Encrypting SANs. Anyone do it?

[Gongalong]

Hi folks,

 

Simple question: does anyone encrypt their SANs, or do people rely on the inherent complexity of hooking it up to a new system, or the difficulty in stealing it?

 

Thanks

[mjk]

We lock the doors, and hope they don't have blasters.

[ChrisMiles]

I looked into it but Nimble state around 10% performance loss on ours which I don't like!

[RobFuller]

The thought has cross my mind, I'm looking into using virtual TPM chips in Hyper-v and enabling BitLocker on the virtual hard disk and encrypting in that directing. Wondering if it would ultimately be less complex come disaster recovery.

[Gongalong]

My main worry is disaster recovery. Backups should of course negate the worry about this, but still...

[ChrisMiles]

The thought has cross my mind, I'm looking into using virtual TPM chips in Hyper-v and enabling BitLocker on the virtual hard disk and encrypting in that directing. Wondering if it would ultimately be less complex come disaster recovery.

 

I'd have thought this would be much worse as you wouldn't be able to mount the vhd's to a new server if you needed to, or use any kind of item level restore in your backup solution?

[RobFuller]

I'd have thought this would be much worse as you wouldn't be able to mount the vhd's to a new server if you needed to, or use any kind of item level restore in your backup solution?

 

"DPM 2016 supports backup and recovery of Shielded VMs that have their VHDs/VHDXs protected with vTPM. Note that Item Level Recovery (ILR) and Alternate Location Recovery (ALR) to a location outside the guarded fabric is not available for this scenario." https://docs.microsoft.com/en-us/system-center/dpm/what-s-new-in-dpm-2016#

 

In DR where the whole VM is restored the vTPM i assume should stay intact.

Edited November 8, 2017 by RobFuller

[FN-GM]

Our SAN is encrypted. The obscurity of setting one up isn't a replacement for security.