Self-Encrypting Hard Drives in the Enterprise

“Self-encrypting” hard drives are a hot topic among security professionals – these hard drives have their own on-board technology to encrypt data written to the drive. Seagate’s Momentus FDE drives made headlines in 2008, and hard drives from manufacturers like Fujitsu and Hitachi are slated for release in 2009 that will support the ‘Opal’ specification of the Trusted Computing Group’s Storage Working Group. These drives offer some compelling value, but there is a significant factor that limits their usability:

Self-encrypting drives aren’t enterprise-ready
Authentication capability along with policy management and centralized control & recovery of keys/passwords are required for self-encrypting drives to be useful in an enterprise. Without authentication, encryption does not protect data. Without central management, the total cost of ownership for the encryption can rapidly increase. There is also the hardware cost factor – self-encrypting drives require you to replace the hardware… which can be a costly across thousands of laptops (and what about the hardware you can’t or don’t replace?)

Get the best of both worlds
SecureDoc supports a heterogeneous environment, allowing you to deploy a mix of encryption formats. You can leverage self-encrypting hard drives on some machines while using SecureDoc’s software encryption to protect ‘legacy’ and other machines until hardware refresh is completed.

SecureDoc also adds the much-needed authentication and enterprise manageability to self-encrypting hard drives. This includes policy & user control, password recovery/helpdesk capability and additional functionality like multi-factor authentication, port control, removable media encryption, file/folder encryption and sophisticated key management. These enhancements extend the value of the self-encrypting drive and make it viable for enterprise use.

SecureDoc makes it possible to derive immediate benefits from hardware encryption while ensuring compliance with legislation and regulation by also protecting legacy machines – all managed within the same solution.