Re: Data Security/Encryption TSM v3.7

I didn't see a reply on this.  Here's my two cents:
1.  Compression is not encryption and there are only a limited
     number of methods.  Once broken, the compressed data is
     as clear as clear text.  Just stops the casual hackers and
     snoopers.
2.  SSH and other such products won't secure your backup jobs as
     TSM is using it's own communications method.
     SSH and other jobs will hide your sessions, but has nothing to
     do with the actual backups.
3.  Encrypting first sounds good, provided you have space enough.
     Sorry, I've never used any such software.
4.  Bytes are bytes and since most people use hardware compression,
     you can stream the data from the tapes with or without TSM.
     Making sense is the same concept as looking at a flow of packet data
     coming across an ethernet wire.  It's again clear text flowing off of
the
     tapes.  Might not make much sense, but sensitive text data from the
     tapes can be sniffed out.
5.  If he can see the traffic, he has breached your systems.  In the current
     days of dedicated ports, he would normally need access to wire between
     switches and routers or the switches and routers themselves.  If you're
     routing across the internet, then unless you're using things like vpn,
your
     traffic is viewable to those who manage or breach the routes.

The above may be wrong as they're my speculations.  VPN might be useable
internally as well as externally to control the clear text across the
network both
in house and out.  Physical access (whether to backup tapes, network
hardware,
or the systems themselves) is always a security problem.
My user book says client encryption is available for Windows
and NT but not unix.  It seems to imply encrypt across the network and not
to
the tape (decrypt before it puts it on the tape).

Cal Fujinaga


> -----Original Message-----
> From: Martin, Jon R. [SMTP:jrmartin AT KNS DOT COM]
> Sent: Fri, November 30, 2001 5:45 PM
> To:   ADSM-L AT VM.MARIST DOT EDU
> Subject:      Data Security/Encryption TSM v3.7
>
> Hello,
>
>         To support a disaster recovery initiative it is intended that all
> corporate servers are backed up to TSM.  The administrator of our firewall
> resists this mainly for the fact that the client data is sent in clear
> text
> over the network.
>
>         As the TSM administrator it has fallen to me to find common ground
> between the firewall administrator and the people driving the disaster
> recovery initiative.  Reading the archives I found the following opinions
> and would like to hear what anyone else might have to add or what recent
> opinion are.
>
> 1.  Set client compression  and then the data is transferred in a
> compressed
> format. Is this a proprietary/undocumented compressed format?
>
> 2.  Implement 'ssh' for secure connectivity between the server and client.
> Can anyone recommend a source for more information on doing this?
>
> 3.  Using PRESCHED and POSTSCHED encrypt sensitive data to a temp
> directory
> on the client and then backup that data.  Any recommendations on available
> products?
>
> 4.  The data on a TSM cartridge can only be read with the database for
> that
> TSM Server.  It would be extremely difficult and costly to retrieve this
> data from the tape alone.  That seemed to be the consensus in the
> archives.
> Does it still hold true?
>
> 5.  With the exception of an attack from within the company, if an
> intruder
> is in the position to capture internal network traffic would not that not
> mean that the firewall and other security measures have already been
> compromised?
>
> Thank You,
> Jon Martin