Link to home
Start Free TrialLog in
Avatar of Optima Systems
Optima SystemsFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Encryption on Servers and RAID 5

Hi
I have a Server running MS 2008 R2 which has 3 SAS hard disks configured for RAID 5 on a Perc Controller.

These are obviously showing as 1 virtual disk split into a C: and D: drive. I am thinking of encrypting the data on the D: drive using Bitlocker. Will this work across a RAID array and is there a downside?

Also as a general question if all the disks were stolen from the Server (ie removed from the bays) what data would a person be able to see if they plugged each disk into a server as an external device and would a specialist recovery company be able to access the files?

Thanks
ASKER CERTIFIED SOLUTION
Avatar of David
David
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Optima Systems

ASKER

Thanks for the answer.

 Just to clarify then, there is no reason not to use Bitlocker and as it sees the virtual drive there will be no issues and if I leave the data un-encrypted a recovery person could access the data on any single drive?
And who would enter the key? Or would you use a TPM?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I have no idea on the key, I would check the docmentation.  Bitlocker certainly works on LSI RAID and partitions, but there are rules and procedures that vary slightly on each flavor of windows.    But do remember the PERC 5 is LSI card but not LSI firmware.

It is LSI card with Dell firmware.  99% the same, but not 100%.   This is a question best asked to the dell support community.
With all that is said above, no encryption on server necessary, have server physically secured. Or you can pay to host your server in the cloud where you and everyone else  do not know where the physical server is
"Bitlocker is a poor choice, as McKnife points out" - I did not do anything like this. BL is no poor choice for sure.
Let me add that there are ways to secure a server even when it's not physically secured AND also have the key entered automatically. We could for example use a scheduled task that points to an unlocking batch file on some other server (secured elsewhere). When that encrypted server gets stolen and the thief boots it, the batch will not be accessible and d: would stay locked.
Thanks to everyone for the replies. I think that probably encrypting the data on the server is unnecessary but we have been asked to look into it.

The thing I am still a little unsure of, as I didnt completely understand the very first reply, is that if by any chance someone gained access to the server and removed the individual disks from the server how much data would they see? Obviously the RAID has been broken so it would be what is visible on the actual disk.
Thanks for any clarification.
Removing the disks will not break the RAID. The raid will exist as long as it is handled with care and attached to the same controller model or model successor and then, whole d: would be accessible.
but if the server was left in the server room and the disks were removed and taken away (ie stolen) what data would be visible on the drives if someone looked at the disks?
Raid is not that tough to reconstruct on another machine, but the order of the discs is important. Let's assume they have done so, which is the path of most resistance btw, they would take the entire enclosure and save some headache there in real life...Either way, the raided drives are readable, but beyond the NTFS headers, if the entire volume was encrypted, they'd have to supply the decryption key to gain access. It's no different than a LT drive or a secondary drive, reconstructing the raid is a pain, but do-able, other than that all the same rules apply. Raid is below the encryption, and as stated above, neither know about the other, the encryption see's a volume and encrypts it. The Raid see's drives and creates a volume, that is all.
The best way to read encrypted drives is to not turn them off. If I were to steal a server, and I found that it was encrypted, I'd stop right there unless there was some extreme, very extreme financial gains to be had.
Encrypting server HDD's does not make you compliant with any US or European law or statute I am aware of. There are ones for Mobile, but not server. Encrypting data on servers should be done at file and database levels rather than the OS or Drive level. Again read my article to see what that is.
-rich
Again: the raid does not matter here. If the unencrypted drives are stolen, all data might be accessed unless the thieves have no idea what they hold.