cancel
Showing results for 
Search instead for 
Did you mean: 

Encryption question

JJ58
Level 4
Partner Certified

Hello

NBU 7.0

i want that The encryption will be handled by the tape drive itself; it’s a completely hardware based encryption,

My question is: Does NBU support hardware based encryption without the encryption option? And if it does, how do you manage it?

Appreciate your feedback

Regards

1 ACCEPTED SOLUTION

Accepted Solutions

teiva-boy
Level 6

Yes NBU supports hardware encryption, and you do NOT need to buy MSEO which is a software encryption option (as the name implies)

Read up on the security and encryption documentation for NBU, all of it, including the setup is all documented in there.

View solution in original post

4 REPLIES 4

teiva-boy
Level 6

Yes NBU supports hardware encryption, and you do NOT need to buy MSEO which is a software encryption option (as the name implies)

Read up on the security and encryption documentation for NBU, all of it, including the setup is all documented in there.

RiaanBadenhorst
Level 6
Partner    VIP    Accredited Certified

Yes NetBackup supports it but the HCL to verify the support. Below is an example of a supported product.

 

http://www.oracle.com/us/products/servers-storage/storage/tape-storage/029154.htm

 

R

RonCaplinger
Level 6

If you are referring to LTO-4's hardware incryption abilities on the tape drives themselves, NetBackup is not involved in any part of the encryption or decryption of the data, nor does it need to be informed of it.  There is nothing to license from Symantec to use this type of encryption.

The encryption/decryption does require a compatible Encryption Key Manager (EKM) server, though, which would be licensed through your tape library hardware vendor.  The tape drives need to communicate with this server (usually over an ethernet connection on the tape library) to obtain valid encryption/decryption keys for the tapes.  The EKM software may be able to run on your media server, but that is not required.  It all depends on your vendor's requirements.  Most folks would run the EKM in a VM, since it should have very low requirements (the only I/O it performs is to send encryption keys, it doesn't read any data from the backup data stream at all).

If you have an offsite disaster recovery site, be sure that you have LTO-4 drives at that location, too, along with a secondary EKM server at that location that has been sync'd with your other EKM server so they contain identical key stores.  Without that, your backups are impossible to decrypt and would be useless in a disaster.

J_H_Is_gone
Level 6

KMS is a free database that comes with Netbackup that will allow you to use lto4+ drives to do hardware encryption.

It is just one chapter in the Security and Encryption guide.

And really easy to setup and maintain.