Nevertheless, vendors are already anticipating a windfall. "We think this is a huge opportunity," says Scott Gordon, VP of marketing at NeoScale Systems. "Especially if other states start looking at this... We've already gotten sales-lead opportunities based on this."
But while storage security vendors may be happy with the new regulations, some observers say their enthusiasm is premature.
"School is still out on whether or not encryption is going to be more predominant in databases," says Doug Johnson, a senior analyst with the American Bankers Association, who adds that encryption can lead to a serious degradation of service. "I dont think encryption is going to be the initial inclination... Institutions are more likely to protect the entry to the data, rather than encrypt the data on the server."
If companies do decide that encrypting data is the best step to take to protect themselves from lawsuits, they will have a long line of products to choose from. Over the past month, several companies have launched new encryption products for storage networks:
- Last week, Kasten Chase announced three new products for securing SANs, including what it claims is the most comprehensive encryption system on the market. The company offers encryption cards that fit in SAN servers, encrypting the data even before it gets into the SAN (see Kasten Chase Secures SANs).
- Decru announced a fast encryption device two weeks ago, with a throughput of up to 2 Gbit/s. The device sits in the storage network between storage units and clients, and is completely transparent, the company claims (see Decru Ships 2-Gig SAN Crypto).
- NeoScale, which just raised $12 million in a second round of funding and appointed a new CEO, also offers in-band encryption appliances -- one for protecting primary storage in Fibre Channel storage arrays, and another for protecting data in tape arrays (see NeoScale Secures Funding, CEO and SAN Security Steps Out).
- Vormetric Inc. earlier this month also launched a storage encryption appliance.
So what encryption solution will companies choose? Observers note that the California law does not specify what level of encryption is required. And it's still too early to say which vendors are the most likely to benefit, according to Enterprise Storage Group Inc. senior analyst Nancy Marrone, who points out that the market is far from mature.