AS400 Iseries: Four Ways To Encrypt i5/OS Backups

Friday, July 24, 2009

Four Ways To Encrypt i5/OS Backups

Joe Hertvik discusses techniques that i5/OS users have for encrypting backups for greater protection and to satisfy auditors and government agencies, explores what technologies are available, as well as the advantages and disadvantages of using each technology

You generally have four options to encrypt backup media from your i5/OS systems.
Software encryption through IBM's Backup Recovery and Media Services (BRMS) licensed program (i5/OS V6R1 only)
Software encryption through a third-party product
Hardware encryption through tape drive capabilities
Hardware encryption through an inline encryption backup solution
All of these techniques do the job but they also exact some sort of processing price on your system. In general, software-based encrypt techniques are prone to the following problems:
They force you to rewrite your backup routines to whatever commands or techniques the encryption enabling package uses. This is true whether you're using IBM's BRMS package or whether you're using a third-party package to perform the encryption.
If you're using BRMS to encrypt your data, you have to upgrade to i5/OS V6R1.
Encrypted backups don't take well to media compaction techniques, so backed up files will generally take up more space on your backup media.
Software encrypted backups generally take longer to run, because there is less compaction going on with the backup and because encryption adds another level of processing to your backup routine.