Using LDT

The following list contains the steps for successfully setting up and using LDT.

1. Install the LDT License on the CipherTrust Manager.

   CipherTrust Transparent Encryption - Live Data Transformation is a separately-licensed feature of CTE. Before you can use it, you have to install the license to activate it. LDT is licensed for a specific number of hosts.

   For details about licensing, see the CipherTrust Manager documentation.

2. Install the CTE Agent and select the LDT feature during the install. For more information, see Installing and Registering the CTE Agent Software on Linux or Installing and Registering the CTE Agent Software on Windows.

   If the client is already registered with CipherTrust Manager, you can enable LDT on the client through the CipherTrust Manager Console. For more information, see Enabling LDT on a Protected Host.

3. Create Versioned Keys.

   LDT uses versioned keys. A versioned key rotates to the next version of the key generating new key material automatically without policy change. LDT encrypts data with keys that use encryption standards like AES-256. This allows data to be re-encrypted without users having to edit the policy.

   For more information, see Keys in LDT (Versioned Keys) and Creating and Viewing Versioned Keys.

4. Optionally create a Key Rotation Schedule that will automatically rotate the versioned keys periodically. For more information, see Creating a Key Rotation Schedule.

5. Create LDT Policies.

   LDT uses a single Live Data Transformation policy to address both initial encryption and subsequent rekeying. The same policy applies to production access and security rules without restricting user or application access to data. Applications have continuity of access to GuardPoint data during LDT.

   For more information, see Creating LDT Policies.

6. Set QoS Settings.

   QoS enables administrators to manage and control LDT impact to application workloads by monitoring and controlling the use of host system resources, such as memory or I/O utilization, during CipherTrust Transparent Encryption - Live Data Transformation. Administrators can also choose schedules for data transformation, or manually pause or resume transformation operations.

   For more information, see Quality of Service.

7. Create GuardPoints and apply LDT policies to the GuardPoints.

   A GuardPoint is a directory in the file system hierarchy, where its contents have a CipherTrust data protection policy applied to it. The CTE Agent intercepts any attempt to access anything in the GuardPoint and uses the policies obtained from the CipherTrust Manager to grant or deny the access attempt. Typically data copied into a GuardPoint is encrypted, and only authorized users can decrypt and use that GuardPoint data.

   For more information, see Creating an LDT GuardPoint.