Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

Built-in Headaches

PC hardware vendors are building security capabilities into their systems, but those features may present compatibility problems for IT

The good news is your end users will soon have a bunch of new security capabilities at their disposal. The bad news is those capabilities won't necessarily be compatible with your current security strategy.

Over the last few weeks, PC hardware vendors have been rolling out security technology like beer at Oktoberfest. Hitachi Global Storage Technologies today announced that it will offer optional hardware encryption on all of its new 2.5-inch disk drives, which are expected to ship at a rate of a million units per quarter in early 2007. The AES feature can be turned on or off at the buyer's request.

Hitachi's news followed Monday's announcement of new drives from Seagate Technology, which will not only offer hard drive encryption but also multi-factor authentication options that would make it impossible for unauthorized users to access any data on the hard drive. (See Seagate Unveils Encrypted Notebook Drive.)

And just two weeks ago, PC maker Lenovo began offering PCs with a built-in biometric device that lets users authenticate themselves to the hard drive via a fingerprint. (See Lenovo Uses Utimaco.)

"2007 will be the year for security on client devices," says Rob Enderle, principal analyst at the Enderle Group, an IT consultancy. "In the business space, performance isn’t the driver anymore, and security increasingly is. This will define the way many of the vendors compete next year."

On the surface, such advancements would seem to be a boon for businesses, which have been troubled with security breaches caused by lost laptops and other exploits that give attackers access to a single PC. In the coming year, the damage done by PC theft could be significantly reduced by built-in features that prevent thieves from accessing sensitive information on the devices they steal, experts say.

But for IT managers, the new capabilities could create administrative nightmares. Many IT departments are already deploying encryption software that performs many of the same functions now being built into disk drives, and most already have authentication technologies and processes that may not work with the technologies now rolling out from vendors like Seagate.

"Built-in security items will cause IT department headaches," says Richard Stiennon, founder of IT-Harvest, an IT consulting firm. "The enterprise would have to standardize on the new Seagate drives or be looking for hard drive encryption help for particular projects."

As a result, many IT organizations will probably forbid the use of the new security technologies, Stiennon says. But as users bring their own machines into the network, the compatibility problems could happen anyway.

Hitachi, Lenovo, and Seagate emphasized that their new security capabilities are optional, and can be turned off in cases where an enterprise has an alternative technology already in place.

— Tim Wilson, Site Editor, Dark Reading

  • Hitachi Global Storage Technologies (Hitachi GST)
  • Lenovo Group Ltd.
  • Seagate Technology Inc. (NYSE: STX)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Stop Defending Everything
    Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
    Small Business Security: 5 Tips on How and Where to Start
    Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
    Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
    Jai Vijayan, Contributing Writer,  2/13/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    6 Emerging Cyber Threats That Enterprises Face in 2020
    This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
    Flash Poll
    How Enterprises Are Developing and Maintaining Secure Applications
    How Enterprises Are Developing and Maintaining Secure Applications
    The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-5531
    PUBLISHED: 2020-02-17
    Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1, CH2): First 5 digits of serial number 21121 or before), MELSEC iQ-R Series C Controller Module / C Intelligent Function Module(R12CCPU-V Ethe...
    CVE-2020-7252
    PUBLISHED: 2020-02-17
    Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.
    CVE-2020-9024
    PUBLISHED: 2020-02-17
    Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
    CVE-2020-9025
    PUBLISHED: 2020-02-17
    Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
    CVE-2020-9026
    PUBLISHED: 2020-02-17
    ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.