Data Storage Encryption

We need to implement data encryption for our backup tapes on and off site.

Could someone point me in the right direction? What are the best practices for data storage encryption?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

You really have three options.

1) Software encryption at the OS layer (Encrypted File System on Windows, or a PGP like software)
2) Wire encryption from a company like Decru ( now owned by NetApp. They encrypt data going across the wire to tape and decrypt going back to the server.
3) A Security Appliance + Software like Vormetric ( This is more complicated because it has a software module and an appliance. However you have a very granular control and audit mechanism.

While there are other companies out there these solutions come to mind as best of breed.

Best practices really fall into the category of what you are tying to secure and the size of your organization.  If you have a small number of servers 1-5 you may choose option 1 above because of cost and complexity to roll out anything else. If you have a midsize organization that can afford options 2 or 3 you now have to consider is encrypting the data pipe enough.

The question for larger organizations becomes, what is it that I am trying to protect? It sometimes is not adequate to just encrypt data on tape and you need to extend the security infrastructure around business process. Vormetric and companies in that space excel at providing a total security solution.


PS I don not work for any of these companies.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Usually, encryption functionnalities are included directly in the backup software. I use arcserve, and it let me encrypt the tape while I'm backing up data on it.
bnditAuthor Commented:
I'm running Veritas 9.1 at the present time and we're thinking of going to Veritas 10D. I don't believe Veritas 9.1 has the encryption ability.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

From what I'Ve read, you can password protect your tape with Backup exec, but this isn't the same as encryption. You need Veritas NetBackup for this, but I never tried it..
How much data are we talking about?
bnditAuthor Commented:
We're talking about 400-500GBs.
Wow. I am encrypting a 250GB hard drive right now. It takes 5-6 days with PGP. I am already into the 3rd day.

To handle that much data, I would suggest you to use your Veritas to password protect your tapes.

What kind of data are we talking about? You may want to revisit and see if you truly need to encrypt all 400GB.
I literally just completed a Decru implementation today- it is unbelievably easy and comprehensive.

They just came out with a SCSI pass-through device that lists at $15K.  It encrypts but doesn't reduce the speed of the backup.

Cool stuff.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Storage Software

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.