if you build the perfect data retention strategy, are able to maintain it and verify that data is deleted at just the right time, employees have a tendency to look after themselves first, not the organization. It is difficult to stop an employee that finds some condemning data that may hurt the organization but helps or protects them. They can for example email the data to a personal email address or copy it to a USB stick. You have to assume if the data was going to hurt the organization it is going to get out somehow. It seems like it always does. The organization's best bet, other than never doing anything wrong, is to at least know about potential threats and be prepared to defend itself. If the data is deleted as part of a retention policy, that is hard to do.

In our next entry we will wrap up this series with looking at the costs associated with a keep data forever strategy and how to keep those costs under control. The strategy needs to be accomplished while meeting the typical cost challenges beyond hard costs; power, cooling and space.

Track us on Twitter: http://twitter.com/storageswiss

Subscribe to our RSS feed.

George Crump is lead analyst of Storage Switzerland, an IT analyst firm focused on the storage and virtualization segments. Find Storage Switzerland's disclosure statement here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio