Encryption in netbackup MSDP multi-domain
Hello All, Looking to enable encryption on Netbackup MSDP multi domain. Does this supported by Netbackup? Also can we enable encryption on Media server where storage server is seprated from media server ? As per my understanding we have to enable encryption on both serversUnderstand, Plan and Rehearse Ransomware Resilience series - Access and Improve
Ransomware uses stolen credentials to gain access to backup systems and then delete, encrypt or expire the backup data. For more details on how to enable these features, here are theten steps to increase your security posture.
NBU 9.x / 10.x Tape storage encryption with IBM ts4500 library
Dear Team We have NBU 9.1.0.1 master server on RHEL with Flex5250 appliances as media server. We are refreshing our tape library hardware with IBM TS4500 library with ts1160 drives We would like to enable tape storage encryption via netbackup . On the IBM library , we have 2 options 1. Application managed encryption ( AME ) .if the netbackup generates and manages encryption policies and keys 2. Library managed encryption (LME ) . encryption transparent to Backup software . ie Netbackup Does netbackup support both methods ? do we have any documentation around this ? does anyone have experience setting this up ?
Duplicating a hardware encrypted tape to an unencrypted tape
I have an LTO5 tape that has been backed up with hardware encryption. It has a variety of different types of backup sessions (flat files, MS SQL servers, MS Exchange) and I've been given the passphrase, so I've re-created the key and can pull off the flat files without any issue. The client has asked me to create an unencrypted version of the tape (they wish to use various 3rd party tools to extract the SQL and MS Exchange backups), and I've tried doing this with the duplication function, but I can't get it to work. I have a second tape drive in which I've mounted a freshly erased and labelled LTO5. When I try duplicating the original sessions from the encrypted tape onto it, I'm given the option of types of encryption (I chose none) but BE is switching on hardware encryption on the target drive anyway. This is regardless of whether I use DirectCopy, or choose to actually have encryption (which then gives me the option of choosing which key to use). Any ideas? Is there some option or other hidden deep in the bowels of BE that's telling it to encrypt everything it writes to tape by default?How does backup Exec generate the AES-256 key used by tape drives for encryption?
Does anyone know the key generator used by BE to create the AES-256 keys used by LTO drives for hardware encryption? You can read an encrypted tape across different versions of BE if you supply the same passphrase when you create the key, so clearly BE is using the same algorithm and/or salt. Does anyone know what it is?
