IBM DS8700, Introduction And Planning Manual

Page: 102 / 256

Availability
This section describes best practices for availability as it pertains to encryption.
Key server
v
Configure key servers to automatically power on when power is
available and to automatically initiate the key server application.
v Configure the key server application to automatically start.
v
Configure redundant network fabrics between key servers and
encrypting storage. Most storage products support two or more network
connections. To improve robustness, provide independent network paths
through independent to independent key servers.
v
Define multiple security administrators and multiple storage
administrators on DS8000 storage facility images so that the loss of
access to one administrator does not prevent the ability to use a recovery
key for recovery purposes.
DS8000
Configure the DS8000 with the dual HMC option to provide redundant
access to your network. Dual HMCs can be provided by cross-coupling the
HMCs on two DS8000 systems or by providing an additional stand-alone
HMC for a single DS8000. The inability of a DS8000 to communicate with a
key server when it powers on prevents access to encrypted storage on the
DS8000.
Encryption deadlock prevention
This section describes the best practices to help prevent the encryption deadlock
condition.
General
v All personnel capable of configuring Tivoli Key Lifecycle Manager key
servers, configuring any encrypted storage products, or managing the
placement or relocation of data related to any Tivoli Key Lifecycle
Manager key servers must review, understand, and adhere to the
information in this document.
v
The change management processes at your installation must cover any
procedures that are required to ensure adherence to guidelines for
proper configuration of key servers, encrypted storage, and data
placement.
v
You must implement automated monitoring of the availability of any
equipment that is associated with management of key services and take
appropriate action to keep them operational. This equipment includes
but is not limited to key servers, SNMP masters, domain name servers,
and DS8000 HMCs.
v Review disaster recovery plans and scenarios and consider the
availability of key servers, key server backups, and key server
synchronization. When possible, each recovery site must be independent
of other recovery sites. Isolate network paths to remote key servers in
the context of a site power cycle to test that the key servers at that site
are not encryption deadlocked within that site. If such a test is
performed, it might be helpful to attempt the power cycle with the
isolated key servers offline to verify that the key servers that are not
isolated are not encryption deadlocked.
Key Server
v Configure redundant key servers. Redundancy implies independent
servers and independent storage devices. For key servers operating in
80
Introduction and Planning Guide