Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• 12 tech leaders’ resolutions for 2012
• NewNet Q4: Platform mania and social commerce shakeout

CipherCloud CEO Pravin Kothari

The company’s cloud gateway encrypts customer data in real time before it’s sent to the cloud, company founder and CEO Praveen Kothari told me.  Its software appliance encrypts corporate data — using AES encryption – in Salesforce.com, Gmail,, Microsoft Office 365 and other applications — on premises before it hits the cloud. The encryption key stays with the customer, so not even the cloud provider can see the data even if it wanted to, he said.

The San Jose, Calif. company just netted $30 million in new funding from Andreessen Horowitz, Index Ventures and T-Systems, the venture arm of Deutsch Telekom. Those companies also participated in an earlier $1.4 million seed round.

The company has good enterprise security DNA: Kothari, was co-founder and SVP of engineering for ArcSight,the data security company HP acquired years ago for  $1.5 billion.

The new funding will be used to staff up: the company expects to double its current 130-person staff next year. A key priority will be to expand sales and marketing and its global presence. CipherCloud claims 49 major, but undisclosed, name-brand companies as users, including two of the largest 5 banks in the US.

Cloud security is a key problem to attack. Large corporations still cite security as a key hurdle to broader cloud adoption. If they can be assured that their data remains under lock-and-key even if it’s outside their data center, they can meet key compliance and regulatory hurdles.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A near-term outlook for big data
• The Case for Increased M&A in 2011: Actions and Outlooks
• Cloud and data first-quarter 2013: analysis and outlook

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Cloud computing infrastructure: 2012 and beyond
• Infrastructure Q2: Big data and PaaS gain more momentum
• Infrastructure Q1: IaaS Comes Down to Earth; Big Data Takes Flight

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A near-term outlook for big data
• Connected world: the consumer technology revolution
• 12 tech leaders’ resolutions for 2012

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A near-term outlook for big data
• Defining Hadoop: the Players, Technologies and Challenges of 2011
• Infrastructure Q2: Big data and PaaS gain more momentum

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why service providers matter for the future of big data
• Infrastructure Q2: Big data and PaaS gain more momentum
• 2012: The Hadoop infrastructure market booms

There are two ways to think about securing information: Enabling access to information that you want to keep, and disabling access to information you no longer want to keep.  In this post, we will focus on the information Mac users no longer want to keep.  If you are thinking that this is as easy as moving a file to the trash, then emptying the trash, think again.  There are numerous data recovery utilities on the market that can recover lost or deleted files.  And these utilities work because most of us do not know how to securely erase information off of our Macs.  The following are some tips on how you can at least make if very difficult for others to recover your unwanted files.

Finder’s Secure Empty Trash

When you just empty the trash on a Mac, OS X no longer keeps track of where the data associated with the file is stored on the hard drive.  The data is still there, it’s just that the Finder can no longer find it.  As you continue to work and OS X saves new files on your hard drive, OS X could write over parts of your deleted files data with the new files data.  What many data recovery utilities take advantage of is the chance that old data is still there, and has not yet been written over by new data.  When you instead elect to use Secure Empty Trash, OS X does in fact ensure that the old data is written over with new data, which will ensure that the old data is no longer there — think of it like scribbling out a written message on a post-it note.  What is not known for sure is how many times Secure Empty Trash writes over the old file’s data.

The U.S. Department of Defense data erasure guidelines require that erased data be written over no less than seven times.  Why seven times?  It just so happens that because of the way hard drives work, there is an opportunity for parts of the data to remain on the physical disk.  There is a mechanical arm that reaches out across the hard drive to read and write data off of a magnetic platter.  That mechanical arm may not pass over exactly the same spot on the hard drive with each pass.  If you remove the platter from the drive, you can actually scan the surface of the drive using a much more precise mechanical arm to read old data off of the drive.  Writing over the data seven times compensates for this opportunity.  Think of it like plowing a field: The more times you plow over the earth, the less likely you are to see last season’s crop lines.

Permanent Erasure Utility

There are utilities that you can use that take this even further.  Available in the Mac App Store is a free utility from Edenwaith called Permanent Eraser.  Tools like Permanent Erasure give the user greater control over how the old data is written over with new data when you empty the trash.  For instance, Peter Gutmann, a computer scientist in the Department of Computer Science at the University of Auckland, had devised a method of overwriting data 35 times, each pass utilizing a different pattern of ones and zeroes.  Permanent Erasure is configurable to take advantage of Gutmann’s research and can apply his technique of writing over old data when the trash is emptied.  In fact, Permanent Erasure goes even further by also scrambling the original file name and truncating the file size to nothing before finally unlinking it from the system.

