topic Re: encrypt data on tapes in Operating System - HP-UX

encrypt data on tapes

John Destreel — Wed, 14 Feb 2007 06:16:28 GMT

Hi,

In order to prevent public exposure of company sensitive backup files of oracle databases on tape and scared by recent lost of patients unencrypted data of a certain hospital, I'm considering my options right now.

On my rp5470 11.11 a make hotbackups of the oracle9 databases and store these with fbackup on tapes. I would like to store the encrypted now.

Crypt is too weak!?
I could upgrade to 11.23 and deploy EVFS, but are there any drawbacks to consider.

Are there any other (free) solutions not including additional hw?

please advice ...
tia

best regards,

John Destreel

Re: encrypt data on tapes

Robert-Jan Goossens — Wed, 14 Feb 2007 06:24:23 GMT

Hi John,

Good article.

http://www.csoonline.com/analyst/report3945.html

Regards,
Robert-Jan

Re: encrypt data on tapes

Bill Hassell — Wed, 14 Feb 2007 07:24:33 GMT

There is no easy way to do this with fbackup. You would be much safer in using Data Protector or other commercial quality backup program where encryption is built in. And of course, proper handling of backup tapes, from creation to transport to storage (and eventually, destruction) is part of a good protection program.

Re: encrypt data on tapes

Steve Lewis — Wed, 14 Feb 2007 07:44:21 GMT

How about a different view?

Your auditors will also want assurance that people such as you cannot update the data on the storage directly, as well as securing the backup tapes.

So how about considering encryption of the columns in the database itself?

This will protect the backup tape data as well as the on-line storage.

In either case you would need to ensure that your encryption keys are kept separately from the backup data, but are just as secure. Key management is becoming quite an issue these days.

Re: encrypt data on tapes

Steven Schweda — Wed, 14 Feb 2007 08:47:06 GMT

If you have a "hotbackup" on disk, you might
run it through GnuPG (or something similar),
and then put the scrambled result onto tape.

I assume that that method would roughly
double your transient disk storage
requirement, and consume some non-trivial
amount of CPU, but the software cost would
meet your criterion.

Re: encrypt data on tapes

Carl Houseman — Tue, 04 Dec 2007 17:03:14 GMT

I just found this thread while researching my own needs for tape encrytpion. I guess this answer is way too late, but what are you using for the hot backups? Typically that would be RMAN, and RMAN has the ability to encrypt the backup data as it creates it. Just google 'rman encryption'