Re: Spectrum VS5030 disk encryption query

Hi Larry,

If you encrypt through the database, isn't the data also encrypted at rest?  If someone stole the disk, they still wouldn't be able to read the encrypted data, right?

--
*Peter Dow* /
Dow Software Services, Inc.
909 793-9050
petercdow@xxxxxxxxx <mailto:petercdow@xxxxxxxxx>
pdow@xxxxxxxxxxxxxx <mailto:pdow@xxxxxxxxxxxxxx> /

On 4/14/2021 8:29 AM, Larry "DrFranken" Bolhuis wrote:

Even if the disks are encrypted at rest, administrators on the server very likely has access to see the data on the disks or in the database through the operating system.

Think about it this way: The two encryption options solve different problems.

Encryption at rest solves the problem of someone stealing the disk or the SAN. Physical possession does not enable access to the data. However once unlocked the disks provide the data to the O/S UN-encrypted. No data is protected from prying eyes who have access to the O/S.

Encryption through the database solves the problem of users and administrators on the system from accessing data they are not allowed to see, even if they have special authorities such as *SAVSYS or *ALLOBJ.

In many environments it's not which to pick it's both!

    - DrF

On 4/13/2021 6:52 PM, Laurence Chiu wrote:

We are about to implement SAN based encryption on our FS5030 SAN.

A comment was made by one of our security team who said while disk
encryption solves the problem of safe disk destruction it does not solve
access to data at rest if you have access to the LUN like a disk
administrator.

So OS level encryption is preferable.

I don't understand that. If data is encrypted and keys are managed locally
or via SKLM what tools would an administrator have to be able to view the
data?  They might be able to delete the LUN but that hardly is access.