Security of the login process
Login to an HFS server is authenticated by a Kerberos-like challenge-response mechanism. This ensures that a unique session key is generated at each login and that passwords are not sent over the network. As such, the login process may be said to be robust.
Security during data transfer
Data is sent to the TSM server by default unencrypted across the network. However, it is recommended that confidential data be sent encrypted, and a facility for encrypting data to be backed up is available, using the industry standard AES (by default 128-bit, but changeable to stronger 256-bit for those running TSM 7.1.3 or higher). For information on what to encrypt and how to encrypt it, see our page on how to encrypt files for backup.
Security of the data tapes
Your data is copied to three separate tapes. One copy resides in a tape library on University premises. The other two copies are held in locked fireproof safes, one on-site at IT Services, one offsite in locked premises. The data on the tapes is inaccessible without the Spectrum Protect database. The data on the offsite tapes is encrypted.
A fuller consideration of the security of TSM is also available.
