IBM DS8700, Introduction And Planning Manual

Page: 101 / 256

administrator might accidentally migrate some data that is required by the key
server from non-encrypted to encrypted storage.
v
Consolidation of servers and storage tends to drive data migration and tends to
move more data under a generalized shared storage environment which tends to
be encryption-capable as time goes on.
v The ability to detect that the data access of a key server has been compromised
cannot be detected except by power cycling the entire environment which results
in the deadlock if the access of a key server has been compromised. Even with
multiple key servers, it might not be possible to detect that all key servers
except one are dependent on the operation of the last key server such that a
single additional change that compromises the access of the last key server is all
that is required to enable the encryption deadlock.
v All IBM server platforms support fabric-attached boot devices and storage. Some
IBM servers do not support internal boot devices. It is common for boot devices
to be present within the generalized storage environment and accessible to
generalized storage management tools that support data management and
relocation.
To reduce the risk of encountering an encryption deadlock, you must be directly
involved in managing the encryption environment.
Best practices for encrypting storage environments
The section introduces the best practice procedures for using encryption in a
storage environment.
The following information is not intended to be comprehensive, but includes some
key techniques for mitigating the risk of an encryption deadlock:
v Security
v
Availability
v Encryption deadlock prevention
Security
This section describes the best practices for the security aspect of encryption.
General
When possible, provide additional physical security around hardware and
media elements that are associated with the key servers. You can also
provide additional network security around hardware that is associated
with key servers.
Keystore
The initiation of a Tivoli Key Lifecycle Manager key server involves the
specification of a password that is used to access the keystore. You must
decide whether the Tivoli Key Lifecycle Manager password must be
provided manually or whether there is some mechanism to automatically
provide the password to the Tivoli Key Lifecycle Manager. If a startup
script is used on the Tivoli Key Lifecycle Manager server that contains the
password, the script file must have access controls to prevent unauthorized
access to the file and password. For example, the file permissions cannot
allow read, write, or run access by unauthorized users. Recovery keys
must be securely maintained for future use. The division of roles between
security administrators and storage administrators must be maintained to
avoid defeating the dual control provided by these two roles. The recovery
keys must be securely stored and accessible to only security administrators.
Chapter 3. Data management features
79