Data Encryption

[Brian_Ballenger]

I'm not sure why BE offers no method for encrypting data, but because it doesn't, I'm looking for a third party method or application that can encrypt the data prior to writing it to tape. Does anybody have any experience doing this? What applications would you recommend?

[Zerene_Sangma]

Hello there,


You can use any third party software for encrypting the data. Backup Exec will backup the encrypted data as it is and will restore it in the same format.

Thank You. If you have additonal concerns or questions, please ask us.

[Brian_Ballenger]

I figured as much, but what I was asking was if anybody had any experience with specific methods or specific third party programs.

Also, does anybody have any experience using EFS in Windows with Backup Exec? Are there any caveats as far as the Backup Exec user being different than the encrypting user?

[gaurav_seth]

Backup Exec for Windows Server (BEWS) uses underlying OS mechanism for this. BEWS does not have it's own mechanism by which it can provide encryption.

Hope this helps.

[Brian_Ballenger]

I've answered my own question, more or less. We've decided to go with the EFS feature in Windows to keep the data encrypted at all times. We did not want the backup account to have the appropriate certificates to decrypt the data. By adding the backup account to the backup operators group, we were able to back up the encrypted data without being able to read it.

For anybody who tries this, please make sure to export your certificates. If your machine dies and you need to restore from backup, you will not be able to access any of your data without first importing the certificate from the old machine.

[Janice_Fielder]

Veritas might want to consider adding an encryption feature. I think that this is going to become an issue as security becomes more important and issues like the problem with the lost Bank of America tapes that were not encrypted make the news.

[Ken_Putnam]

You might want to put this on the Enhancement Request page

http://enhancement.veritas.com/

[Kerm]

Don't neglect to think through having to restore an encrypted tape from a different BEX server after the fire also takes out your certificate copies. You can become so safe that you increase the danger.