Secure Mode for Zero Data Loss Recovery Appliance ensures your database backups are fully encrypted

August 28, 2024 | 3 minute read
Bryan Grenn
Database, Infrastructure & Cloud Solutions Architect
Text Size 100%:

Secure Mode is a great new security feature that was added to the Zero Data Loss Recovery Appliance with the latest major software release, 23.1.  

Secure Mode

To protect your data from exfiltration (unauthorized transfer of information from a system) it is critical that you ensure the data in your database is encrypted along with your backups. 

Unfortunately, encrypted data does not compress and you had to decide between encryption and compression.  The latest release of the Zero Data Loss Recovery Appliance software includes the ability to create space efficient encrypted backups which are both.  You can read more about it in my last blog post here.

Even if you are not currently using TDE (Transparent Data Encryption) to encrypt the data in your database, you can still take advantage of this feature and ensure you backups are encrypted.

But how can you be sure that your backups are encrypted ? It's easy to miss something in your configuration and unknowling leave your data visible.

This is where setting Secure Mode on your backup policy can ensure that your backups are full encrypted, or they will be rejected.

Setting Secure Mode

The Zero Data Loss Recovery Appliance uses the concept of Protection Policies to group databases together that have similar  recovery characteristics.

This ensures that all of your database, all of your critical production databases for example, have the same settings.

When you add a new database and add it to the policy, it automatically inherits those settings.

A few of the typical settings you see for a protection policy are

  • Recovery Window Goal - The length of point-in-time recovery you want to preserve for these database
  • Compliance window - The period of time you want to lock backups (immutable) so that they can not be changed or removed.
  • Unprotected Data Window - The maximum amount of dataloss that is tolerable before an alert is triggered.

Secure Mode is a new setting on a protection policy that affects all databases that are a member of that policy.

At the top of this post, you can see in OEM this option as part of creating or updating a protection policy.

 

Creating Encrypted backups

In OEM (Cloud Control) along with adding the encryption check to a policy, changes were made to backup scheduling that allows for a database to create encrypted backups.

There are some pre-requisites and these are outlined on the schedule backup window screenshot below from the latest OEM plugin.

You can turn on encryption for backups (when all the prerequisites are met), and you can chose the encryption level.

 

Schedule encrypted backup

 

Verifying Encrypted backups

 

When Secure mode is set on a policy, a check is made during the backup process to ensure that the backup is fully encrypted.  

If your backup is not fully encrypted the backup will fail and you will see the error message 

 

        ORA-64868: Only RMAN encrypted backups are supported on this Recovery Appliance.

 

This is a very important new feature that will ensure that your critical backups are fully encrypted, and alert if they are not.

Bryan Grenn

Database, Infrastructure & Cloud Solutions Architect

Bryan Grenn works as a specialist in the North America Engineered Systems sales organization.The organization’s mission is to provide unparalleled expertise to enhance the customer experience with simple, comprehensive and complete architectural solutions that are tailored to their needs.

 

Show more

Previous Post

Global Industry Analyst Perspectives on Oracle Exadata Exascale

Michael Brown | 7 min read

Next Post


University Health Network achieves better operational efficiency by moving to Oracle Exadata Cloud@Customer

Martina Keippel | 3 min read