Gutmann’s technique is quite dated, as it was originally applied to a variety of consumer grade hard drives available back in the late 1990s.  While widely considered the most secure means of erasing data off of an old hard drive that you still intend to use, some have speculated that this technique is no longer entirely necessary on modern-day, high-density and large-volume SATA drives.  Some security forums online have speculated that a single pass of random ones and zeroes is sufficient on modern equipment.  Even though there are tools that make utilizing even the most secure of techniques easy, you do wear down the drive and decrease its lifespan by overemploying this technique on a daily basis.  It is probably best to utilize the Finder’s Secure Erase on a daily basis, and use tools like Permanent Erasure when you have recently deleted something important that you want to make absolutely sure no one will be able to access again.

Time Machine Backups

Lets not forget about Time Machine and other backup solutions you may have implemented.  Going to extremes to erase a file from a hard drive that you routinely back up could be seen as a fool’s errand if you neglect to erase all of the backup copies as well.  But there is a way to delete all backed up versions of a file from within Time Machine.  Before you delete the file you want to remove permanently, open Time Machine and click on the gears to expose a menu.  From the menu select “Delete all backups of this file.” This will remove all references in Time Machine showing that the file ever existed.

This feature of Time Machine will not implement the same technique as Secure Empty Trash or any more advanced utilities like Permanent Erasure by writing over the data on the drive that the original file occupied.  It just so happens that a halfway decent automated backup strategy could end up being the Achilles’ heel of a halfway decent security strategy.  Once you backup your files online for instance, you may not have any way to delete individual files from all of the redundant backups that your cloud-based service provider has elected to employ.  The data is still out there, somewhere.

Disk Utility’s Secure Erase Options

Looking at this problem from an individual file perspective is good if you intend to keep using all of the old hard drives you have ever owned.  But what if you want to sell or give away your old equipment to somebody else?  At such a time it is a good idea to securely erase an entire drive’s data.  Fortunately Mac OS X’s Drive Utility has you covered.  Just open Disk Utility and select the drive you want to erase.  Choose the selector labeled “Erase” and click on the “Security Options” button.  Here you will find a range of options from “Fastest” to “Most Secure.”

Unfortunately, Disk Utility stops short at just a seven pass overwrite and does not employ any other technique of securely erasing an entire drive.  And since OS X 10. 7 Lion, you no longer have the option to boot from DVD in order to gain access to Disk Utility in order to wipe the internal hard drive of your Mac clean.

One of the most widely used and highly recommended tools to use in cases like this, Darik’s Boot And Nuke (DBAN), can be accessed from a bootable CD/DVD on your Mac.  You can also create a customized USB drive that will boot to Ubuntu where you can install and use the terminal command “wipe“ (there is also a GUI interface for “wipe called Parted Magic).  Your best bet is to stick with something like Micromat’s TechTool Pro Wipe Disk feature, which will also boot from DVD or USB.  Any one of these three tools will wipe the internal drive of your Mac completely clean.

Hardware-Based Accessories

You can always try booting your MacBook in target disk mode in order connect to the hard drive externally and securely wipe the internal hard drive.  However, wiping a drive clean may be difficult if the Mac that the drive is in no longer boots up.  There are two hardware accessories for sale at MacSales by NewerTech that can come in handy once you have decided to remove the hard drive from your old Mac.  If you only need to do this on a rare occasion, consider the SuperSpeed USB 3.0 Universal Drive Adapter.  It supports both IDE and SATA formats for 5.25-inch, 3.5-inch and 2.5-inch drives.  If you are looking for a more permanent SATA solution, one that you can connect to via eSATA, then get the NewerTech Voyager hard drive dock.

If you happen to do this a lot, or if you are the go-to person when it comes to IT issues, you may consider investing in a hardware-based wipe solution to securely erase all of the hard drives you have to work with.  WiebeTech’s Drive eRaser Ultra will wipe your IDE and SATA drives clean and won’t lock up your Mac in the process as it is a standalone wipe accessory.

Physical Destruction

There are ways to render a hard drive completely useless to others through the means of bashing, grinding, shredding, incinerating and even exposing the raw elements of the drive to a phase transition by vaporizing all of its components.  Rather than try to handle this yourself by purchasing your own Model 22 HDD Hard Drive Disintegrator, there are services that will take care of this for you.

But even professional disintegration services recommend that you first perform your own due diligence by securely wiping off any private information before submitting the equipment to them for disposal.  One thing to look for when shopping around for such a service is to see if they are NAID Certified, if they offer an audit trail of the destruction process and will issue some sort of certificate of destruction.

Solid State Drives

This is all well and good provided you only have a traditional IDE or SATA hard drive that uses mechanical arms to read and write data off of rotating platters.  But what if you have a solid state drive (SSD), what then?  SSDs utilize a completely different technology that renders many of the above techniques ineffective.  The Non-Volatile Systems Laboratory of the University of California San Diego’s Computer Science and Engineering department has commenced a study to look at the effectiveness of various sanitizing techniques on SSDs. What researchers found was that a new approach to securely wiping a drive is needed.

