The US state of Iowa has recently passed a data breach law that requires companies to give its customers notice should its information be compromised.

 

With a concern that if data is lost or stolen there is now a requirement that it is encrypted to protect customer details.

 

However according to Jerome Wendt, president and lead analyst at DCIG Inc, some US states do not consider encryption alone to provide sufficient security of the data being uncoverable, as Pennsylvania has added a stipulation that companies need to have proper encryption key management policies in place. This will guarantee that encrypted data on tape cannot be decrypted, should someone manage to get their hands on both the tape and the key used to encrypt it.

 

Wendt claimed that laws like this open up a loophole as to what constitutes proper encryption key management policy, as it is no secret that encrypting data stored to tape can be done at a number of points in the backup process.

 

He claimed that it is unclear whether providing a one word password to the software to encrypt the data is a proper key management policy but as encryption is becoming a part of the corporate landscape companies should check with appropriate laws to determine what level of security they should adhere to.