Data Encryption Overview

The first step in the data encryption process is to determine the optimal encryption method for your environment. There are three methods:

• Copy. Clear data is encrypted by copying it into a GuardPoint with an encryption policy.

• Restore. Clear data stored on a backup device is encrypted by restoring it to a GuardPoint with an encryption policy.

• dataxform. Data is encrypted in-place using the dataxform command line utility.

The optimal method depends on the following:

1. Whether you are encrypting data on a block device or directory.

2. The amount of disk space you have.

3. Speed of your backup devices.

How to Decide What Method to Use

Some general rules:

• If the data you are encrypting is in a block device, you must use the Copy or Restore encryption method.

• If you can copy the data into an encrypting GuardPoint on the same disk and same volume, the Copy method is as fast as the dataxform method.

• If you can copy the data into an encrypting GuardPoint on the same disk, but different volume, or SAN or NAS, you can use the Copy method but it is slightly slower.

• The Copy method also requires disk space that is twice the size of the data you are encrypting.

• If the data you are encrypting comes from a backup device that is not a disk, for example, a storage array, you can use the Restore method.

Restore Encryption Method

In this method, your sensitive data is backed up to a storage device. To encrypt the data:

1. Block access to the directory or device that will be encrypted.

2. Create a GuardPoint with an encryption policy on the directory or block device that will hold the protected data.

3. Restore the data from the backup device to the GuardPoint. As data is written into the GuardPoint, it is encrypted.

4. Replace the encryption policy with a production policy or the initial test policy.

5. Open access to the now-protected directory or block device.

In the following example, users access Oracle databases on the protected host.

Figure 2-1: Users Accessing a restored Oracle DB

To encrypt \DB-3:

1. Block user access to it.

2. Create an encryption GuardPoint on \DB-3.....

3. Restore the backup data from the backup media to \DB-3.

4. Restore access to the directory.

This method requires no extra disk space. The speed of this method depends on the speed of the restoration device.

Copy Encryption Method

In this method, you encrypt clear data by copying it into a GuardPoint with an encryption policy. This method is generally faster than the restore encryption method. If the data you copy to the GuardPoint is on the same drive and volume as the GuardPoint, this method is comparable in speed to dataxform, which is about 2-4 GB per minute. If the data to be encrypted is accessed from a slower disk or a different volume, the encryption will be slightly slower.

The following is an example of the Copy Encryption process:

1. Block all access to the directory containing the data to be encrypted.

2. Rename that directory (example: from \mssql\data\2 to \mssql\data\2-OLD).

3. Create a new directory for your sensitive data with the original directory path (\mssql\data\2) and block access to it.

4. Create a GuardPoint with an encryption policy on that directory.

5. Copy the sensitive data into the GuardPoint. Data in the GuardPoint is encrypted.

6. Replace the encryption policy with a production policy or the initial test policy.

7. Allow access to the new directory.

This method requires additional disk space at least as large as \mssql\data\2-OLD. The speed of the method depends on the speed of the copy.

Figure 2-2: Users using the copy method

dataxform Encryption Method

In this method, you encrypt data in place using the dataxform tool. In general, this method is the fastest. To generate an estimated time for encryption see Estimating the dataxform Runtime Period.

The following is an overview of the dataxform method:

1. Block all access to the directory containing the sensitive data.

2. Create a dataxform policy for the GuardPoint on this directory.

3. Run dataxform on the directory. After completion, the data in the GuardPoint is encrypted.

4. Remove the dataxform policy on the GuardPoint and replace it with a production policy.

5. Open access to the directory.