Oracle Transparent Data Encryption (TDE) and General-Purpose Deduplication Technology

 

Introduction

This blog is a continuation of the past discussion on the overall industry technology and market trend posted here: Retrospective Look at the Evolution of Data Protection Technology and Market and What the Future Holds

We finished this discussion with the following summary:

  • The transition to the public cloud-heavy IT strategy is driven by new requirements of primary workload management and protection in the hybrid cloud environment.
  • Legacy “one size fits all” data protection approaches were not designed to accommodate application-native requirements and will become commoditized and less relevant over time with cloud application-defined SLAs.
  • Oracle, as a company, offers both on-premises and public cloud primary workload application development frameworks built with holistic database and application protection requirements in mind.
  • Oracle’s Zero Data Loss Recovery Appliance is the only data protection solution engineered with the Oracle database. It offers best-in-class protection for on-premises workloads today and in the future, offering the same SLAs for Oracle Cloud database and application services.

Encryption and Deduplication

So let’s talk about why this statement about “legacy “one size fits all”” does not work anymore for most of the enterprises.

The primary factor is storage optimization transitioning from the physical tape to a spinning disk as the major advancement in the storage industry is gone. Business drivers like security and ransomware protection are top of mind with CIOs, along with increasing adoption of public cloud services with a pay-as-you-go business model, which makes niche technologies such as secondary storage with deduplication less relevant. Past front-loaded Enterprise License multi-year Agreements (ELAs) for the on-prem datacenters for achieving storage optimization to improve TCO/ROI now became the onus of public service providers, directly affecting their bottom line.

We are in a “transition period” when enterprises still have  “old” business drivers in place for “one size fits all”, and the modern drivers of cloud and cyber security for business-critical applications have already significantly affected the decision-making and purchasing process in IT. 

  1. Generic data protection frameworks that employ storage-based deduplication are still valuable solutions for the multi-asset IT infrastructure to achieve a single pane of glass management across the entire portfolio.
  • Yet, in a scenario where there are specific requirements for end-to-end application security or highly stringent SLAs, generic solutions may not be a good fit.
  1. Ransomware protection is top of mind for all customers. It is NOT a single solution: it is a complete corporate strategy consisting of multiple protection layers and unified response across multiple teams.
  • The effect of a Ransomware attack is similar to a Catastrophic Event.
  • By paying the ransom, you can never be 100% confident in the quality or completeness of the recovered data
  • Therefore, planning practices must be patterned after a Disaster Recovery strategy

That leads to the following considerations:

  1. Perform the full Security Assessment with thorough discovery and comprehensive strategy development
  2. Implement business-critical workloads with end-to-end cohesive encryption throughout their lifecycle management across the entire storage stack, including backups.
  3. Create multi-level defense across application, server, and storage layers with “Last Line of Defense” designed for critical business asset recovery in the case of a catastrophic event.  

As end-to-end encryption (production to backup) increasingly becomes a primary business requirement, legacy technologies such as deduplication become less effective and, thus, less relevant.

Essentially, if any solution is NOT a part of such an end-to-end cohesive approach, it actually becomes not just a distraction but might create a significant problem for both business-critical and generic workloads: any storage system with its own in-flight or at-rest security and encryption breaks the security model, designed as a corporate ransomware and security protection. From the application and database management standpoint, retaining the effectiveness of storage optimization with deduplication requires turning off database-related encryption and compression. This creates a big trade-off, where customers must choose between storage efficiency or end-to-end security.

A recently published Technology Brief Oracle Transparent Data Encryption (TDE) and General-Purpose Deduplication Technology elaborates on the details of  Oracle Database Transparent Data Encryption (TDE) and Recovery Manager (RMAN) backup encryption and their effect on General-Purpose Deduplication Technology. Oracle strongly recommends using TDE with effective encryption key rotation as a critical part of end-to-end database security management. Turning it off just for potentially better backup storage optimization is not in the best interests of any business. While Oracle Cloud Infrastructure (OCI) has already addressed this point of contention with Zero Data Loss Autonomous Recovery Service, fully maintaining end-to-end TDE encryption while providing the highest possible level of storage optimization for database backups, on-premises IT frameworks are much more fragmented and might require a somewhat compartmentalized approach for the protection of the business critical assets vs. less important IT aspects such as test/dev.

So, focusing on such an essential factor as a security vulnerability, it is critical to understand that only Oracle Zero Data Loss Recovery Appliance is a real answer to provide a complete end-to-end secure environment as it does not break any security requirements while maintaining storage optimization of the TDE encrypted data. With a fully supported “Incremental Forever” backup strategy, both Zero Data Loss Recovery Appliance (ZDLRA) and Oracle Database Autonomous Recovery Service (ZRCV) are also capable of generating virtual point-in-time (PIT) full synthetic backups while maintaining relevant encryption keys to provide full recovery without requiring decryption of the source database TDE encrypted data. Moreover, TDE encryption keys are stored and managed separately from the backup data to ensure that, even if the backup storage is compromised, nobody will be able to steal any business-critical data.  

Just to summarize:

  • Public cloud services significantly affected the pricing calculus, shifting the decision-making to the business necessities instead of the legacy on-prem TCO/ROI-driven storage optimization technologies.
  • New emerging threats and security concerns became prevalent.
  • Any trade-off between a secured IT environment and storage optimization can potentially compromise the entire business, making the adoption of public cloud services an even more attractive option.

 

Additional resources:

Zero Data Loss Recovery Appliance
Oracle High Availability
Oracle Backup & Recovery Blog
AskTOM Backup & Recovery Office Hours
Twitter:@ZDLRAPM

Alex Goldblatt | Principal Product Manager | Backup And Recovery
Oracle Mission Critical Database Development