IBM Embarking on Asset Encryption

By Dave Nixon

In providing 355,000 employees with PGP’s whole-disk encryption to ensure data confidentiality, IBM is embarking on an enormous rollout of desktop and laptop encryption.

Although IBM already uses encryption in areas of its organisation, predominantly with Secure Multipurpose Internet Mail Extensions encryption in Lotus Notes, the rollout of PGP whole-disk encryption symbolizes Big Blue’s biggest-ever pledge to data-scrambling.

According to Alan Mitchell, IBM senior technical staff member for IBM’s office of the CIO, information technology security and privacy. “This is an enterprise-wide deployment worldwide through 2008,” Mitchell says. “We’re using whole-disk encryption to protect assets.”

Indicative of other organisations leveraging encryption, the two main drivers are fears regarding data losses and compliance with privacy regulations impacting worldwide industry sectors. (EMC’s CSO recently mentioned that the storage organisation is encrypting all its laptops.)

Although not a banking or healthcare provider, its customers have encouraged IBM to adopt encryption for purposes of sharing information. “We work with banking, healthcare and government agencies,” Mitchell says. “We serve these markets and they are driven by compliance requirements.” He adds, “And we’ve had an increased loss in laptops as well.”

PGP’s software conceals inactive data with encryption. IBM’s pilot program last year found the key management to be reasonably straightforward. Over time, IBM anticipates including language needing encryption in its contracts with business partners that handle IBM-related data.

Declining to discuss the encryption costs of rollout at IBM, Mitchell said “This is going to be part of our requirement in business over time”