7. Installing and Activating Encryption in Spectra T50 Libraries
82
Processes
On an organizational level, identify the level of security your site requires, and the data to be
encrypted—for example, you may choose to encrypt all data, or any combination of financial,
identity-related information, and strategic data.
Consider the following when establishing your encryption procedure:
• Determine the level of security to use at startup. Both editions of BlueScale encryption
permit a standard mode and a secure initialization mode, described in
Security on
Initialization
on page 78.
• Identify any data sets that must be isolated from other encrypted data sets, described in
Data to Encrypt
on page 79.
• Identify when to make copies of encryption keys. AES-256 encryption, a symmetric
encryption method, is a private key method. Users must track each key, which BlueScale
Encryption identifies only by a nickname, or moniker. The key itself is never displayed,
and is encrypted prior to export. Best practices dictate that you make copies of the key
immediately following the key’s creation.
• Identify the number of copies to make of each key, and note the location of each key copy.
Consider storing multiple copies of keys that you then track carefully, storing the copies
away from the data encrypted using those keys. It is important to make sure that at least
one copy of each key is secure and readable (that is, uncorrupted) to make sure you can
restore your data. This is important in that keys, once deleted, are not recoverable—and
once the key is gone, the data is inaccessible; this is typically considered deleted for legal
and practical purposes.
• Identify the key rotation plan—how often to create and use new keys. BlueScale
Encryption Standard Edition stores one key on the library at a time. In Standard Edition,
you must delete the key currently on the library before you can create another key.
Professional Edition permits multiple keys per library at a single time, with one key per
encryption-enabled partition.
• Before you delete a key, make sure that at least one copy has been exported and stored
securely so that data encrypted with the key can be decrypted later.
• Identify methods of tracking user passwords, key passwords, and monikers. If the data is
stored on a computer, make sure it is stored on a computer that enforces encryption and is
not available on a network.