Software Lets Enterprises Encrypt, Restrict Use of CD/DVD Media

LAS VEGAS -- Interop 2008 -- How do you keep users from walking out of the company with sensitive data on a CD -- or coming in with a malware-infected DVD?

In an announcement here, Lumension Security unveiled Sanctuary 4.3, an enhanced version of its software for encrypting and controlling use of portable storage devices such as USB thumb drives. In this version, the company has extended those capabilities to prevent users from accessing CD and DVD data when their PCs are not authorized to do so by the corporate network.

The software enables a company to set policy for the use of CDs by specific groups or departments, and then enforce that policy by making it impossible for users to read or write data on a CD unless a client-based agent releases the encryption keys from a central server. Essentially, the system prevents users from using CDs outside the parameters of the enterprise network, virtually eliminating their ability to steal or give away data by downloading data or giving away a CD, Lumension said.

"Up to now, companies have basically had two choices: they could take the draconian approach -- which is to take out the CD drive from the end user's PC -- or they could take the ostrich approach, where they stick their heads in the sand and pretend that [theft or loss of data via CD] is not a problem," said Don Leatham, director of solutions and strategy at Lumension.

The encryption can be done via Lumension's encryption technology or via PGP, the company said. The company may also support other forms of encryption in the future, Leatham said.

The support for CDs and DVDs may help companies support their case for security compliance, said Charles Kolodgy, vice president at IDC. "Lawyers are requesting proof that a lost laptop or removable media was encrypted -- they want evidence that the data was protected," he said.

— Tim Wilson, Site Editor, Dark Reading