Veritas Encrypt Backup Tapes

[Ztrek7]

With all the security mishaps about "losing" backup tapes, I am looking to encrypt all of our veritas back up jobs.

Is it as easy as adding a password? Or is there some other product that I have to buy?

Any Ideas?

Thanks,

 

[steveot]

You can add a password in the Device & Media properties of the job.

This will protect the tapes from a catalog operation. You will need this password to catalog/restore from the tape. Even in NTBACKUP.
The downside if you loose this password you will have to send the tape off to a data recovery services.

 

[Ztrek7]

Any known cracks to worry about? That is why I asked if it was just password protected or it actually generates some sort of encryption key to encrypt files with the password.

Thoughts?

 

[steveot]

Not that I know of. The password gets stored on tape in the header/catalog information. IF you run ntbackup againt it it will prompt for the password as well. There are 3rd party hardware solutions that lie between the backup exec server that can encrypt the data stream before reaching the tape

 

[Ztrek7]

Names of these third party tools and anyone have any experience in these?

 

[sharmaritu]

I read your thoughts about password protecting the media. Do you know of any third party tools that provide the way to encrypt the data on the media.
Thanks

 

[Scotsgeek]

The only solution I have seen - but not used - is Paranoia2 from DISUK (

http://disuk.com/paranoia2.htm).

Regards

 

[Tekmazter]

any idea on the performance hit you take when encyrpting the stream? Since my backups are already hUUge, I don't have much of a window to play with

 

[justin2000]

Interesting how they call the software paranoia.

Now I have to ask.. what happens if you lose the encryption keys?

What happens if the place you have burns down along with your paranoia?

I reckon you are asking for trouble wanting to encrypt your tapes.

 

[Ztrek7]

I know it seems like the more "features" or "security" we apply to things, it makes it more complicates with more points of failure. But, that is our job. That is why we get paid the big bucks. To SECURE the info, no matter what. To allow in ONLY who deserves to be in. And, make sure it works!

I agree though, the paranoia does not seem like a good idea, especially since i have multiple servers at multiple locations.

How about something like a PGP and a key ring? Back up your keys, take them off site in case of any onsite disaster, and then all your tapes can be encrypted in case of break in, stolen or lost in transit to off site location, etc.

Any one know of a product like that?