Re: Tape Backup encryption

Hi,

Never knew about the SKLM option. Interesting.
I googled around for the IBM Security Key Lifecycle Manager pricing
information, but without result.
Anybody have a indication of what price range I have to think of?

Best regards,
-Arco

Op ma 29 okt. 2018 om 13:42 schreef Denis Robitaille
<denis_robitaille@xxxxxxxxxxxx>:

Hello,

We use SKLM here with a TS3500 tape library.

Here is how it works here.

The SKLM server (windows based) generates, serves and keeps the encryption keys. New sets of keys are generated at fixed interval and old sets are kept for several years according to our governance rules.

In the TS3500 configuration, for the tape drive that we want to work with encryption, they are configure to ask the SKLM server (trough it's IP address) for an encryption key.

During backup, the TS3500 receives the data from the IBM I and encrypt it using the key provided by SKLM. On the tape, the ID of the key is written automatically along with the encrypted data.

During a restore, the key ID is retrieved. The TS3500 ask the SKLM server for the corresponding key and is then able to decrypt the tape during the restore.

If you go that way, make sure that your SKLM server is well protected (we have 1 master and 2 slaves located in different data centers). If you loose your keys, you tape will become useless.