Encrypting Enterprise Vault using (or not) Netbackup

[smaslin]

We have a business need to encrypt the emails that are stored within Enterprise Vault 8.0 SP4. We are also running Netbackup 7.0. I noticed the Enterprise Vault policy grays out the Encryption option. Is there a way to encrypt this data before getting it to tape? I was thinking maybe a disk-to-disk backup using the Enterprise Vault policy type, then a disk-to-tape from that location to tape using the Windows policy type with encryption turned on. Will this work?? Any other ideas?

[GertjanA]

I am not familiar with encrypting data using netbackup, but here is what I think...

When an email is archived, I think you cannot longer call it an email. It is an archived item.
email encryption is done in the mail-program (exchange/outlook) using pki, pgp, drm or whatever you use. If you encrypt the mails in the mailbox, they then get archived, they should remain encrypted. I think...... I'm sure there are people more experienced using this.

Only thing I can think of, seeing the option is greyed out, is to use some sort of copy tool to copy the enterprisevault data to a location where you can encrypt the data before backing up?

Curious to see experts opinion on this too.

[Liam_Finn1]

Gertjan is correct that if you encrypt an email it stays encrypted when archived. Now here is the catch if you archive an encrypted item the contents stay encrypted and because of this the content is not indexed so you cant search on the contents or any attachment's.

The only way to encrypt email and have it available for indexing is if you use Windows Rights Management to encrypt the email as EV has the ability to tie into WRM and decrypt the email at the time of archive to enable an index to be created for that email and it's contents

[smaslin]

Our exchange server is not encrypting emails, I'm not worried about EV getting encrypted emails from Exchange.. at least not right now... I need to make sure that tapes that are sent offsite with EV data on them are encrypted.  It doesnt have to be encrypted at the client, it needs to just be encrypted when it gets to tape.
 

[Liam_Finn1]

Do you have the capacity to do a disk to disk backup, encrypt the backup directory then back the encrypted directory to tape? This will give you what you need. I'm sure you can run a script in Netbackup or any backup software to call a batch file to encrypt a directory then back it up to tape