11:07 AM
George Crump
George Crump

Keeping Data Forever vs. Data Retention

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.

Keeping data forever vs. data retention is going to become an increasingly fierce battle. In the past data retention strategies always won but as we discussed in our first entry in the series the technology is now available to store data forever and as we discussed in the second entry the technology is there to find it when you need it.The alternative to a keep it forever strategy is to have a very specific data retention strategy, something that I used to be a promoter of. The challenge with implementing fixed data retention strategies is that first you have to get various non-IT departments to decide exactly how long their data needs to be retained. Herding cats may be an easier task. Many will say they want their data kept forever anyway. Which then you need to convince them why they shouldn't. Obviously in the keep it forever strategy you are giving them exactly what they want. Giving people what they want is always popular.

Other departments will want their information deleted rather quickly or to follow some obscure guideline. Reality is that different types of data needs to be stored for varying lengths of time and the regulations that dictate those timeframes are often vague and change frequently. The challenge is most people don't store or tag their information by how it should be retained, they either don't have the time, don't know how to tag it or wouldn't know what the retention policy is even if they could tag it. The odds of you properly categorizing all the data in all its forms into the right retention windows are stacked against you. The man hours to properly identify up front and as an ongoing bases all the data which is being created in your enterprise, and then to properly move that data into the right retention buckets at just the right time are going to be staggering.

Finally and probably most condemning to retention policies is the fact that digital assets are too portable. As a result even if you build the perfect data retention strategy, are able to maintain it and verify that data is deleted at just the right time, employees have a tendency to look after themselves first, not the organization. It is difficult to stop an employee that finds some condemning data that may hurt the organization but helps or protects them. They can for example email the data to a personal email address or copy it to a USB stick. You have to assume if the data was going to hurt the organization it is going to get out somehow. It seems like it always does. The organization's best bet, other than never doing anything wrong, is to at least know about potential threats and be prepared to defend itself. If the data is deleted as part of a retention policy, that is hard to do.

In our next entry we will wrap up this series with looking at the costs associated with a keep data forever strategy and how to keep those costs under control. The strategy needs to be accomplished while meeting the typical cost challenges beyond hard costs; power, cooling and space.

Track us on Twitter:

Subscribe to our RSS feed.

George Crump is lead analyst of Storage Switzerland, an IT analyst firm focused on the storage and virtualization segments. Find Storage Switzerland's disclosure statement here.

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.