New box destroys data to foil hackers, thieves

Oracle reseller Attain IT and distributor Randtronics have partnered to offer the Australian market a US-made data privacy appliance that scrambles data when an attack is detected.

Robin Habgood, director at Attain IT, said a box made by Ingrian Networks would help companies comply with pending data privacy legislation. Dubbed the DataSecure Appliance, the device could detect someone trying to remove or alter data on its hard drive database.

Data passing through the appliance was encrypted and required an Ingrian Networks "key" to de-crypt it. However, if an intrusion was detected, the box scrambled the stored data, making the information inaccessible.

"It destroys the data on the hard drives if you tamper with it," Habgood said. "And the reality is this [kind of protection] is going to be legislated. Laws have already been passed in the US and Europe, but we're just a little bit behind."

Organisations -- particularly in sectors using large amounts of "sensitive" information, such as health, finance and government -- were going to be forced to take stronger measures to protect data passing through their IT infrastructure. Furthermore, directors of companies would be held personally accountable for what happened to such data, Habgood said.

"Not only does it secure the data but it actually secures itself, by being tamperproof," he said. "You can't even pry the hard drives out and take them somewhere else."

The device did not focus on perimeter defences, but enabled a company to protect its data from the inside. One of the best ways to gain access to sensitive information was to become an employee of the organisation that held that information, he pointed out.

"There are software solutions that involve fairly significant changes to your database. A hardware solution such as this cuts down the implementation time quite dramatically," Habgood added. "This works with APIs and pretty much any application and runs off most databases."

Attain IT had been seeking products complementing Oracle's database portfolio for some years, he said.

"We see this product as aimed at the senior management and CIOs of an organisation, that are not just involved in data or running your IT. It's about to some extent protecting data and management from the IT department," Habgood said.

Bob Adhar, CEO at distributor Randtronics, said the box complied with a certification called FIPS 140-2 Level 3. "That is a standard that says you have to ensure that it is encrypted in a particular way," he said.

Adhar said the product was used by a number of large organisations overseas, such as Deutsche Bank and the US Department of Defense. Randtronics was in negotiations with some potential customers here, whose names he could not disclose, he said.

Each box cost about $75,000, and two boxes would be needed to provide redundancy. A complete set up would also require $50,000 of software, meaning that a single deployment would cost around $200,000, he said.

"It is a niche product. You're not going to see this in Harvey Norman," Adhar said. "It's more for organisations with 1000 people that can be looking at data."