Hard Drive Life Expectancy (and the Right Question)

Whenever I am asked, “How long can I expect a hard drive to last?” I reply with, “How often do you back up your data?” This seeming non sequitur perplexes people, but I have found that the answer to my question is, almost invariably, the reason the first question is asked. The questioner is wondering how much longer he/she can get away with not backing up data.

Technobabble about MTBF (Mean Time Between Failure) in the 50,000 to 100,000 hour range is useless. Those hours are active hours during which the read/write head of the drive is moving. You have no way to monitor and record read/write head activity and you don’t want to be bothered doing so unless you’re a test engineer for a hard drive manufacturer.

Furthermore, MTBF measures mean (average) time before the hardware fails catastrophically, as in “won’t spin anymore.” That is the very last thing that will go wrong with a hard drive, akin to throwing a rod in your car’s engine. Long before the hardware fails catastrophically, you will be experiencing losses of data, and you might not even notice that it’s happening.

When data is written to a drive, the magnetic charge of tiny areas of the physical disk is altered. One magnetic state means “0” or zero, the other means “1” or one… or on/off, if you prefer. The patterns of this binary code store your data as a collection of magnetized spots in one state or the other. In order to make the disk reusable, the magnetic state of each spot on it must be changeable.

A lot of things can change that magnetic state beside the drive’s read/write head. A strong magnetic field near a drive can scramble data. Power blips can cause a read/write head to write (change the magnetic state of a spot) instead of read, overwriting data with gibberish. Even cosmic rays can penetrate any computer case and zap the data on a hard drive, although a cosmic ray is so narrow it will probably affect only one or a handful of data spots.

You don’t believe in cosmic rays? As I like to say, choosing not to believe in something doesn’t make it go away. But no matter — natural disasters like fires, floods, hurricanes and tornados also tend to dramatically shorten the lifespan of a hard drive. Even if your brand new 2 terabyte hard drive has no manufacturing defects, it won’t last long in an F5 tornado packing 200 MPH winds. And of course, there are well-known threats from viruses, botnets, and ransomware.

So a hard drive is in constant danger of having all or part of its data either erased, corrupted, destroyed, or otherwise rendered unreadable. It doesn’t matter if the drive is fresh out of the box or nearing its MTBF. (That list of destructive actions reminded me of another phrase: “Do Not Fold, Spindle or Mutilate”. I searched for that and found an interesting 100-year history of the punch card.

What Studies Have Been Done on Hard Drive Life Expectancy?

A study on hard drive longevity was conducted by Backblaze, an online backup provider that has more than 25,000 consumer-grade hard drives in service. They found that 78% of the drives they use are lasting longer than four years. That might sound good, but it also implies that 22% of hard drives fail in the first four years.

The Backblaze study identifies the three most common causes of drive failure: factory defects, random failures, and parts that wear out. The failures due to factory defects tend to happen in the first 18 months of service. Failures due to wear out start to increase much faster after the three-year point.

The Backblaze study has been ongoing for several years. Other hard drive studies done by Google and Carnegie-Mellon University have been five-year spans, and both were conducted in 2007. So there just isn’t an authoritative answer as to how long a hard drive will last. Backblaze has some stats that give them confidence to predict that more than half of all drives will last six years. I think you’ll find their report interesting.

What Are the Implications?

Let me summarize and pontificate a bit. About one in five hard drives will fail within four years. Failure rates start to jump after three years. And there’s a 50/50 chance your drive will last six years. Does that give you a warm fuzzy feeling? I’d rather not rely on luck and statistics. My advice is simple… why take chances?

It’s vital to back up your data regularly and not just whenever you don’t feel like doing something else. Regular, automatic backups are the best defense you have against loss of data.

Have a great week from all of us at ZI

What is Two-Factor Authentication?

It goes by many names… Sometimes it’s referred to as “2FA,” “two-step verification,” “login approval,” or “enhanced login security.” Bottom line, it’s a big improvement on the username/password method of gaining access to online accounts. Massive data breaches, often exposing millions of login credentials

Two-factor authentication makes it much more difficult (if not impossible) for someone to hack into your online accounts, even if they have your password. That’s because a password is just one factor used to prove (authenticate) that you are who you say you are. The other authentication factor will be quite different.

A username, such as JSmith419, is who you claim to be. In order to authenticate that claim, you may provide a password which, in theory, only the real JSmith419 knows. That’s one-factor authentication. Two-factor authentication requires two of the following three types of authentication factors:

• Something you know (e.g., a password)
• Something you have (e.g., a mobile phone)
• Something that is part of you (e.g., a fingerprint)

Passwords and mobile phones have become the preferred pair of factors for two-factor authentication. To use two-factor authentication methods 1 and 2, you might register your phone number with an online service such as Gmail, Facebook or your bank. Then, each time you enter your username and password, the service sends a text (SMS) message to that phone number, containing a unique one-time code that you must type in to be fully authenticated.

But there are serious vulnerabilities in SMS-based authentication. The SMS protocol was never designed for sensitive communications, so it utterly lacks encryption and other ways of defending against eavesdroppers.

You’ve Got Options

Google and other online services offer 2FA without the insecure SMS requirement. If you turn on this option you’ll need to enter your username/password as usual. You’ll then be prompted for an authentication code before the login can be completed. The code can come from Google Authenticator, an app for your Android or iOS device. This time-sensitive code can be generated even if you’re not online, and you can also print a list of codes for use when you don’t have your phone handy.

The really cool thing about using a two-factor authentication app is that even if a malicious person has your username and password, they cannot login to your account! And no, using Google Authenticator does not give Google access to any of the accounts you use it with. If you prefer to use a non-Google authentication app, check out Authy or the Lastpass Authenticator.

If it sounds like a nuisance to enter both a password and a verification code every time you log in, well, you’re right. But most services that offer two-factor authentication give you the option to enter the code once and check a box that says something like “trust this computer.” If you do that, you won’t need to enter a verification code each time you sign in with that computer.

Online businesses increasingly urge customers to use two-factor authentication. Some even insist upon it. Their reasons include the skyrocketing frequency of mass thefts of username/password pairs by hackers, and the cost of responding to such breaches. Those costs can include lawsuits, fraudulent transactions that merchants or banks must eat, the cost of notifying affected customers, and even the cost of providing a year’s worth of credit report monitoring. Not to mention the cost of bad publicity and lost customers.

2FA: Step-By-Step

There are a couple of websites developed to encourage and help Internet users enable two-factor authentication on all the sites that offer it. The Turn It On site is chock-full of information about two-factor authentication (abbreviated 2FA). Even better, it provides step-by-step instructions for enabling 2FA on over 100 sites, a list that is growing rapidly. See also TwoFactorAuth.org for a long list of websites that support Two-Factor Authentication.

Amazon, Apple, Facebook, Gmail, Instagram, Outlook, Snapchat, Twitter, and Yahoo are among popular sites offering 2FA. “Turn It On” also documents 2FA procedures for backup and sync services such as Dropbox; financial sites including Chase, Wells Fargo, and Bank of America; cloud computing resources such as Amazon Web Services; communication services such as Skype and Office 365; domain services such as GoDaddy; Web hosting services; government Web sites; Paypal and other payment services; eBay, Etsy, and other shopping sites; and many social media sites.

Another option for two-factor authentication is a gadget called a security key. We are all relying on web-based services for an increasing number of functions. As the number of user accounts you have grows, so does your exposure to identity theft and fraud. Two-factor authentication is the best way to protect yourself. It’s worth the small extra effort.

Have a Great week from all of us at ZI