Spectra T50e - Best Practices

Chapter 10—Encryption and Key Management BlueScale Key Management
August 2017 User Guide—Spectra T50e Library
295
Best Practices
Toeffectivelyusekeymanagementandtoensuredatasecurity,createan
encryptionstrategyandbackitupwiththeappropriatestaffandcustom
strategiesbasedonyoursecurityrequirements.
People
Identifythekeypeoplewhoareresponsibleformanagingtheencryption
ofdatawrittentotape.
Superuser Oneormorepeoplewhohavesuperuserprivilegesonthe
library.Onlyasuperusercanaccessandconfiguretheencryptionfeatures.
See
UnderstandingUserGroupsandSecurityonpage96forinformation
aboutthethreetypesofusergroupsandwhattypesofprivilegeseachhas.
Encryption Password Holder Oneormoresuperuserswhohavethe
library’sencryptionpassword(s).
Whendeterminingthenumberofsuperusersandencryptionpassword
holders,balancetheneedsforsecurityandavailabilityfortheencrypted
data.Itmaybewisetohavemorethanasingleuserfamiliarwith
passwords,dependingonthesizeofyourorganization,sothatifone
personisnotavailable,another
cantakeover.
Keys (Data Set
Isolation)
 Singleencryptionkeystoredon
thelibraryatatime.
 Thesamekeyisusedforall
partitionsconfiguredtouse
encryption.
 Upto30encryptionkeysstoredonthe
library.
 Separateencryptionkeyscanbe
assignedtoeachstoragepartitionto
isolatedatasets.
Key Export and
Import
Asinglepasswordisusedwhen
exportingandimportingthe
encryptionkey.Theencryptionkey
isexportedinasinglefile.
ChoiceofusingoneorM‐of‐Nshares
withmultiplepasswordstoexportand
importkeys.WiththeM‐of‐Nshares
option,asinglefileofencryptedkeydata
issplitintomultipleparts,orshares(N),
andsomespecifiedsubset(M)isrequired
toimportthefilecontaining
thekeydata.
Compression Drive‐basedcompressiononly.
Compatibility
between Software
Editions
Dataencryptedusingeithersoftwareeditioncanbedecryptedbyalibrary
runningtheotheredition.
Feature Standard Edition Professional Edition