Interview with Geoffrey Nesnow

January 2008

Interviewee: Geoffrey Nesnow, Sr. Manager, North America Business Development, Iron Mountain

Subject:   Lost Backup Tapes & Lost or Stolen Laptops

Problem 1: Lost Backup Tapes

Nymity: What are the main causes that lead to a loss of backup tape?

Nesnow:  There are a number of people and processes involved in most off-site media vaulting programs.  Most losses are due to a breakdown in the management of the chain of custody throughout the process. 

The most common cause of a loss is poor communication either inside a company or between the company and their vendor.  Our experience has shown that the vast majority of losses aren’t actually losses – that is they are within the walls of the company or its offsite vendor, but they aren’t where they are expected to be.  These can be painful and mildly expensive when they happen, but aren’t nearly as risky as true losses.  A very common example of this is in a large organization when an end user requests a restore from last night’s backup.  The IT organization will sometimes pull the tape from the loading dock without letting operations or their offsite vendor know about the change in inventory.

There are some very rare cases of media being lost in transport.  Typically, these are due to multiple errors or extenuating circumstances, such as a major vehicle accident.  The level of controls in place to prevent this in our process is substantial.  We’ve studied every loss or near loss and used process, technology and compensating controls to address every possible scenario.  For example, we have installed a customized alarm system on all our vehicles that makes it almost impossible for a door to be open or unlocked when a driver isn’t actively loading or unloading the vehicle.  And, we continue to invest millions of dollars to further reduce the risks every year. 

Nymity: How do organizations typically respond to these issues?

Nesnow:  Thankfully, most organizations are very willing to partner with us to help resolve the issue as quickly and effectively as possible.  The vast majority of incidents don’t actually involve loss of media outside the customer or offsite vendor’s location.  Because of our experience in this area, we are able to help customers focus on the highest probability scenarios first. 

In the extremely rare scenario where the media can’t be located, we’re able to help customers analyze their processes as well as our own to isolate where the processes broke down to prevent the same problems from occurring again.  We also actively encourage our customers to leverage technology, such as media tracking software, online backup and media encryption to further reduce their risks.

Nymity: How has Iron Mountain solved the problem of securely backing up desktops?

Nesnow:  Iron Mountain’s Connected® Backup for PCs provides organizations of all sizes the ability to protect their laptops and desktops securely, efficiently and reliably.  We have addressed the security concerns of this type of solution with a combination of technology, process and infrastructure investments.  For starters, all data is encrypted at the source PC and is transmitted and stored in this encrypted format.  For customers using our managed backup service, their data is sent first to our primary underground data center and then replicated to our second underground data center.  These underground facilities are amongst the most secure commercially available properties available.  They feature armed guards, solid limestone walls on all sides and a small number of tightly controlled entrances in addition to exceptional security of the datacenter facilities contained inside the underground locations. 

Iron Mountain is also one of the only companies that does background checks on all of its employees.  This is an additional level of security that customers of all sizes appreciate. 

Nymity:  What are the other benefits of this approach?

Nesnow:  In addition to providing exceptional security, reliability and cost effectiveness, Connected® for PCs can help reduce the support burden of IT organizations by making desktop and laptop support easier and more efficient.  By providing centralized control of all functions, Connected Backup for PCs is able to reduce the administrative burden on an IT organization in addition to helping them resolve end user issues more quickly with a higher probability of a desirable outcome.

Problem 2: Lost or Stolen Computers

Nymity:  As our subscribers understand the problem of a lost or stolen computer, how can organizations eliminate the loss of personal information contained on these devices?

Nesnow:  Because end-users are not consistent at backing up their own data, the backup tasks need to be done in the background, automatically, in a secure and efficient manner without user action or IT intervention.  By using a solution like Iron Mountain’s Connected® Backup for PC, companies can ensure that their end user PCs are always protected from loss, damage or error.  In many cases, using a solution like Connected can actually dramatically reduce the cost of protecting PC data by leveraging sophisticated de-duplication and compression technologies to reduce the amount of bandwidth and storage required.

However, this only solves half the problem.  The other challenge is to make sure that the data on the lost or stolen PCs is not compromised.

There are a number of products on the market that can help organizations secure the data on portable devices.  The most common type of solution is full disk encryption.  This technology indiscriminately encrypts all files stored on a PC or laptop to reduce the likelihood of this data being inappropriately accessed.  However, it is not without a cost.  There can be substantial performance degradation and encryption can make repairs more difficult – think of a helpdesk technician trying to fix a system issue when he or she can’t open or modify any files. 

Iron Mountain’s approach to this issue is to help customers encrypt only user files, not system files and to provide a mechanism to remotely destroy a compromised laptop or PC on demand or on various triggers, such as failed logins.  Our solution, called DataDefense, is a great complement to our Connected Backup for PC.

Nymity:  How long does it work for laptop computers?

Nesnow:  Connected® Backup for PC gives you the option to pre-set your retention policies. Data will be stored as long as required by the company policies. Whenever a restore is required, end-users can access their backed up data directly over the internet and restore with a few mouse-clicks.

Similar to Connected, DataDefense will work as long as required by the organization. It gives IT control over which actions to take in the event of a laptop or PC loss. As soon as a laptop is marked as stolen, the organization can choose to: Disable the PC, eliminate data on the drive, lock the computer after a certain amount of failed logins, etc.

Nymity: When a laptop is lost or stolen, is the data contained lost?

Nesnow:  No, with Connected® Backup for PC, you will always have access to your data. For customers using our managed service offering, data is stored in an Iron Mountain underground vault, and mirrored to a second datacenter hundreds of miles away.

In the event of a lost or stolen laptop, the user can simply utilize Connected’s self-service Web portal to access all of the data that was on his or her laptop at the time of the previous backup, as well as a number of historic points in time. He or she can then request the backed-up data to be re-sent to a new device.  

In addition to the ability to recover from a complete loss, Connected Backup for PC also helps users easily recover from much more common issues like file loss or damage or viruses.

And DataDefense offers confidence to customers that the data on their lost PC or laptop won’t be compromised, avoiding the costs and embarrassment. 

Nymity: What are common types of deployments of these solutions?

Nesnow:  Our solutions offer the tools required to ensure easy deployment across the enterprise as well as centralized management. Both client configuration and rules can be managed centrally. The Agent software can be installed on the PCs silently by central IT. For Connected® Backup for PC, once the initial full backup is completed, automatic backups complete in minutes, according to the set schedules and configurations.

The Connected solution can be delivered in three ways:

Subscription service: Your data is backed up to Iron Mountain’s off-site locations for a monthly fee based on usage, with no capital investment on the customer’s part.

Licensed software: Large customers may want to license the software and manage it themselves on-site. Iron Mountain professional services will help them install their system and get them started.

Remote Managed Services: With this option, Iron Mountain remotely manages the licensed software at the customer’s location . The customer gets the advantage of running licensed software inside their environment without the overhead of daily management. 

Nymity: In closing, how can our subscribers learn more about these approaches to eliminating the loss of personal information?

Nesnow:  For more information on Iron Mountain products and services, please visit: http://www.ironmountain.com or http://www.ironmountain.com/dataprotection/pc/ for the specific products mentioned above, or contact us at 1-800-899-IRON.