The SSD’s wear-leveling technology, while designed to prolong the lifespan of the drive, makes it almost impossible to guarantee that a given file has been overwritten.  The implementation of many SSDs’ buffering technology, which was designed to help compensate for memory failures, also challenges many of the established erasure techniques.  The only recourse then is to always use full disk encryption on SSDs.  SSDs store the encryption keys in a Key Storage Area (KSA).  This KSA can be cleared to make the data that remains on the drive practically impossible to recover.  Some newer SSDs provide an “erase unit” command, but this has not been implemented uniformly across all drives and is not exposed in popular drive utility tools currently available to consumers.

When thinking about both your security as well as your backup strategy, think also of the reverse side of the equation — not just how can you continue to securely access your most private information, but also how can you prevent access to your private information by wiping it clean off of any device it has been stored on when you no longer want that device.  Paying attention to someone can access your files stored on old discarded computer equipment is key to any good security strategy.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• The rise of M2M security challenges
• Who and what to watch in the new era of the living room
• New challenges for the IT organization

1. Set up Time Machine

If you aren’t using Time Machine, it’s time to start. This is your first, best line of defense on a desktop or laptop. Backups made using the built-in OS X feature are non-intrusive, and recovery of files is nearly instant. Although external hard drive prices are high right now, most everyone will benefit with Time Machine. Hook up an external hard drive and OS X will ask you to use it for Time Machine. I generally recommend getting a hard drive 1.5 times the size of your internal drive.

2. Set up online backup the proper way

I suggest online backup services as your second line of defense. It’s important to keep backups offsite in case of a disaster or theft at your location. If you do your initial backup all at once it can take months and you’ll find you are missing a key file just when you need it — I wrote about how to optimize your strategy here – and be sure to leave your computer on and awake if you want your backup strategy to work. Also, please remember that sync software like Dropbox isn’t a true online backup system, since it has the ability to remove files.

3. Back up your online email system

If you use online email systems such as Gmail, you need to back that up as well. Don’t rely 100% on your provider. Your account could get hacked, or you could accidentally delete your email. Follow this guide on backing up your Gmail using POP access. A similar strategy would be applicable to Hotmail, AOL and Yahoo (though Yahoo may require a paid upgrade to do it).

4. Test your backups

I’ve written about this before, but if you aren’t testing your backups, how do you know if they’re working? Do you know how to restore in case of disaster? Trust but verify as they say. Simply try restoring files from your backups to make sure they work as expected.

5. Back up your iOS devices

With iCloud, backing up to your computer isn’t technically necessary because you can restore from the cloud. On a practical level though, that takes time, and there’s also no guarantee your backup will always be there when you need it. At least every month, it’s important to hook up your iOS device to your computer for a quick and immediate backup of your data. To do a manual backup via iTunes, follow these instructions.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Survey: How apps can solve photo management
• Do Consumers Care Where Their Content Is Stored?
• Cloud and data first-quarter 2013: analysis and outlook

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Takeaways from mobile’s second quarter
• CES 2012: a recap and analysis
• The future of mobile: a segment analysis by GigaOM Pro

• Web workers are more vulnerable to “social engineering” attacks. In an office, “you can pretend that you’re a bike courier or FedEx guy, but you still have to get past the security guard, receptionist, and so on,” explains Steven Chan, chief software architect with MIT’s engineering systems division.
• Office network security usually beats home network security.
• Loss or theft of devices is a bigger threat for mobile workers.
• Greater employee control over which devices they use can for work can create security concerns.

Still, the payoffs of web work are high and there are sensible steps organizations can take to minimize these risks. The experts at MIT also offer these recommendations:

• Limit the threat from lost or stolen devices through encryption and tracking. “For thorough security, the entire hard drive should be encrypted and should be accessible only through strong passwords—Microsoft recommends passwords of at least 14 characters, some of which are letters, numbers, and symbols. Furthermore, tracking software can be used to locate a lost laptop, phone, or tablet and remotely wipe it clean of data,” says MIT.
• Decide who needs access to what. Review often. MIT’s Chan suggests “credentialing, which means employees should get access only to the information they require for their work.” And don’t just set these permissions and forget about them. “Security isn’t something companies dust off and adjust once a year,” agrees CTO Edge in another recent piece on telecommuting and security.
• Servers should be vigilant too. “Have servers in a network identify and authenticate all devices attempting to gain access,” suggests MIT. “In a step known as device fingerprinting, the network can try to distinguish a legitimate remote employee from a rogue hacker by looking at the IP address, device serial numbers, and other settings on the user’s computer. If an unfamiliar device attempts to access the network… either entry is denied or the request is evaluated after further authentication (by a phone call to the user, for instance).”

While there are some risks, working remotely can also offer security advantages, according to some experts. For instance, locating files in the cloud, which is increasingly common practices for dispersed teams, means that “there are no files on a physical laptop which could get lost or hacked into,” InfoStreet CEO Siamak Farah has previously told WebWorkerDaily.

Is your team taking all sensible measures to keep your data secure despite being physically dispersed?

Photo courtesy Flickr user Trevor Blake

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• The Future of Work Platforms: An Overview
• Social networks will displace business processes, not socialize them
• Millennials in the enterprise, part 1: strategies for supporting the new digital workforce