I’m a proponent of tape elimination solutions that entirely remove tape from the data protection design or at least eliminate the tape export and transport to offsite storage. There are several solution paths you can go down like deduplication with replication or online backup service to name a few.
What if you just can’t get around the tape shuffle two-step though? Whenever humans like you or me get our hands on a tape, we open ourselves to the risk of tape loss. If you’re worried about tape loss, the next solution to consider is tape Encryption. So what are your design options for implementing tape encryption? Here are four competing tape encryption design approaches to consider.

Backup software encryption: This is usually performed on the backup client but some vendors can encrypt on the media server as well. Most backup software vendors have a software option for encryption.

SAN appliance based encryption: A device that resides in the data path of the Backup Server and the Tape Drive. The device intercepts and encrypts the data stream onto the tape drive.

Tape drive hardware encryption: Some tape drives include optional hardware specifications for encryption as data is written to tape. Hardware Encryption requires software to support the encryption management function.

SAN network encryption: SAN port traffic is rerouted through the encryption engine within the SAN switch with no rewiring of the SAN. Encryption is implemented as a port-by-port service, as apposed to the SAN appliance solution described above.

With all these solutions, Key Management is an important consideration. Remember that key management will inevitably add to the recovery process which is managed by your backup team on a daily basis as well as in a DR situation. Be sure to include the operational cost of encryption and key management into your recovery overhead.

- James Brissenden, GlassHouse Senior Consultant, Storage and Data Protection