Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 313

• Loss of the entire array, or simultaneous loss of half of the drives in the array. If half of the drives on an array are lost, the data on those drives is compromised. The locking mechanism for the remaining drives is also compromised, leaving the data exposed. If more than half of the drives are lost, the array is rendered inoperable. In the case of a RAID-10 configuration, loss or theft of one drive in each mirrored pair could result in the data on the entire array being exposed and the RAID sets rendered inoperable. • If the drive is removed from the array but power is maintained to that drive, the drive remains unlocked. Data locking occurs when power to the drive is lost. • It is possible to recover the encryption key data from the SAS link if it is compromised ("snooped") during the process of unlocking a locked drive. • Insider attacks. For example, an administrator account can still change the ACLs on volumes, allowing different initiators to access the data on the disks. Administrators can read any volume, grant permission to anyone to read any volume, can obtain the key shares, and so on. About SED Members in a Group AutoSED operates at the member level, not at the group level. SED management is completely automatic within a member. Within a group, the administrator is responsible for deploying SED members and non-SED members properly. A pool must contain only SED members to be secure. A gold key icon indicates that the pool is fully encrypted. Volumes created in this pool are secure. Though it is permitted to mix SED members and non-SED members in the same pool, it is not recommended. An alert icon indicates that a pool is only partially encrypted. Mixed pools are intended only to simplify the gradual upgrade of a pool from non-SED to SED. No security benefits should be expected until the entire pool contains only SED members. Creating a volume in a mixed pool provides no security, because some or all of the volume might reside on non-SED members. Examples 1. A group contains two pools of non-SED members. A new SED member is brought online. Add the SED member to its own pool. Volumes that you create in this pool will be secure. Volumes that you create in the nonSED pools continue to be insecure. 2. A group contains a pool of three SED members. A non-SED member is added to this pool. Every volume in this pool immediately becomes insecure. Because of Dell EqualLogic's automatic load balancing, volumes and snapshots will be spread across all the members, including the non-SED member. To return the pool to secure operation, delete the non-SED member or move it to a different pool. 3. A group contains a pool of three non-SED members. The intention is to migrate the pool to secure operation. Add enough SED members to the pool to hold your data. Delete the non-SED members or move them to a different pool. During this time, the pool is still not secure. When the process completes, the gold key icon signifies that the pool (and all of its volumes) are now secure. Back Up a Self-Encrypting Drive (SED) Key The AutoSED machinery remains functional even when severe failures have taken the array offline. The backup is needed only in exceptional circumstances, such as the loss of more than half the drives from an array. The SED key is never explicitly revealed as part of the backup process. Rather, it is encrypted into a set of three unique backup units. Any two backup units from the same backup set can be combined to decode the key. Although the key never changes (unless the member is reset), each backup set is unique. No two sets are alike, and backup units from different sets cannot be combined. The array automatically creates and presents a backup set during initial setup, when the RAID policy is configured. Additional backup sets can be manually requested at any time. About Self-Encrypting Drives (SEDs) and AutoSED 313