News
6/30/2010
11:07 AM
George Crump
George Crump
Commentary
50%
50%

Keeping Data Forever vs. Data Retention

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.The alternative to a keep it forever strategy is to have a very specific data retention strategy, something that I used to be a promoter of. The challenge with implementing fixed data retention strategies is that first you have to get various non-IT departments to decide exactly how long their data needs to be retained. Herding cats may be an easier task. Many will say they want their data kept forever anyway. Which then you need to convince them why they shouldn't. Obviously in the keep it forever strategy you are giving them exactly what they want. Giving people what they want is always popular.

Other departments will want their information deleted rather quickly or to follow some obscure guideline. Reality is that different types of data needs to be stored for varying lengths of time and the regulations that dictate those timeframes are often vague and change frequently. The challenge is most people don't store or tag their information by how it should be retained, they either don't have the time, don't know how to tag it or wouldn't know what the retention policy is even if they could tag it. The odds of you properly categorizing all the data in all its forms into the right retention windows are stacked against you. The man hours to properly identify up front and as an ongoing bases all the data which is being created in your enterprise, and then to properly move that data into the right retention buckets at just the right time are going to be staggering.

Finally and probably most condemning to retention policies is the fact that digital assets are too portable. As a result even if you build the perfect data retention strategy, are able to maintain it and verify that data is deleted at just the right time, employees have a tendency to look after themselves first, not the organization. It is difficult to stop an employee that finds some condemning data that may hurt the organization but helps or protects them. They can for example email the data to a personal email address or copy it to a USB stick. You have to assume if the data was going to hurt the organization it is going to get out somehow. It seems like it always does. The organization's best bet, other than never doing anything wrong, is to at least know about potential threats and be prepared to defend itself. If the data is deleted as part of a retention policy, that is hard to do.

In our next entry we will wrap up this series with looking at the costs associated with a keep data forever strategy and how to keep those costs under control. The strategy needs to be accomplished while meeting the typical cost challenges beyond hard costs; power, cooling and space.

Track us on Twitter: http://twitter.com/storageswiss

Subscribe to our RSS feed.

George Crump is lead analyst of Storage Switzerland, an IT analyst firm focused on the storage and virtualization segments. Find Storage Switzerland's disclosure statement here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-2086
Published: 2015-02-26
Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.

CVE-2015-2087
Published: 2015-02-26
Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors.

CVE-2015-2088
Published: 2015-02-26
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

CVE-2015-2089
Published: 2015-02-26
Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (...

CVE-2015-2090
Published: 2015-02-26
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.