Planning for storage of encrypted data

Determine whether your company requires stored data to be encrypted, and choose the method that best suits your needs.

Table 1. Selecting a data encryption method
Business requirement	Encryption method	Additional information
Protect data at the client level.	IBM Storage Protect client encryption	You can encrypt data at the file level by using an include/exclude list. In this way, you can maintain a high degree of control over which data is encrypted. Extra computing resources are required at the client that might affect the performance of backup and restore processes. For more information about this method, see client encryption.
Protect data in storage pool volumes on a tape drive.	Application method	When you use the Application method, IBM Storage Protect manages the encryption keys to protect data in storage pool volumes. You must take extra care to secure database backups because the encryption keys are stored in the server database. Without access to database backups and matching encryption keys, you cannot restore your data. You cannot use this method to encrypt database backups, exported data, or backup sets. For more information about the Application method, see Tape encryption methods.
Protect data on a tape drive.	Library method	When you use the Library method, the library manages encryption keys. You can encrypt both data in storage pools and other data on a tape drive. You can control which volumes are encrypted by using their bar code serial numbers. For more information about the Library method, see Tape encryption methods.
Protect data on a tape drive.	System method	When you use the System method, a device driver or the AIX operating system manages encryption. This encryption method is available only on the AIX® operating system. You can encrypt both data in storage pools and other data on a tape drive. For more information about the System method, see Tape encryption methods.