Data at rest

Data at rest in information technology means inactive data that is stored physically in any digital form (e.g. databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices etc.).

Figure 1: The 3 states of data.

Data at rest is used as a complement to the terms data in use and data in transit which together define the three states of digital data (see Figure 1).[1]

Alternative definition

There is some disagreement as to the boundary between data at rest and data in use. Data at rest generally refers to data stored in persistent storage (disk, tape) while data in use generally refers to data being processed by a computer central processing unit (CPU) or in random access memory (RAM, also referred to as main memory or simply memory). Definitions include:

"...all data in computer storage while excluding data that is traversing a network or temporarily residing in computer memory to be read or updated."[2]
Figure 2: Data at Rest vs Data in Use.
"...all data in storage but excludes any data that frequently traverses the network or that which resides in temporary memory. Data at rest includes but is not limited to archived data, data which is not accessed or changed frequently, files stored on hard drives, USB thumb drives, files stored on backup tape and disks, and also files stored off-site or on a storage area network (SAN)."[3]

Data in use has also been taken to mean “active data” in the context of being in a database or being manipulated by an application. For example, some enterprise encryption gateway solutions for the cloud claim to encrypt data at rest, data in transit and data in use.[4]

While it is generally accepted that archive data (i.e. which never changes), regardless of its storage medium, is data at rest and active data subject to constant or frequent change is data in use, “inactive data” could be taken to mean data which may change, but infrequently. The imprecise nature of terms such as “constant” and “frequent” means that some stored data cannot be comprehensively defined as either data at rest or in use. These definitions could be taken to assume that Data at Rest is a superset of data in use; however, data in use, subject to frequent change, has distinct processing requirements from data at rest, whether completely static or subject to occasional change.

The division of data at rest into the sub-categories "static" and "inconstant" addresses this distinction (see Figure 2)..

Concerns about data at rest

Because of its nature data at rest is of increasing concern to businesses, government agencies and other institutions.[2] Mobile devices are often subject to specific security protocols to protect data at rest from unauthorised access when lost or stolen[5] and there is an increasing recognition that database management systems and file servers should also be considered as at risk;[6] the longer data is left unused in storage, the more likely it might be retrieved by unauthorized individuals outside the network.

Encryption

Data encryption, which prevents data visibility in the event of its unauthorized access or theft, is commonly used to protect data in motion and increasingly promoted for protecting data at rest.[7]

The encryption of data at rest should only include strong encryption methods such as AES or RSA. Encrypted data should remain encrypted when access controls such as usernames and password fail. Increasing encryption on multiple levels is recommended. Cryptography can be implemented on the database housing the data and on the physical storage where the databases are stored. Data encryption keys should be updated on a regular basis. Encryption keys should be stored separately from the data. Periodic auditing of sensitive data should be part of policy and should occur on scheduled occurrences. Finally, only store the minimum possible amount of sensitive data.[8]

Federation

A further method of preventing unwanted access to data at rest is the use of data federation[9] especially when data is distributed globally (e.g. in off-shore archives). An example of this would be a European organisation which stores its archived data off-site in the USA. Under the terms of the USA PATRIOT Act[10] the American authorities can demand access to all data physically stored within its boundaries, even if it includes personal information on European citizens with no connections to the USA. Data encryption alone cannot be used to prevent this as the authorities have the right to demand decrypted information. A data federation policy which retained personal citizen information with no foreign connections within its country of origin (separate from information which is either not personal or is relevant to off-shore authorities) is one option to address this concern.

References

  1. ↑ "Data Loss Prevention | Norton Internet Security". Nortoninternetsecurity.cc. 2011-03-12. Retrieved 2012-12-26.
  2. 1 2 "What is data at rest? - Definition from WhatIs.com". Searchstorage.techtarget.com. 2012-12-22. Retrieved 2012-12-26.
  3. ↑ "What is data at rest? - A Word Definition From the Webopedia Computer Dictionary". Webopedia.com. Retrieved 2012-12-26.
  4. ↑ "CipherCloud Brings Encryption to Microsoft Office 365". Retrieved 2013-11-01.
  5. ↑ http://www.gordon.army.mil/nec/documents/BBP%20Data%20at%20Rest.pdf
  6. ↑ "IT Research, Magic Quadrants, Hype Cycles". Gartner. Retrieved 2012-12-26.
  7. ↑ Inmon, Bill. "Encryption at Rest - Information Management Magazine Article". Information-management.com. Retrieved 2012-12-26.
  8. ↑ "Cryptographic Storage Cheat Sheet". OWASP. Retrieved 2012-12-26.
  9. ↑ "Information service patterns, Part 1: Data federation pattern". Ibm.com. Retrieved 2012-12-26.
  10. ↑ "USA Patriot Act". Fincen.gov. 2002-01-01. Retrieved 2012-12-26.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.