encrypt data on tapes

[John Destreel]

Hi,

In order to prevent public exposure of company sensitive backup files of oracle databases on tape and scared by recent lost of patients unencrypted data of a certain hospital, I'm considering my options right now.

On my rp5470 11.11 a make hotbackups of the oracle9 databases and store these with fbackup on tapes. I would like to store the encrypted now.

Crypt is too weak!?
I could upgrade to 11.23 and deploy EVFS, but are there any drawbacks to consider.

Are there any other (free) solutions not including additional hw?

please advice ...
tia

best regards,

John Destreel

[Robert-Jan Goossens]

Hi John,

Good article.

http://www.csoonline.com/analyst/report3945.html

Regards,
Robert-Jan

[Bill Hassell]

There is no easy way to do this with fbackup. You would be much safer in using Data Protector or other commercial quality backup program where encryption is built in. And of course, proper handling of backup tapes, from creation to transport to storage (and eventually, destruction) is part of a good protection program.

[Steve Lewis · Accepted solution]

How about a different view?

Your auditors will also want assurance that people such as you cannot update the data on the storage directly, as well as securing the backup tapes.

So how about considering encryption of the columns in the database itself?

This will protect the backup tape data as well as the on-line storage.

In either case you would need to ensure that your encryption keys are kept separately from the backup data, but are just as secure. Key management is becoming quite an issue these days.

[Steven Schweda]

If you have a "hotbackup" on disk, you might
run it through GnuPG (or something similar),
and then put the scrambled result onto tape.

I assume that that method would roughly
double your transient disk storage
requirement, and consume some non-trivial
amount of CPU, but the software cost would
meet your criterion.

[Carl Houseman]

I just found this thread while researching my own needs for tape encrytpion. I guess this answer is way too late, but what are you using for the hot backups? Typically that would be RMAN, and RMAN has the ability to encrypt the backup data as it creates it. Just google 'rman encryption'