Administrators designing access controls for data at rest have a variety of models at their disposal. In high-security environments, they may choose to use a mandatory access control (MAC) model, where only the administrator grants access. Those seeking more flexibility will likely adopt the more common discretionary access control (DAC) model that allows users to delegate permissions. Users of both MAC and DAC models may also choose to implement role-based access control (RBAC) to simplify administration through the use of permissions based on individuals’ role(s) within the organization.

Let’s look at an example of file server access and DAR. A large corporation is establishing network storage for archival purposes for all of its employees. Each user’s local Documents directory is mapped to a folder on a network file server. The users are told that any document that needs to be backed up should be stored in the Documents folder. For ease of management and organization, each user’s folder on the file server is named with his or her logon. These folders are then organized by department, so each user folder is within his or her departmental folder.

Although documents are more easily backed up, end users raised concerns, especially users in the human resources (HR) and accounting departments. Some documents contain sensitive information that should not be accessible to all employees. This is where access controls come in. Each user is granted full rights to his or her network folder and limited rights to the departmental folder. For document-sharing purposes, users have rights to read and modify files in other user folders in their department; however, those rights may be altered by the owner of the document. Users do not have any access rights to any other department’s folders. Using access controls, the company is able to guarantee the privacy of sensitive data on the file share.

Access controls alone are not enough to secure DAR. Portable devices can be stolen and access controls can be circumvented. When a malicious user has access to the medium on which information is at rest, the user can circumvent standard access controls. A malicious user could mount a stolen laptop hard drive, for example, on another system on which he or she has administrative rights. The user could then take ownership of files and folders, modifying the access rights at will. This is where disk encryption becomes vital.

Disk encryption, especially whole disk encryption, is essential to securing data at rest, especially on a portable device. It’s difficult for an unauthorized user to extract data from an encrypted disk. Although a malicious user could attempt to decrypt the disk, it would take months or even years.

You must also consider physical security when dealing with DAR. If an organization uses backup tapes or optical media for archival purposes, how and where are those tapes stored and transported? How does the organization decommission and dispose of obsolete systems? Some organizations have discovered that improper data and device disposal can lead to information leaks. Here are some examples of data leaks due to poor data disposal practices:

• In 2018, SSM Health St. Mary’s Hospital in Jefferson City, Missouri, reported that improper storage of paper records led to a data breach affecting 301,000 individuals.
• In 2017, ShopRite Supermarkets reported that they improperly disposed of a pharmacy signature capture device that had stored the health records of as many as 12,172 individuals.
• At the end of the 2008 U.S. Presidential campaign, the McCain campaign sold off smartphones that were no longer needed. They neglected, however, to clear the devices’ memory before the sale and exposed the personal phone numbers of high-end donors and campaign officials.
• In 2006, a U.S. defense contractor sold obsolete hard drives on eBay. Information found on these drives included Top Secret documents on a new U.S. missile defense program.
• In 2005, a German police department sold a hard drive containing detailed plans on the department’s alarm systems as well as sensitive police procedural documentation.

There are countless other examples. A study by British Telecom found that 34% of the hard drives the company bought on eBay contained sensitive information. This included personal data, financial information, and even classified documents belonging to various nations.

One way to secure DIM is to encrypt data. This is especially common with email. The information sender and receiver agree on an encryption technique and then share the appropriate keys. The sender then encrypts the information and the receiver decrypts it. Anyone who intercepts the data packets in transit is left with meaningless bits of data.

Another method is to secure the communications channel. You can use protocols such as Transport Layer Security (TLS) to accomplish this. TLS creates encrypted two-way communications at the Application Layer of networking. You’ll see this most commonly with Hypertext Transfer Protocol Secure (HTTPS) communications. You can also secure the path with a virtual private network (VPN) to provide a secure encrypted tunnel through a public network such as the Internet.