Backup security

Security of the login process

Login to an HFS server is authenticated by a Kerberos-like challenge-response mechanism.  This ensures that a unique session key is generated at each login and that passwords are not sent over the network.  As such, the login process may be said to be robust.

Security during data transfer

Data is sent to the TSM server by default unencrypted across the network.  However, it is recommended that confidential data be sent encrypted, and a facility for encrypting data to be backed up is available, using the industry standard AES (by default 128-bit, but changeable to stronger 256-bit for those running TSM 7.1.3 or higher).  For information on what to encrypt and how to encrypt it, see our page on how to encrypt files for backup.

Security of the data tapes

Your data is copied to three separate tapes.  One copy resides in a tape library on University premises.  The other two copies are held in locked fireproof safes, one on-site at IT Services, one offsite in locked premises.  The data on the tapes is inaccessible without the Spectrum Protect database.  The data on the offsite tapes is encrypted.


A fuller consideration of the security of TSM is also available.

Get support

If you cannot find the solution you need here then we have other ways to get IT support

Get IT support