Sutton's law

When asked by a reporter why he robbed banks, the famous bank robber Willie Sutton is said to have replied, "Because that's where the money is." It turns out that Sutton didn't really say this: a reporter looking for a noteworthy quote actually just made it up. But despite this slight inaccuracy, we still may be able to gain some useful insight into enterprise encryption strategies by applying what has become known as "Sutton's Law" to enterprise data.

Data in storage can be the biggest compliance headache because storage contains so much sensitive data. This means that a hacker can obtain more sensitive information from a single backup tape than he can from years of trying to intercept data that's being transmitted. Because of this, Willy Sutton might advise twenty-first century hackers to target storage systems, "because that's where the data is."

If this is what hackers are going to do, what's the best way to counter them?

One easy way to protect data in storage is to encrypt it. Encrypted data is no more useful to a hacker than stacks of blank paper would have been to Willie Sutton, and we would expect that Sutton would have found a different line of work if that's all he would have gained by robbing banks. He would certainly have advised hackers to focus their efforts elsewhere if they could only recover encrypted data from storage.