The best solution for data encryption ??

[chris_magic]

Guys,

I would like to know what is the best solution for data encryption.

By the library or by TSM?

Thanks in advance.

 

[cjhood]

Chris,

I've only done encryption via LTO4 drives with TSM managing the keys, and from my experience it works ok. The major issue is that the TSM database holds the keys, and thus you can't encrypt the DB backup tape. Performance is good, as the encryption is done in hardware it's almost as fast as regular LTO4.

I can't speak for LME, or for client-side encryption, perhaps someone else here could share their opinions...

 

[dangel42]

We also have TSM manage encryption and have had no issues.

 

[chris_magic]

I ask this because I want to encrypt only the data who are in my LTO storage pool who is going in vault.

My TSM server is on Windows 2003 server and the version is 5.5.4.1

Is it possible to encrypt only a specific storage pool (LTO) ?

 

[cjhood]

I ask this because I want to encrypt only the data who are in my LTO storage pool who is going in vault.

My TSM server is on Windows 2003 server and the version is 5.5.4.1

Is it possible to encrypt only a specific storage pool (LTO) ?

You setup encryption on the DEVCLASS. So for your offsite pool, you'd create a new device class (LTO_ENCRYPT or something like that), and make sure DRIVEE=on. Then create a new storage pool for your offsite tapes using that devclass.

You can update an existing devclass to encryption on, however it will be turned on for all storage pools using that devclass.