Should your data vaulting solution be encrypted?

by: Robin Remines

Data Vaulting (or sometimes known as remote backup service (RBS) is the process of sending data off-site, where it can be protected from hardware failures, theft, and other threats. Many credit unions are now using data vaulting as an effective way to ensure rapid recovery of critical systems in the event of a crisis. Even though the data is stored offsite, keeping the data safe is still the responsibility of the credit union regardless of the method or strategy used.

So – should your data vaulting solution be encrypted? Short answer – YES. And lets look at why.

  • Well, for starters, it’s required (err, recommended) – To foster adequate data and media handling the data vault provider should:
    • Have proper application configuration
    • Secure data storage and/or processing
    • Adequate access and integrity controls
    • Appropriate encryption
    • Adequate key management for encrypted data; and Sufficient data retention.
  • The FFIEC states that when using a managed service provider the credit union has to ensure they are protecting data in transit to avoid a data breach/leakage.
continue reading »