In the world of enterprise storage, encryption is of paramount importance. From customer health records to national secrets, no organization can afford to let data slip into unwanted hands. This is why vendors evolved self-encrypting drives (SEDs) able to protect every bit of addressable data on a drive, right down to the base-level OS files, and secure it with advanced cryptographic algorithms (typically AES). HP G60 keyboard
Of course, the enterprise world—and regulated vertical markets and military groups in particular—expects some sort of assurance that their components have been validated as secure by an independent third-party expert. The original gold standard for SEDs was the 2009 Opal specification promoted by the Trusted Computing Group, which details minimum security requirements for client devices. However, adherence to Opal was spotty from the beginning, and organizations with the most stringent security demands wanted even more assurance. laptop screen
Enter the National Institute of Standards and Technology (NIST), which gave the world the Advanced Encryption Standard (AES) in the first place. Back in 2001, NIST first published the Federal Information Processing Standard (FIPS) 140-2, a standard used to certify cryptographic hardware modules and their attendant firmware and software. Four varying levels exist within the FIPS 140-2 standard, differentiated mostly by the degree of physical security (such as tamper-proofing) present in the device. HP DV7 fan
“FIPS 140-2 validation goes well beyond simply testing the cryptographic algorithms—such as AES, random number generation, digital signature, and hashing—into testing the overall security strength, tamper resistance, and risk aversion within the identified secure boundary of the drive,” says Ryan Smith, senior manager, SSD product marketing, Samsung Semiconductor. “FIPS 140-2 validation is a must-have in many purchase decisions, both government and private sector, because the validation, based on rigorous independent laboratory testing, is a well-recognized benchmark for cryptographic security.” Compaq C700 fan
This is why it’s a big deal that Samsung’s PM810 SSD just became the first-ever SSD to obtain FIPS 140-2 validation. Many SEDs claim Opal compliance, and there are several enterprise-class hard drives with FIPS 140-2 stamp, but this is a first in the SSD world, making it as the first and only option for SSD buyers requiring “military grade” security. HP DV2 screen
Yet there could be a caveat. It takes many months for a device to pass through the battery of FIPS 140-2 testing.
Tom’s Hardware has been testing the Samsung PM810 (also called the 470 series) since at least May 2011, and 18 months is an eon in the flash storage world. More significantly, the PM810/470 series is a consumer-class that, despite a 1.5-million-hour MTBF, is not a bona fide enterprise drive. Compaq CQ43 screen
When we directly asked Samsung why it was validating a consumer drive for enterprise and vertical markets, Smith answered by further discussing the role of encryption in compliance rather than addressing issues of endurance, data integrity, drive interface, and other enterprise-level storage attributes.
His point is certainly well-taken: notebooks toted about by enterprises containing a FIPS 140-2 validated drive couldn’t hope for better data protection today, and the PM810 will run circles around the performance of any competing FIPS 140-2 hard drive. Just be aware than in non-mobile situations, there are more elements in play forenterprise storage, and encryptionis only one of them. Lenovo T400 screen
Samsung’s new validation marks a sorely needed industry first, but it should be taken both in the narrow context of security as well as the broader context of storage priorities.
