SECURING FIBRE CHANNEL FABRICS - Brocade

Encrypting Data-at-RestEncrypting Data-at-RestData-at-rest includes tape and disk media, which require differentencryption methodologies. Disks are block-based devices and tapesare streaming devices, which usually require different modes of operationto perform the encryption. Encryption of data-at-rest can beperformed in several places in the SAN, as shown in Figure 37.• Application• Appliance• Fabric/network itself• Host• Disk• TapeEncryption can beperformed at differentpoints in the SANFabricDiskApplicationHostSwitch toswitchApplianceTapeFigure 3. SAN encryption points for data-at-restApplication-Based EncryptionThere are several schools of thought as to where encryption shouldtake place. Some applications actually require the data to beencrypted at the application level to prevent unauthorized users fromviewing certain types of data. For instance, it is possible to encrypt anentire column containing sensitive information in a database usingSecuring Fibre Channel Fabrics 111