Forum Discussion

robertoaxity's avatar
robertoaxity
Moderator
2 years ago

How to see encrypt in my jobs backup?

Hello, can you help me? i need image or evidence of encryption of backups at veritas, if my backup has encryption how can I see that, some file on the client or master associated with the client, pol...
Linux
  • davidmoline's avatar
    davidmoline
    2 years ago

    Hi robertoaxity 

    Firstly, a glib answer - since you don't know it is probably that the backups are not encrypted. Now how to check this. 

    1. For tape, most modern tape drives have inbuilt encrpytion option, it just needs to be enabled. One way is to setup NetBackup KMS and create ENCR_<pools> that use the KMS to enable encryption when writing to tape. It is also possible to an external mechanism to encrypt tapes (in which case NetBackup has no knowledge of this). If you don't have KMS setup, nor any tape pools starting with ENCR_, then you are not using NetBackup controlled tape encryption. If you have a third party mechanism - I cannot tell you how to verify. 

    2. For Disk, if the disk is MSDP, then review the storage server properties to see if the encryption filed is set to 1. MSDP can optionally use KMS also which can also be checked in the same place. If the disk is Advanced disk, then you can use NetBackup KMS to encypt data at rest if the pool name starts with ENCR_. 

    3. It is possible to enable client-side encryption by selecting the appropriate check box on the policy. 

    Hope this helps. 

    David

davidmoline's avatar
davidmoline
Level 6

Hi robertoaxity 

How are you encrypting your backups? The answer will determine the method to show the proof. 

Also what level of eveidence do you need? For instance would the stsorage server properties be sufficient to show an MSDP pool is encrypted?

Cheers
David

robertoaxity's avatar
robertoaxity
Moderator
2 years ago

I dont know if my backup are encrypted, so i need see that and how i see the backup encrypted

  • davidmoline's avatar
    davidmoline
    Level 6
    2 years ago

    Okay, let's start at the basics - what devices are you using to store your backups? Are you trying (or wanting ) to encrypt your backups from the client, or just where the backups are stored (disk/tape/cloud)?

    Have you review the Security and Encryption Admin guide - this provides much of the background and details how to configure the various options.

    • robertoaxity's avatar
      robertoaxity
      Moderator
      2 years ago

      Hello,

      The backup are stored in disk pool and then copie in tape, so example i have a server A in a policy standard all_loca_drives, i need know if this backup job of server A has encrypted or no.

      thanks for your help

      • davidmoline's avatar
        davidmoline
        Level 6
        2 years ago

        Hi robertoaxity 

        Firstly, a glib answer - since you don't know it is probably that the backups are not encrypted. Now how to check this. 

        1. For tape, most modern tape drives have inbuilt encrpytion option, it just needs to be enabled. One way is to setup NetBackup KMS and create ENCR_<pools> that use the KMS to enable encryption when writing to tape. It is also possible to an external mechanism to encrypt tapes (in which case NetBackup has no knowledge of this). If you don't have KMS setup, nor any tape pools starting with ENCR_, then you are not using NetBackup controlled tape encryption. If you have a third party mechanism - I cannot tell you how to verify. 

        2. For Disk, if the disk is MSDP, then review the storage server properties to see if the encryption filed is set to 1. MSDP can optionally use KMS also which can also be checked in the same place. If the disk is Advanced disk, then you can use NetBackup KMS to encypt data at rest if the pool name starts with ENCR_. 

        3. It is possible to enable client-side encryption by selecting the appropriate check box on the policy. 

        Hope this helps. 

        David